pki-enabled applications that work!

PKI-Enabled ApplicationsThat work!

Linda PrussOffice of Campus Information Security

pruss@doit.wisc.edu

Projects

• Strong VPN Authentication– Administrator access to restricted data networks

via VPN

• Laptop/desktop full disk encryption– Data encryption for computers storing restricted

data … the “lost” laptop problem

Strong VPN AuthN

• Passwords do not provide an adequate degree of safety for systems that process or store data elements defined as restricted.

• Password while easy to use are vulnerable to a wide variety of attacks and weaknesses including guessing, impersonation, observing, borrowing, snooping and dictionary attacks.

Strong VPN AuthN

• UW Madison adopted a modified version of the PCI DSS v 1.1 as the required security controls target for systems containing restricted data.

• PCI DSS 8.3 “Implement two factor authentication for remote access to the network by employees, administrators, and third parties. Use technologies such as VPN with individual certificates”

Strong VPN AuthN

• UW Madison adopted a modified version of NIST 800-63 as best practice.

• Authentication Level of Assurance 3 (LOA3) should be used for people who have access to restricted data. – LOA3 requires 2factor authentication– Can be achieved with either soft or hard tokens

Strong VPN AuthN

• How to get beyond simple password?– Do it ourselves first • Administrators and DBAs

• How to accomplish 2 factor authentication?– One Time passwords (a la RSA SecurID)

– X.509 certificate authentication

Strong VPN AuthN

• Already had existing PKI infrastructure– Mostly used for S/MIME– No infrastructure for one time passwords

• VPN approach there is no need to re-configure individual servers and other network devices.

• Many VPNs (cisco) are pki-capable

Strong VPN AuthN

• Do-able– Admins– Limited and known population• Eases Identity proofing while we shore up

infrastructure

Strong VPN AuthN

Strong VPN AuthN Cisco ASA 5510 (server side)

Strong VPN AuthN Cisco ASA 5510 (server side)

Strong VPN AuthN

• CISCO SSL VPN Client (client side)– Integrated with Microsoft certificate store– Use IE and/or certificates MMC to manage

certificates– Clients for Windows, Macintosh and Linux– Windows works with hardware token– Using x.509 for administrative access to ASDM

management console, as well.

Strong VPN AuthN

• Certificate Issues:– Soft or hard tokens• Not all OSs support hardware token• Hardware allows

– Password enforcement and– Private key never leaves token

– Still subject to many of same attacks• Keyboard loggers• Phishing?• Weak passwords

Strong VPN AuthN

• Certificate Issues:– Using the same certificate for multiple purposes– Validity periods (too short?)– Lost token or certs …• Temporary password access

– CRLs

Strong VPN AuthN

• Non-PKI Issues:– Multi-cast– Redundancy– Performance– Usability – Politics– Process – Licensing cost

Full Disk Encryption

• Primary Objective– Research and recommend a FDE product for pilot

implementation

• Many requirements

• One Requirement of Solution– Integrate with existing PKI infrastructure

Full Disk Encryption

• Typically disk/file encryption is done with symmetric keys

• Use public keys to encrypt the symmetric key• Microsoft EFS uses public keys to encrypt the

file encryption key.• Because of the “preboot” nature of disk

encryption and performance

Full Disk Encryption

• Instead tend to support strong authentication mechanisms (tokens, smartcards)

• For effective full disk encryption, password strength is critical ie. protecting the strong with the weak.

• Use “already deployed” tokens/smartcards as a mechanism to do strong authentication i.e. two factors.

Full Disk Encryption

• Selected SafeBoot (McAfee) as the FDE product to pilot.

• Safeboot has two ways to leverage our pki infrastructure:– Use token to store user symmetric key. Token

password allows you to get to symmetric key. – Use user’s public key to encrypt user’s symmetric

key. Then use token (with private key) to decrypt symmetric key.

Full Disk Encryption

• Use as key store– Allows 2 factor authN to decrypt hard disk– Must sync token password via management

console

• Use to send encrypted symmetric key– No need to physically handle token– Must have public keys/certs available via

external source ---LDAP, AD

Common Characteristics

• Leverage existing PKI infrastructure• Protect restricted data • Provide for strong authentication– Attaining LOA3 authentication assurance

Futures

• Strong AuthN to enterprise systems- Peoplesoft signon code

- Strong AuthN to Web single signon

- Expand use of S/MIME