Who can forget the Persian story of the woodcutter named Ali Baba? In the story, Ali Baba overhears a thief use the secret password "open sesame" and witnesses a magical cave open. In it is a trove of treasures, and after a series of calamitous adventures (in which Ali Baba kills or scares away each of the 40 thieves), Ali Baba becomes rich beyond his dreams. In the end, he passes the secret password on to his descendents, who continue to plunder the cave to the end of their days.

The Lowly Password

The lowly password has been around at least as long as the story of Ali Baba. Yet, even today, it is still often the first line of our security defenses. Identification and Authentication (I&A) is a technical term that security administrators often use to describe this security mechanism. It is designed to prevent unauthorized people (or processes) from entering our computer systems. But though we may believe our computer security techniques have long since surpassed the calamitous vulnerabilities of Ali Baba's cave, you may be surprised to learn how tenuous those protections remain.

Identification and Access

Today, I&A remains the critical building block of most computer security: It is still the basis for creating most types of access control and for establishing user accountability. To control the power of an individual or a process within the system, some form of access control is invariably used. This access control requires that the system be able to identify users and differentiate between them. Some form of user accountability must link the activities on a computer system to specific individuals.

To validate that the user is who or what he claims to be, some form of authentication is required. The same is true of any program processes being run. The authentication process typically reverts to one of three techniques: special knowledge, special token, or special recognition.

• Special Knowledge: This is something the individual knows, such as a secret password, a Personal Identification Number (PIN number), or a cryptographic key (as when two systems communicate).
• Special Token: This is something the individual carries in his possession, such as a key, an ATM card, a credit card, or some other form of physical identification.
• Special Recognition: This is some sort of biometric characteristic, such as a voice pattern or fingerprint.

Authentication Tradeoffs

On computer systems, each of these authenticating methods has trade-offs between ease of use and ease of administration. And while it may appear that any of these means could provide strong authentication, there are problems associated with each.

For instance, hackers often build programs that try to break through security by repetitively guessing at passwords and user identifications. Similarly, passwords and user IDs are often stolen by hackers if they are left in exposed places. And users often forget passwords or lose the tokens that provide them with authentication. Finally, biometric systems have significant technical and cost problems.

The Ali Baba Syndrome

Today, the most common form of I&A is a user ID coupled with a password. This technique is based solely on special knowledge, something the user knows. There are other, additional password techniques, such as knowledge of a cryptographic key that a program process uses, but these techniques are essentially encrypted passwords: Once the key is known, the holder has access.

In general, password systems work by requiring the user to enter a user ID and password (or passphrase or PIN). The system compares the password to a previously stored password for that user ID. If there is a match, the user is authenticated and granted access.

There are a lot of obvious benefits to the password technique:

• Passwords have been successfully providing security for computer systems for a long time.
• They are integrated into many operating systems, and users and system administrators are familiar with them.
• When properly managed in a controlled environment, password authentication has a proven track record in providing effective security.

However, there is one obvious flaw in relying upon a password security mechanism: the Ali Baba Syndrome. If a password escapes, all sorts of mischief can begin.

Secrecy and Security

The entire password security mechanism is based upon keeping passwords secret! So the task of all security administrators is to build management systems that mitigate the escape of this special knowledge to unauthorized individuals.

Here are some of the threats:

Guessing or Finding Passwords

If users select their own passwords, they tend to make them easy to remember. That often makes them easy to guess. The names of people's children, pets, or favorite sports teams are common examples. On the other hand, assigned passwords may be difficult to remember, so users are more likely to write them down.

Some computer systems are still shipped with administrative accounts that have preset passwords. Because these passwords are standard, they are easily "guessed." Although security practitioners have been warning about this problem for years, many system administrators still do not change default passwords.

Another method of learning passwords is to observe someone entering a password or PIN. The observation can be done by someone in the same room or by someone some distance away using binoculars. This is often referred to as "shoulder surfing."

Giving Passwords Away

Users sometimes give their passwords to co-workers in order to share files. In addition, people can be tricked into divulging their passwords. This process is referred to as "social engineering," and is the current vogue of many email Trojans.

Monitoring Passwords

When passwords are transmitted to a computer system, they can be electronically monitored. Monitoring by hackers or hacking viruses can happen on the network used to transmit the password or on the computer system itself. Simple encryption of a password that will be used again does not solve this problem because encrypting the same password will create the same "ciphertext"; the ciphertext itself becomes the password.

Accessing the Password File

If the password file is not protected by strong access controls, the file can be downloaded.

