Tariq Bin Azad, in Securing Citrix Presentation Server in the Enterprise, 2008
Understanding Multifactor Authentication
An authentication factor is a piece of information and process used to authenticate a person’s identity for security purposes. Two-factor authentication (2FA), shown in Figure 4.27, is an authentication mechanism based on two pieces of information: something you have, such as a smart card, token id, etc. and something you know, such as a PIN. When presented with a log-on option, the user must provide both pieces of the authentication mechanism or they will be denied access to the system. There is another factor of authentication providing multifactor authentication based on something a person is or does, such as a biometric recognition. Citrix XenApp natively supports 2FA and can support 3FA with third-party add-on products.
Figure 4.27. Understanding Multifactor Authentication
Context-Aware Multifactor Authentication Survey
Emin Huseynov, Jean-Marc Seigneur, in Computer and Information Security Handbook (Third Edition), 2017
Sound-Proof
In Sound-Proof [26] the second authentication factor is based on verification of the user’s phone’s presence near the main device (Fig. 50.9). The system compares ambient noise recorded by the main system (a laptop) with sound recorded by the mobile phone. This comparison is triggered by a push notification (the ambient sound does not need to be recorded all of the time); it is done only for a short time when the second factor is requested by the system. In case there is no ambient sound at all (which is presented as a very rare case), the system suggests that the user “clears the throat” to generate some sound.
Figure 50.9. Sound-based authentication example. SP, Sound-Proof.
Biometric Authentication for SCADA Security
Jack Wiles, in Techno Security’s Guide to Securing SCADA, 2008
Solutions Fast Track
Understand the Strengths and Weaknesses of Biometric Solutions
-
-
Know that biometrics is appropriate only in limited circumstances in SCADA security.
-
-
Analyze the number of authentication factors needed.
-
-
Make realistic choices concerning the physical traits measured for identity.
Choose Biometric Technology That Matches Your Security Priorities
-
-
Is speed of access or certainty of authentication more important?
-
-
What current, cost-effective product meets your company’s needs?
-
-
Factor complexity and environmental concerns into your decision.
Learn About Your Biometric System’s Vulnerabilities
-
-
Systems mteasuring physical characteristics external to the body may be fooled by presenting a false sample.
-
-
Biometric systems may be attacked through their software systems.
-
-
Data and software integrity is critical and must be monitored and confirmed on a regular basis in biometric scanning and comparison systems.
Prepare for Social and Legal Changes
-
-
Some people refuse to provide invasive biometric samples for any purpose, including security.
-
-
Current U.S law contains loopholes relating to storage and use of physical data for security purposes.
-
-
Expect changes in law and regulation of biometrics that could affect the use of this technology in your SCADA security system.
Identification and Authentication
Jason Andress, in The Basics of Information Security, 2011
Biometrics
When we look at biometrics, we should consider what exactly it is when we use it as an authentication factor. As we discussed in the “Identification” section at the beginning of the chapter, there is a difference between authentication and verification. When we complete an authentication transaction with a biometric identifier, we are essentially asking the user to provide evidence that he or she is who he or she claims to be; this is, by definition, verification, and not authentication. Although some biometric identifiers may be more difficult to falsify than others, this is only due to limitations in today’s technology. At some point in the future, we will need to develop more robust biometric characteristics to measure, or stop using biometrics as an authentication mechanism.
Additional Resources
Biometrics-equipped devices and readers are becoming common enough that we have begun to see very inexpensive (less than $20) versions of them on the market. It pays to research such devices carefully before we depend on them for security, as some of the cheaper versions are very easily bypassed.
This being said, we can use biometric systems in two different manners. We can use them to verify the claim of identity that someone has put forth, as we discussed earlier, or we can reverse the process and use biometrics as a method of identification. This process is commonly used by law enforcement agencies to identify the owner of fingerprints that have been left on various objects, and can be a very time-consuming effort, considering the sheer size of the fingerprint libraries held by such organizations. We also see similar use in the comparison of DNA samples taken from suspects in crimes compared to physical evidence recovered from the crime scene.
To use a biometric system in either manner, we need to put the user through the enrollment process. Enrollment involves recording the chosen biometric characteristic from the user—for instance, making a copy of a fingerprint—and recording the characteristic in the system. Processing of the characteristic may also include noting certain parts of the image, depending on the characteristic in question, to use for later matching in the system.
