Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/7/2014
01:40 PM
Garret Grajek
Garret Grajek
Commentary
Connect Directly
LinkedIn
Google+
RSS
E-Mail
50%
50%

The Case For Browser-Based Access Controls

Is "browser-ized" security a better defense against hackers than traditional methods? Check out these two examples.

It’s apparent that network access is a hacker’s preferred point of attack. Just look at recent hacks, and to others as far back as the 2011 RSA breach. You'll see that the complexities and nuances of each network deployment simply encourage hackers. In fact, improper network segmentation is believed to be one of the primary factors in the Target HVAC breach.

Should we be giving network access to all these users? Of course not.  

Since the advent of browser-based information sharing, the need to allow full network access has incrementally decreased every year. Full network connectivity to various administrators, workers, and contractors is not only unnecessary today, it is downright dangerous.  

Security-wise, there is much that can be delivered today via the prism of an app, including browser-based apps. Take, for example, Google, which is doing a pretty good job with Google Apps teaching the world that a browser can accomplish a lot more than just sending emails and sharing pictures of cats.

Think about it. When was the last time a bank gave you network access to retrieve information on your bank account? What is standard practice to secure enterprise data in banking today is to “browser-ize” it by:

  • Hardening the web server
  • Conducting code scans
  • Filtering for known L7 attacks (cross-site scripting, etc.)
  • Securing the credential collection forms
  • Applying two-factor access controls

Once the enterprise data is put behind a quantifiable prism (which is the functionality that browsers perform), we can discern what information is being delivered to the user, such as which data stores the app is allowed to see, the roles, permissions, and authorization the app is allowed to see, and the security mechanisms the user should accomplish to achieve access.

Case in point: healthcare
Recently I was working on a project where foreign contractors were initially granted network access to manage the final leg of healthcare data processing. The enterprise auditors came in and flagged the network access as a violation of Personal Healthcare Information (PHI) access regulations. The solution? We created a web form that allowed offshore contractors to view the data they were allowed to see, and then submit an approval in accordance to the guidelines set forth by the enterprise. Most importantly, these contractors were granted no network access and thus had no visibility to the full set of PHI data.

In this case, once access was given to the user, modern L7 (web session) methods could be utilized to automate the authentication process via other web-based resources. For example, the SSO that provides information from one resource to the next can be intelligently conducted with access controls, including re-checking of group membership and re-verification of authorization. Mechanisms such as re-authentication with second factor on a timed basis, or step-up authentication for more access to the portal can also be inserted along with device registration and device inspection.

Mobile apps can also foil hackers
Mobile apps can serve the same functionality as the browser-based app, effectively quantifying both the user access and the data access in a single, functional prism of view. The mobile browser app can have similar control mechanisms, including device registration, two-factor, and host-inspection analytics. Additional mobile centric authentication can also be used, such as PUSH technology and Smart Card/NFC identification.

By restricting access to a web or mobile app or a set of web/mobile apps via a portal, enterprises can itemize and restrict:

  • Which users (or groups) get access
  • What type of authentication is required
  • What resources to which the users can have access
  • What data these resources are accessing

What’s more --  all of this access is logged, with access controls pre-determined and approved by the security, infrastructure, and yes, the network team.

Garret Grajek is a CISSP-certified security engineer with more than 20 years of experience in the information security and authentication space. As Chief Technical Officer and Chief Operating Officer for SecureAuth Corp., Garret is responsible for the company's identity ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
anon2505142574
50%
50%
anon2505142574,
User Rank: Apprentice
3/14/2014 | 10:27:47 AM
Browser Based Contrrols
It's a lot easier to insure a form-collection page/mobile app is secure - than to insure that proper network access controls are implemented across all sector  (Wifi, Lan, remote access, etc) of your network. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
3/13/2014 | 12:19:27 PM
Interesting example form healthcare
Garret, I'm curious to know how common is the strategy you described where offshore contractors were able to view data via a web form with no actual network access. 

 
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19037
PUBLISHED: 2019-11-21
ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can be zero.
CVE-2019-19036
PUBLISHED: 2019-11-21
btrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because rcu_dereference(root->node) can be zero.
CVE-2019-19039
PUBLISHED: 2019-11-21
__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg program.
CVE-2019-6852
PUBLISHED: 2019-11-20
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP har...
CVE-2019-6853
PUBLISHED: 2019-11-20
A CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum (models 9680, 5740 and 5720, bCX4040, bCX9640, 9900, 9940, 9924 and 9702) , which could enable a successful Cross-site Scripting (XSS attack) when using the products web server.