Password files are often protected with something called "one-way encryption109" so that plain-text passwords are not available to system administrators or hackers (if they successfully bypass other access controls). However, even if the file is encrypted, hackers can use a programming technique called "brute force" to learn passwords once the password file is downloaded.

Using Passwords as Access Control

Some mainframe operating systems and many PC applications use passwords as a means of restricting access to specific resources within a system.

Instead of using mechanisms such as access control lists (a standard feature of OS/400 and i5/OS), access in these systems is granted by entering a single password. The result can be a proliferation of passwords that reduce the overall security of a system.

For instance, Microsoft still uses a simple user ID and password as a means to map a remote disk drive to the user's system, enabling complete access to all the contents contained within the folders on the drive. This can permit a person to accidentally or intentionally spread a virus or other malware to the mapped drive, without the knowledge of the owner of the drive.

Improving Password Security

Today, the use of passwords as a means of access control is still common, but it is an approach that is often less than optimal and not cost-effective. All of these threats represent the inherent vulnerability of password security, and it is these threats that represent the heart of the Ali Baba Syndrome of compromised security.

So how can you mitigate the Ali Baba Syndrome of escaped passwords? Let's look at some of the techniques that administrators can use to help manage and password security.

Password Generators

If users are allowed to create their own passwords, they often pick words that are easy for them to remember. Unfortunately, these too often prove to be the same words that are easy for hackers to guess. Password generators can help by creating the user passwords themselves. Users are not allowed to generate their own passwords, so they can't pick the easy-to-guess ones.

Some password generators create only pronounceable non-words to help users remember them. However, remember that users tend to write down hard-to-remember passwords, and this creates its own security vulnerability. Clearly, the users should be aware of this risk, and a user who loses a password should be made accountable for the danger.

Limits on Log-In Attempts

Most operating systems can be configured to lock a user ID after a set number of failed log-in attempts.

This prevents "guessing" by hackers, but it also creates a problem for administrators, especially in a 24x7 networked environment. If a user loses access during off-hours, there must be some method for resetting the password and obtaining the new version without security administrator intervention.

Password Attributes

Users can be instructed, or the system can force them, to select passwords with a certain minimum length and/or with special characters that are unrelated to their user ID and not in an online dictionary.

This technique makes passwords more difficult to guess. Unfortunately, it also makes the password more likely to be written down.

Periodic Password Change Requirements

Users can be required to periodically change their passwords. This requirement can reduce the damage done by stolen passwords and can make brute force attempts to break into systems more difficult. However, if you require password changes too frequently, you stand the chance of irritating users, who must readjust their "special knowledge" of passwords to perform their routine jobs.

Password File Protection

This technique involves using a method of access control to mitigate the loss of password files. One of IBM's key enterprise-level solutions is single sign-on, which enables an individual to use one user ID and password to access multiple systems in the network. This is, in essence, a password file/database system that consolidates user IDs, passwords, and access control into an encrypted management system. Other systems exist for different operating systems, too. Access control and one-way encryption can even be used to protect these password files/databases.

For more information about single sign-on and encryption, see Carol Woodbury's three-part series on this topic, starting here and ending in this issue of MC Mag Online.

Beyond Passwords

Most analysts agree that security systems will ultimately evolve toward more cost-effective methods of biometric authentication. However, that transformation is still quite a ways away. Retinal scanners and fingerprint recognition systems--though existing in the most secure environments--are still much too expensive for common business use. DNA matching for security is still in the realm of sci-fi. So, until biometric technology becomes cost-effective, our computer security systems will continue to rely upon basic password authentication techniques.

As a result, thwarting the Ali Baba Syndrome of escaped passwords will also continue to be the priority of most security administrators well into the future. As new hacking techniques and virus infections spread through our connected systems, mitigating their impact will likewise occupy more and more attention.

Keep Ali Baba at Bay!

Ali Baba was a simple woodcutter who overheard a couple of magic words. With that power, he overthrew the regime of the 40 thieves and grew rich beyond his dreams. Make certain you are protecting your systems from the Ali Baba Syndrome. Strengthen your password security, build user awareness of the risks, and mitigate your exposure with time-tested password security techniques.

Thomas M. Stockwell is Editor in Chief of MC Press Online, LP.

Thomas M. Stockwell is an independent IT analyst and writer. He is the former Editor in Chief of MC Press Online and Midrange Computing magazine and has over 20 years of experience as a programmer, systems engineer, IT director, industry analyst, author, speaker, consultant, and editor.  

 

Tom works from his home in the Napa Valley in California. He can be reached at ITincendiary.com.

 

 

Also Read

IBM i Shops Pivot to Battle COVID-19

Energy, Vibe, and Atmosphere

Murphy’s Security Law