User credential / Password Security.
Recent security related embarrassment at Yahoo, LinkedIn and Sony has only proved that securing user information needs more considerations. Security is not a product rather a process.
First identifying how username/password can be leaked and its price.
Basically there are four ways an adversary can find out username/password for one or more accounts stored on the server.
1. Password guessing - Assuming adversary knows username for one or more accounts and they can
deploy dictionary attack to find correct password.
2. Adversary eavesdropping on user network ( Man in Middle Attack)
3. Adversary getting access to user computer through some virus/worm
4. Adversary getting access to username/password table or system on the server.
Password Guessing :
Fix :
Max invalid attempts strategy should be deployed, i.e. temporary lock the account after 4 or 5 invalid password attempt.
Cons :
Inconveniences to user, user will endup locking and changing passwords frequently
Attacker can easy mass lock accounts using DOS (block such IP's)
Note: Encrypting passwords at server side or securing Servers will not save one from this attack.
Man in Middle Attack :
Fix :
Enable SSL/TLS (HTTPS) minimum 128 bits, this will take care of message security and integrity.
Note : Any secure system should function on TLS otherwise it will send all communication in plain text and this communication will be freely available to everyone in middle (Local Network, ISP etc)
Key-logger / Worm :
Adversary can easily get access to username/password via installed keylogger/worm/virus on a user computer.
Fix : Application should email notify or track user logins from all IP's and alert user whenever a new IP is used.
DB Leak
Adversary can get access to database containing one or more username/password either through electronic hack, or through an unhappy employee or physical server room job.
This is major embarrassment! destroys organization brand, value and trust.
Fix :
Salt and Hash both Username/Password (i.e. one way encryption). Random salts should be stored on a separate system other than where username/passwords are stored.
These were the very high level things one needs to consider when designing security strategy.
If you are interested more details evaluations feel free to contact me on LinkedIn.
Comments