Characteristics
Biometric factors are defined by seven characteristics: universality, uniqueness, permanence, collectability, performance, acceptability, and circumvention [4].
Universality stipulates that we should be able to find our chosen biometric characteristic in the majority of people we expect to enroll in the system. For instance, although we might be able to use a scar as an identifier, we cannot guarantee that everyone will have a scar. Even if we choose a very common characteristic, such as a fingerprint, we should take into account that some people may not have an index finger on their right hand and be prepared to compensate for this.
Uniqueness is a measure of how unique a particular characteristic is among individuals. For example, if we choose to use height or weight as a biometric identifier, we would stand a very good chance of finding several people in any given group who are of the same height or weight. We can select characteristics with a higher degree of uniqueness, such as DNA, or iris patterns, but there is always a possibility of duplication, whether intentional or otherwise.
Permanence tests show how well a particular characteristic resists change over time and with advancing age. If we choose a factor that can easily vary, such as height, weight, or hand geometry, we will eventually find ourselves in the position of not being able to authenticate a legitimate user. We can instead use factors such as fingerprints that, although they can be altered, are unlikely to be altered without deliberate action.
Collectability measures how easy it is to acquire a characteristic with which we can later authenticate a user. Most commonly used biometrics, such as fingerprints, are relatively easy to acquire, and this is one reason they are in common use. If we choose a characteristic that is more difficult to acquire, such as a footprint, the user will need to remove his shoe and sock in order to enroll (and to authenticate again later), which is considerably more troublesome than taking a fingerprint.
Performance is a set of metrics that judge how well a given system functions. Such factors include speed, accuracy, and error rate. We will discuss the performance of biometric systems at greater length later in this section.
Acceptability is a measure of how acceptable the particular characteristic is to the users of the system. In general, systems that are slow, difficult to use, or awkward to use are less likely to be acceptable to the user [5]. Systems that require users to remove their clothes, touch devices that have been repeatedly used by others, or provide tissue or bodily fluids will likely not enjoy a high degree of acceptability.
Circumvention describes the ease with which a system can be tricked by a falsified biometric identifier. The classic example of a circumvention attack against the fingerprint as a biometric identifier is found in the “gummy finger.” In this type of attack, a fingerprint is lifted from a surface, potentially in a covert fashion, and is used to create a mold with which the attacker can cast a positive image of the fingerprint in gelatin. Some biometric systems have features specifically designed to defeat such attacks by measuring skin temperature, pulse, pupillary response, and a number of other items.
Measuring Performance
We can look at many factors when measuring the performance of a biometric system, but a few primary metrics stand out as being particularly important for gauging how well the system is working. False acceptance rate (FAR) and false rejection rate (FRR) are two of these [6]. FAR occurs when we accept a user whom we should actually have rejected. This type of issue is also referred to as a false positive. FRR is the problem of rejecting a legitimate user when we should have accepted him. This type of issue is commonly known outside the world of biometrics as a false negative.
Either of these situations is undesirable in excess. What we try to achieve with such systems is a balance between the two error types, referred to as an equal error rate (EER) [6]. If we plot out both the FAR and FRR on a graph, as we have done in Figure 2.3, the EER is the point where the two lines intersect. EER is sometimes used as a measure of the accuracy of biometric systems.
Figure 2.3. Equal Error Rate
Issues
There are several issues common to biometric systems. As we mentioned when discussing circumvention, some biometric identifiers can be easily forged. Given a falsified identifier, we face a problem; we cannot revoke such a characteristic.
Although we can remove the particular identifier from the system and no longer allow it to be used to authenticate a user, in some cases this is not practical. If we look at fingerprints as an example, we find such a commonly used identifier that someone falsely using our fingerprints could cause us great problems. Although we may currently be able to move to stronger biometrics that, at present, are not easily copied, such as an iris pattern, such efforts will not remain beyond the grasp of attackers forever.
We also face possible issues of privacy in the use of biometrics, both as owners of such systems and as users of them. When we are enrolled in a biometric system, we are essentially giving away a copy of whatever identifier is chosen, whether it is a fingerprint, iris pattern, DNA sample, or otherwise. Once such an item has been entered into a computer system, we have little, if any, control over what is done with the material. We can hope that once we are no longer associated with the institution in question, such materials would be destroyed, but we really have no way of guaranteeing this has actually taken place. Particularly in the case of DNA sampling, the repercussions of surrendering genetic material could be an issue hanging over our heads for the rest of our lives.