Problems With Centralized Passwords

1. Problems With Centralized Passwords Dartmouth College PKI Lab

2. Users HATE username/passwords Too many for them to manage: Re-use same password Use weak (easy to remember) passwords Rely on “remember my password” crutches Forgotten password help desk calls cost $25 - $200 (IDC) and are far too common As we put more services online, it just gets worse… Managing the Multitude: User Perspective

3. Many different username/password schemes to learn, set up, and administer: Backups, password resets, revoking access, initial password values, etc. Multiple administrators have access usernames/passwords – many points of failure Managing the Multitude: Admin Perspective

4. Traditional approaches Single password Single sign-on, fewer sign-ons PKI Local password management by end user Two factor authentication Ending the Madness

5. Users like it, but… Requires synchronizing passwords (inherently problematic) – actually makes admin madness worse! Single username/password becomes single point of failure… Hack weakest application and get passwords to all applications! Costly to maintain and difficult to make work well. Single Password

6. More secure & provides some relief for users, but… Requires infrastructure (e.g. WebISO or Kerberos sidecar). Fewer sign-ons still has synchronization problems. Single sign-on solutions are for web applications only. Kerberos sidecar has problems with address translation and firewalls and is not widely supported. Single Sign-on, Fewer Sign-ons

7. Corrupts value of username/password for authentication and authorization. Users do share passwords: PKI Lab survey of 171 undergraduates revealed that 75% of them shared their password and fewer than half of those changed it after sharing. We need two factor authentication to address password sharing. Password Sharing

8. Traditional username/password authentication requires access to passwords database from network servers or authentication server: Bad guys have network access, can use this to crack individual accounts or worse, get many or all passwords in one grand hack. How would you like to have to notify thousands of users to satisfy FERPA requirements when their accounts are breached? This has happened! Multiple (possibly many) system administrators have access to user passwords. Traditional Single Sign-on or Fewer Sign-on means once a username/password is compromised, access to multiple services is compromised. All Your Eggs in One Basket

9. Users manage their own (single or few) passwords. Two factor authentication. Widely supported alternative for authentication to all sorts of applications (both web-based and otherwise). PKI’s Answer to Password Woes

10. PKI can eliminate user passwords on network servers. Password to PKI credentials are local in the application key store or in hardware token. User manages the password and only has one per set of credentials (likely only one or two). Still need process for forgotten password, but it is only one for all applications using PKI authentication, and users are much less likely to forgot it since they use it frequently and control it themselves. PKI Passwords Are Local to Client

11. User maintains password on their credentials. PKI credentials authenticate user to the various services they use via PKI standards. No need for password synchronization. No additional infrastructure other than standard PKI and simple, standard hooks for PKI authentication in applications. Typically less effort to enable PKI authentication than other SSO methods. PKI Enables Single Passwordand Single Sign-on

12. Requires something the user has (credentials stored in the application or a smartcard or token) in addition to something a user knows (local password for the credentials). Significant security improvement, especially with smartcard or token (a post-it next to the screen is no longer a major security hole). Reduces risk of password sharing. PKI Provides Two Factor Authentication

13. Benefits of PKI Dartmouth College PKI Lab

14. There are many problems managing network services usernames and passwords in the real world (see Problems With Centralized Passwords). PKI offers the best solution for cost-effectively securing network applications for your enterprise without driving users crazy. Password Management & SSO

15. Our computerized world still relies heavily on handwritten signatures. PKI allows digital signatures, recognized by Federal Government as legal signatures: Reduce paperwork with electronic forms. Much faster and more traceable business processes. Improved assurance of electronic transactions (e.g. really know who that email was from). http://museum.nist.gov/exhibits/timeline/item.cfm?itemId=78 Digital Signatures

16. Can use same PKI digital credentials as authentication and digital signatures. More leverage of the PK Infrastructure. Easy to encrypt data for any individual without prior exchange of information – simply look up their certificate which contains their public key. Encryption

17. Fewer passwords! Consistent mechanism for authentication that they only have to learn once. UT Houston Medical Center users now request that all network services use PKI authentication. Same user credentials for authentication, digital signatures, and encryption – lots of payback for user’s effort to acquire and manage the credentials. User Convenience

18. Centralized issuance and revocation of user credentials. Consistent identity checking when issuing certificates. Same authentication mechanism for all network services. Leverage investment in tokens or smart cards across many applications. Coherent Enterprise-Wide Security Administration

19. Inter-institution trust allows identity verification and encryption using credentials issued by a trusted collaborating institution: Signed forms and documents for business process (e.g. grant applications, financial aid forms, government reports) Signed and encrypted email from a colleague at another school Authentication to applications shared among consortiums of schools Peer to peer authentication for secure information sharing Interoperability With Other Institutions

20. Standards promise interoperability among vendors and open source, and already deliver in practice. Wide variety of implementations available and broad coverage of application space. Level playing field for open source and new vendors – promotes innovation and healthy competition. Standards Based Solution

21. Commercial and open source Development toolkits and applications Certificate Authority, directory, escrow, revocation, and other infrastructure tools Windows, Macintosh, Linux, Solaris, UNIX Software and hardware key storage Apache, Oracle, IIS, SSL, Web Services, Shibboleth, etc. Microsoft, Sun, Cisco, IBM, BEA, RSA, Verisign, DST, Entrust, AOL, Adobe, Infomosaic, Aladdin, Schlumberger, and many others Unequaled Client and Server Support

22. Industry support for PKI Federal and State governments major adopters Microsoft, Johnson and Johnson, Disney, heavy industry adopters Major deployment in Europe China pushing WAPI wireless authentication that requires PKI Web Services (SAML uses PKI signed assertions) Momentum Outside Higher Education

23. FBCA, HEBCA bridge projects Proof of concept NIH EDUCAUSE project to demonstrate digitally signing documents for submission to the Federal government (more later) Possible DOE, NSF, NIH applications for Higher Education? Likely Federal Opportunities