Multi-layered security

Enterprises have typically focused on securing the network perimeter and relied on static passwords to authenticate users inside the firewall. This is insufficient, given the nature of today’s Advanced Persistent Threats (APTs) and internal risks associated with Bring Your Own Device (BYOD) adoption. Static passwords can be a potential recipe for a security disaster. In this article Julian Lovelock, Vice President of Product Marketing, Identity Assurance HID Global explains that enterprises would benefit from not only employing strong authentication for remote access, but also extending its use to cover the desktop, key applications, servers, and cloud-based systems as part of a multi-layered security strategy.

Unfortunately, choosing an effective strong authentication solution for enterprise data protection has traditionally been difficult. Available solutions have been inadequate either in their security capabilities, the user experience they deliver, or in the cost and complexity to deploy them. Now, we have the opportunity to eliminate these problems using Near Field Communications (NFC)-enabled credentials that can reside on smart cards or smartphones, and can be employed to secure access to everything from doors, to data, to the cloud. Versatile, NFC-based strong authentication solutions can:

  • Support converged secure logical access to the network and cloud-based services and resources, as well as physical access to buildings, offices and other areas;
  • Support mobile security tokens for the most convenient and secure access from smartphones or tablets; and 
  • Deliver multifactor authentication capabilities for the most effective threat protection, as part of a multi-layered security strategy.

The challenges of strong authentication

Multi-factor authentication, also known as strong authentication, combines something the user knows (such as a password) with something the user has (such as mobile and web tokens), and can also be extended to include a third factor in the form of something the user is (which can be ascertained through a biometric or behaviour-metric solution).

Users have grown weary of the inconvenience of hardware OTPs, display cards and other physical devices for two-factor authentication. Additionally, OTPs are useful only for a limited range of applications. The industry is now replacing hardware OTPs with software tokens that can be held on such user devices as mobile phones, tablets, and browser-based tokens. With software OTPs, organizations are able to replace a dedicated security token with the user’s smartphone, enabling the two-factor authentication to grow in popularity and convenience. A phone app generates an OTP, or OTPs are sent to the phone via SMS. However, there are security vulnerabilities with software OTPs that have driven the need for a far more secure strong authentication alternative, such as smart cards based on the Public Key Infrastructure (PKI). The downside to this approach, however, is its high cost and level of complexity to deploy. 

Future mobile opportunities

The benefits of NFC technology are many as it becomes a standard feature of smart phones, tablets and laptops targeted at the enterprise market
NFC-based mobile model will deliver particularly robust security, and will be especially attractive in a BYOD environment

The benefits of NFC technology are many as it becomes a standard feature of smart phones, tablets and laptops targeted at the enterprise market. Users can have a smart card or smartphone that grants access to resources by simply “tapping in” – without the need to enter a password on touch-screen devices, or the need for additional devices to issue and manage. In addition, there are a number of steadily growing NFC-based tap-in use cases that are poised for strong adoption in the enterprise, including tap-in to facilities, VPNs, wireless networks, corporate Intranets, cloud- and web-based applications, and SSO clients, among many other scenarios. These benefits and the wide range of potential applications – along with the fact that manufacturers are enabling more and more phones, tablets and laptops with NFC -- are driving many companies to seriously consider incorporating secure NFC-based physical and logical access into their facilities and IT access strategies.

The mobile model will deliver particularly robust security, and will be especially attractive in a BYOD environment. It will be implemented within a trusted boundary, and use a secure communications channel for transferring identity information between validated phones, their secure elements (SEs), and other secure media and devices. The authentication credential will be stored on the mobile device’s secure element, and a cloud-based identity provisioning model will eliminate the risk of credential copying while making it easier to issue temporary credentials, cancel lost or stolen credentials, and monitor and modify security parameters when required. It will also be possible to combine mobile tokens with cloud app single-sign-on capabilities, blending classic two-factor authentication with streamlined access to multiple cloud apps on a single device that users rarely lose or forget.

The NFC tap-in strong authentication model will not only eliminate the problems of earlier solutions, it will also offer the opportunity to achieve true convergence through a single solution that can be used to access IT resources while also enabling many other applications. These include such physical access control applications as time-and-attendance, secure-print-management, cashless vending, building automation, and biometric templates for additional factors of authentication – all delivered on the same smart card or NFC-enabled phone alongside OTPs, eliminating the need to carry additional tokens or devices. Historically, physical and logical access control functions were mutually exclusive within an organization, and each was managed by different groups. Now, however, the lines between these groups will begin to blur.

As BYOD continues to grow in popularity and many cloud-based applications are accessed from personal devices, enterprises will need to take a layered approach to security
Enterprises would benefit from employing strong authentication for cloud-based systems as part of a multi-layered security strategy

Additional considerations for the cloud

As identity management moves to the cloud and enterprises take advantage of the Software as a Service (SaaS) model, there are other critical elements to consider. For instance, it will be critical to resolve challenges around provisioning and revoking user identities across multiple cloud-based applications, while also enabling secure, hassle-free user login to those applications.

