Upending Old Assumptions in Security

By Wendy Nather, Head of Advisory CISOs at Duo

Every time you think you’ve figured out this risk management thing, something else happens to torpedo your hidden assumptions. Remember when we assumed that an IP address was a pretty good indicator of someone’s physical location and origin, so a network-layer firewall was enough? Twenty years ago, the Jericho Forum started questioning that assumption, and today we have the zero trust movement.

This year we’re having to face the impracticality of other assumptions having to do with physical proximity and touch. We’ve known for a long time that for many people, especially for the disabled, showing up someplace in person with an ID in hand to perform an authentication was difficult, if not impossible. For help desk staff scattered outside the corporate buildings, it’s become harder to authenticate a caller who isn’t dialing in from an office phone, or who can’t show up and sign a form. I’m trying right now to figure out how to get a new passport photo taken and printed, when I used to be able to walk into a store without a mask. The physical presence factor isn’t a given, so how do we replace it?

Even biometrics are having a moment of concern, particularly with shared readers that everyone needs to touch with an ungloved finger or hand. It makes more sense for everyone to keep and use an individual biometric reader, and that drives users more towards personally assigned or provided devices. And contactless payment is great, as long as the bearer of the device doesn’t have to get too physically close to anyone else about to use it. We won’t even mention the problem with FaceID while wearing a mask.

This is where we come back to the tenet of adaptive authentication. We have to adapt to circumstances of technology use that we might not have foreseen, whether it’s a mobile phone shared within a family, a facility without cellular service, a point-of-sale terminal that is used by so many staff members in one day that individual logins take too long, or by providing a second authentication factor in a sterile operating room. And we have to plan for outages of anything we used to rely on, whether it’s within a long supply chain or key people in a workflow process.

Security For Today

The good news is that we have enough options and enough creativity to adapt. We can make risk decisions such as, “If everyone has to use an X, then everyone has to have their own X.” CISOs are used to granting exceptions to policy for specific periods of time: “You can skip that step as long as you re-verify it within 24 hours.” Let’s face it: we’re dealing with a very dynamic environment calling for numerous exceptions that may become permanent policy, so here’s what we can do:

• Document your risk decisions: who made them, who approved them, what the reasoning was behind them, and how long they’re expected to be in effect.

• Examine your controls for single points of failure (what will you do if you don’t have any connectivity of any kind?), and build in alternatives, even if you don’t feel comfortable with them. Yes, we know SMS is hackable, but sometimes it’s all we have, and it’s better than nothing.

• Security is all about tradeoffs and mitigations, so make sure you have a robust process in place where anyone can make a suggestion or a request. “Yes, you can use your own device as long as you update its software within the same time period as our managed devices.”

• And finally: build for the future, even if you don’t know what the future will bring. Flexibility is not the same as temporary fixes, and we all know that it’s the latter that tend to lead to security vulnerabilities. A cloud instance that was only supposed to be a proof-of-concept for a short time, so it isn’t secured; a website set up for a sale that has been over for weeks; a firewall port that was opened “just until we get this into production” -- even though things are changing rapidly right now, we can’t afford to build up technical debt even faster than before.

We can live in the now, but it might turn out to be a long “now.” Let’s get comfortable and stay alert.