Problems With Centralized Passwords

Dartmouth College PKI Lab

Managing the Multitude: User Perspective

• Users HATE username/passwords• Too many for them to manage:

– Re-use same password

– Use weak (easy to remember) passwords

– Rely on “remember my password” crutches

• Forgotten password help desk calls cost $25 - $200 (IDC) and are far too common

• As we put more services online, it just gets worse…

Managing the Multitude: Admin Perspective

• Many different username/password schemes to learn, set up, and administer:– Backups, password resets, revoking

access, initial password values, etc.

• Multiple administrators have access usernames/passwords – many points of failure

Ending the Madness

• Traditional approaches– Single password– Single sign-on, fewer sign-ons

• PKI– Local password management by end user– Two factor authentication

Single Password• Users like it, but…

• Requires synchronizing passwords (inherently problematic) – actually makes admin madness worse!

• Single username/password becomes single point of failure… Hack weakest application and get passwords to all applications!

• Costly to maintain and difficult to make work well.

Single Sign-on, Fewer Sign-ons

• More secure & provides some relief for users, but…

• Requires infrastructure (e.g. WebISO or Kerberos sidecar).

• Fewer sign-ons still has synchronization problems.• Single sign-on solutions are for web applications only.• Kerberos sidecar has problems with address translation

and firewalls and is not widely supported.

Password Sharing

• Corrupts value of username/password for authentication and authorization.

• Users do share passwords: PKI Lab survey of 171 undergraduates revealed that 75% of them shared their password and fewer than half of those changed it after sharing.

• We need two factor authentication to address password sharing.

All Your Eggs in One Basket• Traditional username/password authentication

requires access to passwords database from network servers or authentication server:– Bad guys have network access, can use this to crack

individual accounts or worse, get many or all passwords in one grand hack. How would you like to have to notify thousands of users to satisfy FERPA requirements when their accounts are breached? This has happened!

– Multiple (possibly many) system administrators have access to user passwords.

• Traditional Single Sign-on or Fewer Sign-on means once a username/password is compromised, access to multiple services is compromised.

PKI’s Answer to Password Woes• Users manage their own (single or few)

passwords.

• Two factor authentication.

• Widely supported alternative for authentication to all sorts of applications (both web-based and otherwise).

PKI Passwords Are Local to Client• PKI can eliminate user passwords on network

servers.• Password to PKI credentials are local in the

application key store or in hardware token.• User manages the password and only has one

per set of credentials (likely only one or two).• Still need process for forgotten password, but it

is only one for all applications using PKI authentication, and users are much less likely to forgot it since they use it frequently and control it themselves.

PKI Enables Single Passwordand Single Sign-on

• User maintains password on their credentials.

• PKI credentials authenticate user to the various services they use via PKI standards.

• No need for password synchronization.

• No additional infrastructure other than standard PKI and simple, standard hooks for PKI authentication in applications.

• Typically less effort to enable PKI authentication than other SSO methods.

PKI Provides Two Factor Authentication

• Requires something the user has (credentials stored in the application or a smartcard or token) in addition to something a user knows (local password for the credentials).

• Significant security improvement, especially with smartcard or token (a post-it next to the screen is no longer a major security hole).

• Reduces risk of password sharing.

Benefits of PKI

Dartmouth College PKI Lab

Password Management & SSO

• There are many problems managing network services usernames and passwords in the real world (see Problems With Centralized Passwords).

• PKI offers the best solution for cost-effectively securing network applications for your enterprise without driving users crazy.

Digital Signatures

• Our computerized world still relies heavily on handwritten signatures.

• PKI allows digital signatures, recognized by Federal Government as legal signatures:– Reduce paperwork with electronic forms.– Much faster and more traceable business processes.– Improved assurance of electronic transactions (e.g. really

know who that email was from).

http://museum.nist.gov/exhibits/timeline/item.cfm?itemId=78

Encryption

• Can use same PKI digital credentials as authentication and digital signatures.

• More leverage of the PK Infrastructure.

• Easy to encrypt data for any individual without prior exchange of information – simply look up their certificate which contains their public key.

User Convenience• Fewer passwords!

• Consistent mechanism for authentication that they only have to learn once.

• UT Houston Medical Center users now request that all network services use PKI authentication.

• Same user credentials for authentication, digital signatures, and encryption – lots of payback for user’s effort to acquire and manage the credentials.

Coherent Enterprise-Wide Security Administration

• Centralized issuance and revocation of user credentials.

• Consistent identity checking when issuing certificates.

• Same authentication mechanism for all network services.

• Leverage investment in tokens or smart cards across many applications.

Interoperability With Other Institutions

• Inter-institution trust allows identity verification and encryption using credentials issued by a trusted collaborating institution:– Signed forms and documents for business process

(e.g. grant applications, financial aid forms, government reports)

– Signed and encrypted email from a colleague at another school

– Authentication to applications shared among consortiums of schools

– Peer to peer authentication for secure information sharing

Standards Based Solution• Standards promise interoperability among

vendors and open source, and already deliver in practice.

• Wide variety of implementations available and broad coverage of application space.

• Level playing field for open source and new vendors – promotes innovation and healthy competition.

Unequaled Client and Server Support• Commercial and open source• Development toolkits and applications• Certificate Authority, directory, escrow,

revocation, and other infrastructure tools• Windows, Macintosh, Linux, Solaris, UNIX• Software and hardware key storage• Apache, Oracle, IIS, SSL, Web Services,

Shibboleth, etc.• Microsoft, Sun, Cisco, IBM, BEA, RSA,

Verisign, DST, Entrust, AOL, Adobe, Infomosaic, Aladdin, Schlumberger, and many others

Momentum Outside Higher Education

• Industry support for PKI

• Federal and State governments major adopters

• Microsoft, Johnson and Johnson, Disney, heavy industry adopters

• Major deployment in Europe

• China pushing WAPI wireless authentication that requires PKI

• Web Services (SAML uses PKI signed assertions)

Likely Federal Opportunities

• FBCA, HEBCA bridge projects

• Proof of concept NIH EDUCAUSE project to demonstrate digitally signing documents for submission to the Federal government (more later)

• Possible DOE, NSF, NIH applications for Higher Education?