The most effective approach for addressing data moving to the cloud will likely be federated identity management, which allows users to access multiple applications by authenticating to a central portal. It also will be critical to ensure the personal privacy of BYOD users, while protecting the integrity of enterprise data and resources. Several other security issues also emerge. IT departments won’t have the same level of control over BYODs or the potentially untrustworthy personal apps they may carry, and aren’t likely to be loading a standard image onto BYODs with anti-virus and other protective software. Nor is it likely that organizations will be able to retrieve devices when employees leave. We will need to find new and innovative ways to address these and other challenges. Notwithstanding the risks, the use of mobile phones equipped with SEs, or equivalent protected containers, opens opportunities for powerful new authentication models that leverage the phone as a secure portable credential store, enabling use cases ranging from tap-in strong authentication for remote data access, to entering a building or apartment.

Additionally, as BYOD continues to grow in popularity and many cloud-based applications are accessed from personal devices, enterprises will need to take a layered approach to security, recognizing that no single authentication method is going to address the multiple devices and multiple use cases required by today’s mobile enterprise.

A Layered security approach

In addition to multi-factor user authentication as the first layer of security, both inside the firewall and in the cloud, there are four other layers that should be implemented.

The second layer is device authentication. In other words, once it is determined that the user is who he or she says she is, it is important to verify that the person is using a “known” device. For this step, it is important to combine endpoint device identification and profiling with such elements as proxy detection and geo-location.

Migration to NFC-based strong
authentication and true converged
solutions requires an extensible
and adaptable multi-technology
smart card and reader platform

The third layer is ensuring that the user’s browser is part of a secure communication channel. Browser protection can be implemented through simple passive malware detection, but this does not result in the strongest possible endpoint security. It is more effective to use a proactive hardened browser with mutual secure socket layer connection to the application. 

The fourth layer is transaction authentication/pattern-based intelligence, which increases security for particularly sensitive transactions. A transaction authentication layer can include Out-Of-Band (OOB) transaction verification, transaction signing for non-repudiation, transaction monitoring, and behavioural analysis. 

The final layer is application security, which protects applications on mobile devices that are used to deliver sensitive information. The application must be architecturally hardened and capable of executing mutual authentication. Adding this layer makes data theft much more complex and costly for hackers.

Effectively implementing these five security layers requires an integrated versatile authentication platform with real-time threat detection capabilities. Used in online banking and ecommerce for some time, threat detection technology is expected to cross over into the corporate sector as a way to provide an additional layer of security for remote access use cases such as VPNs or Virtual Desktops.

Migrating to new capabilities

Migration to NFC-based strong authentication and true converged solutions requires an extensible and adaptable multi-technology smart card and reader platform. For optimal flexibility and interoperability, this platform should be based on open architecture, and enable both legacy credential and new credential technology to be combined on the same card while also supporting NFC-enabled mobile platforms. To meet security requirements, the platform should use contactless high frequency smart card technology that features mutual authentication and cryptographic protection mechanisms with secret keys, and employs a secure messaging protocol that is delivered on a trust-based communication platform within a secure ecosystem of interoperable products. 

With these capabilities, organizations can ensure the highest level of security, convenience, and interoperability on either cards or phones, along with the adaptability to meet tomorrow’s requirements including a combination of both strong authentication for protecting the data and applications in the cloud, and contactless high-frequency smart card capabilities for diverse physical access control applications. 

With proper planning, organizations can solve the strong authentication challenge while extending their solutions to protect everything from the cloud and desktop to the door. These converged solutions reduce deployment and operational costs by enabling organizations to leverage their existing physical access control credential investment to seamlessly add logical access control for network log-on. The result is a fully interoperable, multi-layered security solution across company networks, systems and facilities.

Share with LinkedIn Share with Twitter Share with Facebook Share with What's App Share with Facebook
Download PDF version Download PDF version

Author profile

Julian Lovelock Vice President, Strategic Innovation, HID Global

In case you missed it

Which security markets are embracing touchless and contactless systems?
Which security markets are embracing touchless and contactless systems?

The idea of touchless systems has gained new levels of prominence during the last year, driven by the global COVID-19 pandemic. Contactless systems have been part of the industry’s toolbox for decades, while technologies like facial and iris recognition are finding new uses every day. We asked this week’s Expert Panel Roundtable: Which security markets are embracing touchless, contactless systems and why? 

