Info Security & ID Mgmt

Wednesday, December 06, 2006

Organizations today are filling terabytes, even petabytes of information on to their servers. This could be in the form of customer details, fianncial information and other sensitive data. All this data is undoubtedly crucial for an enterprise and the biggest challenge for any organization is to maintain proper access rights to this information, so that only eligible persons can access a given set of information. Luckily, there are quite a few mechanisms through which one can guarantee a superior level of information security. These mechanisms have evolved over the last couple of decades. Let's take a look at the latest happenings in this field.

Network Access Control
The concept of stopping any unauthorized or malicious attack at the network level sounds as a dream for security specialists. And that's what NAC provides. As the name suggests, it checks for access right of any traffic between two end points, and allows only the authentic traffic to reach the other end. There are quite a few mechanisms through which NAC can work. One way is to go back to each end point and verify the
authenticity of those devices before letting the traffic go pass. Some of them run a set of vulnerability assessment and IDS tools on the traffic, to check for authenticity. And there are some which are too smart and go a level beyond all this and run and execute the traffic data, on top of a virtual machine, to check for its behavior.

After the traffic and the user generating it have been identified and scanned, the device checks them against the policy and gives access to the user according to the policies. For example, a user accessing the network from a VPN might only get access to a certain part of the network whereas the same user logging from the same network will get full access. On the other hand, any malicious or unknown user can be automatically sent to a quarantine zone or a honeypot for further analysis.

APP Firewalls
Firewalls are known to all. But there is a new type of firewall, creating a lot of interest this year. This is the Application Firewall. The hype for App Firewalls started after the release and success of SELinux, which is a good example of an App Firewall. If you understand what is SELinux and what it does, then you know what an App Firewall is.

If you don't understand it, then think of it as an advance form of the Policy Editor of Windows. After the acceptance of SELinux in the industry, many other players have entered the market. For example, SUSE brought a fully graphical App firewall called APP Armor with its latest release of Enterprise Linux (SELD 10 and SELS 10).

An Application Firewall is essentially a software which sits and communicates with the OS kernel and isolates the memory space of every application from each other. So, if one application gets attacked and compromised, then the other applications will still continue to work without any problem.

For example if someone breaks the root password of a given Linux server by running any brute force attack or dictionary attack, or by any other mechanism, and gets into the # prompt then using an Application firewall he can be restricted to change or play around with vital services running on the system such as the Web Server or the SQL server. After logging as root he still gets the privilege of a guest user.

"Our organization deals with IT and ITES (BPOs and call centers). Most of our customers implement their global development centers from our premises. In addition to iGATE specific security implementation, these customers want to implement their own security solutions for projects and processes. Due to this, handling and deploying security processes (which include access rights permission) to folders and applications, has become cumbersome. iGATE operates on heterogeneous systems due to its client requirements. Managing user accounts and associated passwords on a heterogeneous system is a cumbersome and difficult process. Due to above challenges, iGATE is evaluating various IDM solutions."

Shiva M, Vice President, Global IT Infra Support and Purchases, iGATE

Identity management
Web SSO: SSO or Single Sign On is a very well known concept. From ages software giants such as Microsoft are preaching about SSO. And each and every Server Level OS today has option for setting up interlinked Authentication servers, that can provide SSO in a given network.
But when it comes to Internet, the scenario changes. Internet being an unorganized entity, it traditionally does not have any SSO option built into its core. And it was not needed as well. But after the increase of Web Services, SAS (Software as service) and SOA it had become too necessary to have SSO over Web as well.

This area is still too new and we don't have a full-fledged solution as of now. But there are technologies such as SAML, WS-Security, etc that are working towards this end. Let's see what these technologies are and what they do.

Security Assertion Markup Language: SAML has been developed by the Security Services Technical Committee of OASIS. This is essentially an XML-based framework for user authentication, entitlement, and attribute information. SAML makes businesses capable of making assertions regarding the identity, attributes, and entitlements of a principal (user) to other entities in the network. The challenge that SAML is trying to solve is the Web SSO. SAML assumes that the principal has enrolled with at least one identity provider. The identity providers are supposed to provide local level of authentication to the principal.

WS (Web Service) Security: This is a protocol that uses and specifies the use of SAML and Cerberus for securing Web Services. The protocol contains specifications on how integrity and confidentiality can be enforced on Web Services messaging. Microsoft, IBM and Verisign initially work out this standard.

Two Factor Sign in: This is a mechanism with which a user gets an additional layer of protection with a hardware token or card based authentication, coupled with a standard PIN or password.

In such a scenario, at the first stage a user has to authenticate himself by either swapping an RF or Magnetic card or by providing a random number generated by a hardware device (called a token) to the system. In the second stage, the user has to provide a standard PIN or password to gain the full authentication.

Automated provisioning: It's a system for creating and managing multiple instances of a service within a shared IT infrastructure. The network administrator maintains a set of computing resources that can be allocated to different services and then to users based on policies.
The users can then request to access services of a particular type, and instances of these services are then provisioned to meet their requirements.

Role based access control: There are roles for different job related functions. And then permission is allotted according to the type of roles. Now, instead of assigning direct policies to a certain user or group, they are assigned roles. And through those role assignments, the users get the required permissions to perform any particular task in the network.

As users/groups are not assigned policies directly but have acquired the policies through roles, management of individual user/group rights becomes very easy. All you have to do in this case is to allocate proper role to a given user. This simplifies the task of editing a user, changing user policies or even adding new users. This feature can be achieved by using any LDAP server. Microsoft is a vendor in this space.

Self-destructive USB drives
Very recently Microsoft had patented a new technology and soon we will see those all around us. This is an innovative idea and is called “Volatile Potable Memory”. In normal terminology we will call it self-destructing Pen drives.

The idea comes from a point that MS has certain application which creates and writes sensitive information related to the configuration of networks and network devices to USB pen drives. And if by some means the devices is lost or stolen, then it creates a high risk of Network Compromise.
So, to solve this issue MS had came up with this concept of VPM or Volatile Portable Memory. The working mechanism of such a devices is very simple. When you copy some data into the drive it also gets charged for one hour.

And after this time period it automatically discharges and shuts down erasing all the data inside it. this mechanism is also called timed erasure mechanism.

Page(s)   1