Slashdot Mirror
Businesses Under Pressure To 'Consumerize' Logins (betanews.com)
Almost two-thirds (64 percent) of IT leaders say their security teams are considering implementing consumer-grade access to cloud services for employees. From a report: According to the 2018 Identity and Access Management Index from digital security company Gemalto 54 percent of respondents believe that the authentication methods they implement in their businesses are not as good compared to those found on popular sites including Amazon and Facebook. Authentication methods applied in the consumer world can be applied to secure access to enterprise resources 70 percent of IT professionals believe. But despite this, 92 percent of IT leaders express concern about employees reusing personal credentials for work. This comes as 61 percent admit they are still not implementing two-factor authentication to allow access to their network, potentially leaving themselves vulnerable to cyber criminals.
We need Equifax grade security in the businessplace.
Ouch! My brain is inflamed 46% and blood pressure up 18%. Too many numbers! Will someone please translate this for me?
...omphaloskepsis often...
... most people are dumb! News at 11.
I don't respond to AC's.
Same... though I would suspect LinkedIn being a Microsoft property makes it a more likely avenue of encroachment for this kind of business in the long-run. Already enough of a nuisance to have to deal with third parties to provide access for critical business tools... let's just put all the eggs in one basket.
There is no XUL, only WebExtensions...
I'm involved in a big cloudification project and there is absolutely pressure to use consumer-grade identity services instead of your own. It's part of the massive responsibility offload that's happening. "Oh, the cloud will do that." "Oh, this SaaS product Just Works (TM)". While this is true in many cases, I highly doubt an IT department in any sort of established company is going to want Facebook to be the _default_ identity provider. I can see a use case where you have essentially "throwaway" users who work for a week or so then disappear...but if your workers generate documents and need access to shared resources, do you really want Facebook or Google knowing what they do with their IDs when logged on?
As it is now, Amazon, Google, Facebook and Microsoft may very well end up the 4 biggest "keepers of identity" at least in the consumer space. Tech has a way of running in cycles though. I saw a very interesting article a while back that wrote out what I was thinking...everyone is assumed to be a "digital native" and tech genius just because they grew up with the Internet and the smartphone, but the reality is that people actually know way less than they had to in the past. If something isn't more than a few taps and swipes away, most born-on-the-smartphone users are lost.
We do not even have two factor authentication. But even places that do seem to lack the protection mechanisms built into Google or Facebook. You have to admit that a risk based approach, looking at a multitude of factors, is better than a dogmatic approach.
You're hired, congratulations. Here's a W-4 to fill out. Give it to Julie when you're done and she'll also need to photocopy your driver's license.
Oh, and you'll need to choose an authentication provider. If you choose Blue Cross for your logins, you get 3% off your first month of health insurance premiums, but if you choose Facebook, you get three months of free TV service. I think Google doesn't have a deal right now, but if you already have an account there, it might be more convenient. Bank of America is a good option too, but the terms are that you have to carry your phone, running their app, everywhere and they'll penalize you with failed logins if you ever turn it off, so don't do that or we'll have no choice to fire you because you have to be able to log in. Subway's login system gets you loyalty points good for lunch purchases; that's a popular one. Southwest gets you a frequent flyer mile with every login. And I'm sure you saw in the news, our PR division said we had to cancel our NRA login agreement but the legislature is probably going to make us undo that in a few weeks.
"Believe me!" -- Donald Trump
Wait what? Using FB as the authentication provider is absolute nonsense! First you would give up the data both of the person logging in and of the organization as well. For the person logging in there would be information such as location, IP, and hardware/software configuration and for the corporation there would be organizational structure, locations, and possibly even current projects working on. Things that are a social engineer / hackers wet dream.
But the most nonsense part of it all is that corporations would be giving up control, this leaves corporations vulnerable to vendor lock in, API changes, and third party outages. This is just leaving the door open for extortion, loss of functionality and huge costs should the company ever want to move away to another technology.
Its one thing to implement similar procedures and processes that companies like facebook and amazon use but it is completely another to outsource your companies security to them. That any security minded person could even recommend any such thing is ludicrous and should be enough to have someone removed from IT management in any business. Ideas like this are exactly why "the cloud" will always be a contentious issue, Sure you get the benefits of economy of scale but at what costs and what potential risk, we often hear so much marketing about how cheap and easy the cloud is but no one will ever tell you what the downsides are because they are trying to sell you a product. IT management is supposed to be figuring out all of the costs and making informed decisions, unfortunately it seems as if that only entails listening to sales pitches from a couple vendors and going with what will save the company money now regardless of the potential risk and cost in the future.
To be fair, I think this is about your employer subsidizing Facebook during your paid time.
"Believe me!" -- Donald Trump
In the real world people store valuable things in massive vaults and guarded with bullets.
In the fantasy world of the Internet all of the worlds valuables are stored in cardboard boxes in the backrooms of advertising agencies.
Whether it is the house of cards that is global PKI protecting authentication and integrity of trillions of dollars of commerce or rise of centralized authentication providers the disparity between the value of what is being protected and the resources expended to do the protecting reaches new heights of absurdity with each passing day.
Yeesh, not all that hard. (1) Implement a good (SSL-based?) VPN (2) Put anything sensitive behind it for outside access (3) Assuming you're not using 2FA, require a certificate that's additionally encrypted with a strong password to connect (4) Set up clients to limit connection time. (5) Audit logins regularly
You know what 2FA does? It annoys people. It inconveniences them. It forces them to jump through hoops to do the simplest of things.
You what 2Fa doesn't do? It doesn't make things secure. Why? Because the attack vector is no longer a brute force attack on passwords and answers, but a simple email to the person indicating their account has been compromised and they need to input all their information again. Add a link in the email and you now have complete access to the person's account(s), 2FA included.
Stop linking Forbes shit, they don't deal with adblockers, and in the past have served malware.