How body worn cameras and AI can curb the issue of abusive behaviour
How body worn cameras and AI can curb the issue of abusive behaviour

Amongst the many negative consequences of the pandemic is a rise in violent and abusive behaviour across society. Health workers have experienced it on a regular basis. So too have police officers and public transport workers. Unfortunately, violence and abuse towards shop workers is also endemic in British society. To address this problem which, in truth, has been on the rise since long before the emergence of COVID-19, we need better deterrents. The ability to prosecute these offences is one such deterrent, but just as important is the ability to deescalate situations before they spill over into unacceptable or unlawful behaviour. Major retail customers In both instances, organisations of all sizes are now recognising that the answer could involve greater use of rapidly advancing body worn camera technology. Andy Marsh, the Chief Constable of Avon and Somerset Police, is one of the police officers responsible for introducing body worn cameras to the UK police force, where they are now in widespread use. Andy Marsh is one of the police officers responsible for introducing body worn cameras to the UK police force He explains that “The reason the majority of people don’t speed or drink-drive is that rational human beings weigh up the risk and consequences of breaking the law and getting caught. Body worn cameras help provide appropriate ‘desistance’, especially where there are forward-facing screens so the person interacting with the wearer can see themselves and their behaviour.” Evidence shows that if a forward-facing camera is switched on before the intervention becomes hostile, it will generally lead to a de-escalation – as often as 90% of the time, according to one of our major retail customers. Digital evidence investigations Only a tiny handful of abusive incidents ever translate into arrests and prosecutions. A key issue is a lack of clear evidence – how to get past the usual impasse of one person’s word against the other. Body worn cameras break the deadlock and allow organisations to report incidents to the police with confidence, knowing that they will lead to action. Marsh suggests that “We usually see an earlier admission, an earlier guilty plea and a more appropriate sentence, where body worn camera footage is in play.” The technology has come on in leaps and bounds in recent years. For example, it’s now possible to record high-definition footage on a lightweight device that’s barely the size of a palm. And it’s not just about the evidence organisations gather themselves. Many police forces are looking at ways to make it easier for businesses and the public to collaborate on digital evidence investigations. Body worn cameras This is good for the victims of crime because it means we get the evidence more quickly" “We’ve created an online crime portal in Avon and Somerset which people can use to pass digital evidence and material to us without an officer having to attend their premises. This is good for the victims of crime because it means we get the evidence more quickly and can take action more swiftly to resolve that issue,” adds Marsh. Our body worn cameras can now even support facial recognition thanks to new, smart AI on the devices themselves, which can scan and process faces within a three-metre distance against a pre-defined database of people (which we call a watchlist). Any matches trigger alerts or additional camera activity such as recording and streaming, while the facial recognition data of people not on the watchlist itself is not recorded or saved to assuage privacy concerns. Similar criminal behaviour Where could this technology come in handy? Well, staff at gambling venues or in-store retail workers could undoubtedly benefit from the ability to quickly spot known fraudsters or addicts who have requested that venues refuse their custom. Stewards at mass sporting events could play a key role in helping to identify people who have been banned from attending. The primary reason for using body worn cameras is to increase the safety of frontline workers The primary reason for using body worn cameras is to increase the safety of frontline workers, deescalating confrontations and limiting the use of force. AI-powered facial recognition can also serve this purpose by helping them make better-informed choices about how to handle specific situations. For example, it is a massive advantage to police officers on the beat to understand that the person they are dealing with may have a history of similar criminal behaviour. Facial recognition technology But it’s also an advantage within retail, where aggressive incidents are on the rise and staff need all the help they can get to determine what an appropriate response should be to a particular customer incident. In fact, extensive consultation with our retail, police, transport and gambling customers indicates that introducing facial recognition technology to body worn cameras could be instrumental, not just in helping to prevent crime, but in tracking down vulnerable and missing people too. Of course, facial recognition technology has to be balanced against the need to protect the privacy of ordinary citizens. Video recording using body worn cameras has to be done proportionately – the same is true for the use of facial recognition technology. The technology also has to be compliant with GDPR, Data Protection, the Information Commissioners recommendations and so on. Positive working environment Violent and abusive incidents affect everyone in the immediate vicinity and create a culture of fear Importantly, it should be for a specific, proportionate and justifiable reason which, of course, means it should never be used for indiscriminate mass surveillance. Every organisation using this technology must remember that a facial recognition system match is not proof of someone’s identity, but rather, an indication of likelihood to help inform the user rather than dictate the course of action. Violent and abusive incidents affect everyone in the immediate vicinity and create a culture of fear and apprehension. This is why it’s so important to get on top of the problem – both on a societal and at an organisational level. Body worn cameras have a vital role to play, as an evidence-gathering tool and as a deterrent that empowers the wearer and creates a more positive working environment. Deterring unlawful behaviour One of the critical roles these cameras play is in staff training, providing real-world video evidence that can be used to educate and upskill workers across a variety of industries. Society’s problem with abusive and violent behaviour cannot be solved by technology alone. But with exceptional quality camera footage now a reality, and the possibility of AI technology at the device level in real-time, body worn cameras will only get better at deterring unlawful behaviour and helping to protect hardworking frontline staff. Alasdair Field is CEO of video technology provider Reveal, which works with UK police forces and major brands such as Matalan, JD Sports and Boots to help them improve staff safety, deescalate confrontations and reduce violent and abusive incidents.

