tag:blogger.com,1999:blog-7361241058688122298.post6716673228812106771..comments2021-11-08T23:39:44.995-08:00Comments on Identity Happens: Anything goodware can do, malware can do.Marty Schleiffhttp://www.blogger.com/profile/17651772246892504175noreply@blogger.comBlogger4125tag:blogger.com,1999:blog-7361241058688122298.post-10949977212713600402011-08-18T07:52:19.758-07:002011-08-18T07:52:19.758-07:00I agree with Aidan completely.
Regarding TPM (an...I agree with Aidan completely. <br /><br />Regarding TPM (and similar hardware protection of keys): They drastically narrow the attack surface. Without hardware-protected keys, an attacker could steal private keys, and misuse them any time he wished from his own computer. With hardware-protected keys, the attacker can only misuse the keys when the victim's device is powered on (and accessible?). At my day job we're trying to reduce that threat even further, so I like the idea of augmenting TPM with trusted boot and app whitelisting, as Paul suggested. <br /><br />Regarding trusted boot: Aiden points out the problem with his question, "...where is it practiced". I hope that discussions like this can draw attention to the issue, and result in much broader availability of trusted boot. And going back to Mike's comment, it's especially needed for mobile devices.<br /><br />Regarding adaptive authentication: At my day job we're increasingly interested in these techniques (e.g., detecting multiple logins from the same account, within a short period of time, originating from geographically disperse locations). I wonder about false positives.Marty Schleiffhttps://www.blogger.com/profile/17651772246892504175noreply@blogger.comtag:blogger.com,1999:blog-7361241058688122298.post-54542365079630160032011-08-13T13:00:00.138-07:002011-08-13T13:00:00.138-07:00Using the TPM for strong machine identity is extre...Using the TPM for strong machine identity is extremely valuable and narrows down the attack surface. Trusted Boot is a nice concept but where is it practiced and there are may other places to hide malware i.e MBR, applications etc. <br />Adaptive authentication & web fraud prevention hold alot of promise. Examples include, ability to look at contextual aspects of a transaction request and compare context against a historical behavioral baseline and issue clientless demand for alternate authentication, if significant anomalies are present. TPM-based strong machine identity should be one of the contextual factors.Aidan Herbertnoreply@blogger.comtag:blogger.com,1999:blog-7361241058688122298.post-16361370067961789692011-08-12T10:16:57.911-07:002011-08-12T10:16:57.911-07:00I like the triad and believe the PC industry is mo...I like the triad and believe the PC industry is motivated and making reasonable progress on providing the 3 components. Unfortunately I wish we could say the same for the mobile industry. There seems to be a complete lack of motivation there, rather obviously because of the different customer demographic. I hear of niche cases, and even rumor of some big players providing a leg or 2 of the triad, but not really a serious effort to address security suitable to enterprise use.Mikenoreply@blogger.comtag:blogger.com,1999:blog-7361241058688122298.post-13653236922322819952011-08-10T10:27:52.104-07:002011-08-10T10:27:52.104-07:00Nice analysis Marty. I think work has to continue...Nice analysis Marty. I think work has to continue to figure out how to take advantage of hardware based PKI key stores like smart cards and TPM chips in spite of your law, (1) because of the end-to-end strength of a certificate based logon and (2) for the usability advantages. I think we need a triad of <br />(1) hardware based key stores <br />(2) trusted boot <br />(3) application whitelisting <br />together, to begin with. <br />TPM chips can give you trusted boot in theory, but don't protect the OS once it is booted, so you need application controls. Application whitelisting alone doesn't protect you from blue pill hypervisor rootkits.Paulnoreply@blogger.com