ASSA ABLOY Opening Solutions embraces BIM to smooth specification and installation of door security solutions
ASSA ABLOY Opening Solutions embraces BIM to smooth specification and installation of door security solutions

BIM (building information modeling) provides a process for creating and managing information during the building lifecycle and beyond. BIM is often equated with 3D modeling of construction projects, but the visual component is just part of the value of BIM. Additional data, such as specifications and other documentation, is also part of the process, underlying the visual aspects, helping to drive decision making and providing immediate access to detailed information about all facets of the building process. Incorporating BIM systems For the last six years, ASSA ABLOY Opening Solutions has worked with specification writers and architects in Europe, the Middle East, and Africa (EMEA) to make it easy to incorporate ASSA ABLOY Opening Solutions doors, hardware, and security solutions into BIM systems. Everyone on a project can work together in the interactive and information-rich BIM environment. BIM tools are also used by contractors, distributors, facility owners, and security consultants. BIM software BIM information relating to doors, hardware, and security solutions is available in the cloud  BIM information relating to doors, hardware, and security solutions is available in the cloud with the company’s Openings Studio BIM software. This improves the process of door scheduling and visualisation and enables customers to focus on the design, installation, and management of openings. “If you have up-to-date information inside the BIM model, you can reduce mistakes and misunderstanding in the building industry,” says Marc Ameryckx, ASSA ABLOY Opening Solutions’ BIM Manager for the EMEIA region. “It helps to eliminate mistakes before they happen or as early as possible in the building process. The earlier, the less it costs. We provide data as soon as possible in the process.” (ASSA ABLOY Opening Solutions also has comparable systems available in other regions of the global company.) Centralised data in BIM 3D model Expanding the data available in BIM provides additional value compared to merely providing “BIM objects” that can be incorporated into a BIM 3D model. The combination of BIM modeling and the underlying specifications boosts the quality of the project and its key to success, says Marc Ameryckx. Even after the building is complete, the BIM model is still valuable, providing a repository of “as-built” information that can be used by building managers and security professionals tasked with operating and maintaining the building. For example, if a lock needs to be replaced, retrofitting is simpler because all the information about the lock and existing installation is available in a centralised data file. Revit and ArchiCAD A widely used BIM software is Revit from Autodesk, a program that brings architecture, engineering, and construction disciplines into a unified modeling environment to drive more efficient and cost-effective projects. Another BIM software program is ArchiCAD, developed by the Hungarian company Graphisoft. Openings Studio™ added a plugin for ArchiCAD this year, in addition to Revit. Tailor-made information security solutions We provide tailor-made information security solutions with various hardware on projects with more doors" “We can provide tailor-made information security solutions with various hardware on projects with more doors, adding more flexibility,” says Marc Ameryckx. “Customers do not need to be the experts on the products because we provide expertise as part of our specifications.” For example, how often do building mistakes occur because of a misunderstanding about the electrical needs of a lock and the wrong cabling is installed? The problem is especially expensive if it is discovered only after the walls are complete. Providing complete data about the electrical lock as part of a BIM system avoids the snafu. Another example is the specification of a deadbolt lock on a door that operates with an electric strike. The deadbolt undermines the intended operation of the electric strike and can interfere with escape routes in case of an emergency. The mistake becomes obvious in the BIM environment and can be rectified before consequences impact the real world. Data addition to Opening Suites site ASSA ABLOY Opening Solutions is continuously expanding the data it provides at the Opening Suites site, covering additional functionality and more components including the door, cabling, and electrical connections. Hardware sets are linked to specific doors in the BIM models, including all the details of various components, including article numbers, technical sheets, electrical requirements, all depending on customer expectations. Physical equipment includes QR codes that can be scanned by a smartphone to provide information on the door (A mobile app is in development). More details and more data Experienced BIM consultants work with the Openings Studio software on projects ranging from single doors to large buildings with many doors. Data will be more and more important, and there will be more data inside BIM models Adding more data and detail to the BIM process at the level of each door expands the usefulness of BIM, which has historically been focused on broader issues such as structural work and HVAC. “Openings Studio™ provides all the data to integrate doors and security in the BIM process,” says Marc Ameryckx. The higher level of detail may be a new aspect even for customers who already use BIM software. “Data will be more and more important, and there will be more data inside BIM models,” says Marc Ameryckx. In the future, the use of “digital twins” could expand the capabilities even further; for example, the software could simulate escape routes in case of fire. More data makes more things possible.