04
Mon, Nov
1 New Articles

Open Sesame: The Ali Baba Syndrome

Commentary
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Who can forget the Persian story of the woodcutter named Ali Baba? In the story, Ali Baba overhears a thief use the secret password "open sesame" and witnesses a magical cave open. In it is a trove of treasures, and after a series of calamitous adventures (in which Ali Baba kills or scares away each of the 40 thieves), Ali Baba becomes rich beyond his dreams. In the end, he passes the secret password on to his descendents, who continue to plunder the cave to the end of their days.

The Lowly Password

The lowly password has been around at least as long as the story of Ali Baba. Yet, even today, it is still often the first line of our security defenses. Identification and Authentication (I&A) is a technical term that security administrators often use to describe this security mechanism. It is designed to prevent unauthorized people (or processes) from entering our computer systems. But though we may believe our computer security techniques have long since surpassed the calamitous vulnerabilities of Ali Baba's cave, you may be surprised to learn how tenuous those protections remain.

Identification and Access

Today, I&A remains the critical building block of most computer security: It is still the basis for creating most types of access control and for establishing user accountability. To control the power of an individual or a process within the system, some form of access control is invariably used. This access control requires that the system be able to identify users and differentiate between them. Some form of user accountability must link the activities on a computer system to specific individuals.

To validate that the user is who or what he claims to be, some form of authentication is required. The same is true of any program processes being run. The authentication process typically reverts to one of three techniques: special knowledge, special token, or special recognition.

  • Special Knowledge: This is something the individual knows, such as a secret password, a Personal Identification Number (PIN number), or a cryptographic key (as when two systems communicate).
  • Special Token: This is something the individual carries in his possession, such as a key, an ATM card, a credit card, or some other form of physical identification.
  • Special Recognition: This is some sort of biometric characteristic, such as a voice pattern or fingerprint.

Authentication Tradeoffs

On computer systems, each of these authenticating methods has trade-offs between ease of use and ease of administration. And while it may appear that any of these means could provide strong authentication, there are problems associated with each.

For instance, hackers often build programs that try to break through security by repetitively guessing at passwords and user identifications. Similarly, passwords and user IDs are often stolen by hackers if they are left in exposed places. And users often forget passwords or lose the tokens that provide them with authentication. Finally, biometric systems have significant technical and cost problems.

The Ali Baba Syndrome

Today, the most common form of I&A is a user ID coupled with a password. This technique is based solely on special knowledge, something the user knows. There are other, additional password techniques, such as knowledge of a cryptographic key that a program process uses, but these techniques are essentially encrypted passwords: Once the key is known, the holder has access.

In general, password systems work by requiring the user to enter a user ID and password (or passphrase or PIN). The system compares the password to a previously stored password for that user ID. If there is a match, the user is authenticated and granted access.

There are a lot of obvious benefits to the password technique:

  • Passwords have been successfully providing security for computer systems for a long time.
  • They are integrated into many operating systems, and users and system administrators are familiar with them.
  • When properly managed in a controlled environment, password authentication has a proven track record in providing effective security.

However, there is one obvious flaw in relying upon a password security mechanism: the Ali Baba Syndrome. If a password escapes, all sorts of mischief can begin.

Secrecy and Security

The entire password security mechanism is based upon keeping passwords secret! So the task of all security administrators is to build management systems that mitigate the escape of this special knowledge to unauthorized individuals.

Here are some of the threats:

Guessing or Finding Passwords

If users select their own passwords, they tend to make them easy to remember. That often makes them easy to guess. The names of people's children, pets, or favorite sports teams are common examples. On the other hand, assigned passwords may be difficult to remember, so users are more likely to write them down.

Some computer systems are still shipped with administrative accounts that have preset passwords. Because these passwords are standard, they are easily "guessed." Although security practitioners have been warning about this problem for years, many system administrators still do not change default passwords.

Another method of learning passwords is to observe someone entering a password or PIN. The observation can be done by someone in the same room or by someone some distance away using binoculars. This is often referred to as "shoulder surfing."

Giving Passwords Away

Users sometimes give their passwords to co-workers in order to share files. In addition, people can be tricked into divulging their passwords. This process is referred to as "social engineering," and is the current vogue of many email Trojans.

Monitoring Passwords

When passwords are transmitted to a computer system, they can be electronically monitored. Monitoring by hackers or hacking viruses can happen on the network used to transmit the password or on the computer system itself. Simple encryption of a password that will be used again does not solve this problem because encrypting the same password will create the same "ciphertext"; the ciphertext itself becomes the password.

Accessing the Password File

If the password file is not protected by strong access controls, the file can be downloaded.

Password files are often protected with something called "one-way encryption109" so that plain-text passwords are not available to system administrators or hackers (if they successfully bypass other access controls). However, even if the file is encrypted, hackers can use a programming technique called "brute force" to learn passwords once the password file is downloaded.

Using Passwords as Access Control

Some mainframe operating systems and many PC applications use passwords as a means of restricting access to specific resources within a system.

Instead of using mechanisms such as access control lists (a standard feature of OS/400 and i5/OS), access in these systems is granted by entering a single password. The result can be a proliferation of passwords that reduce the overall security of a system.

For instance, Microsoft still uses a simple user ID and password as a means to map a remote disk drive to the user's system, enabling complete access to all the contents contained within the folders on the drive. This can permit a person to accidentally or intentionally spread a virus or other malware to the mapped drive, without the knowledge of the owner of the drive.

Improving Password Security

Today, the use of passwords as a means of access control is still common, but it is an approach that is often less than optimal and not cost-effective. All of these threats represent the inherent vulnerability of password security, and it is these threats that represent the heart of the Ali Baba Syndrome of compromised security.

So how can you mitigate the Ali Baba Syndrome of escaped passwords? Let's look at some of the techniques that administrators can use to help manage and password security.

Password Generators

If users are allowed to create their own passwords, they often pick words that are easy for them to remember. Unfortunately, these too often prove to be the same words that are easy for hackers to guess. Password generators can help by creating the user passwords themselves. Users are not allowed to generate their own passwords, so they can't pick the easy-to-guess ones.

Some password generators create only pronounceable non-words to help users remember them. However, remember that users tend to write down hard-to-remember passwords, and this creates its own security vulnerability. Clearly, the users should be aware of this risk, and a user who loses a password should be made accountable for the danger.

Limits on Log-In Attempts

Most operating systems can be configured to lock a user ID after a set number of failed log-in attempts.

This prevents "guessing" by hackers, but it also creates a problem for administrators, especially in a 24x7 networked environment. If a user loses access during off-hours, there must be some method for resetting the password and obtaining the new version without security administrator intervention.

Password Attributes

Users can be instructed, or the system can force them, to select passwords with a certain minimum length and/or with special characters that are unrelated to their user ID and not in an online dictionary.

This technique makes passwords more difficult to guess. Unfortunately, it also makes the password more likely to be written down.

Periodic Password Change Requirements

Users can be required to periodically change their passwords. This requirement can reduce the damage done by stolen passwords and can make brute force attempts to break into systems more difficult. However, if you require password changes too frequently, you stand the chance of irritating users, who must readjust their "special knowledge" of passwords to perform their routine jobs.

Password File Protection

This technique involves using a method of access control to mitigate the loss of password files. One of IBM's key enterprise-level solutions is single sign-on, which enables an individual to use one user ID and password to access multiple systems in the network. This is, in essence, a password file/database system that consolidates user IDs, passwords, and access control into an encrypted management system. Other systems exist for different operating systems, too. Access control and one-way encryption can even be used to protect these password files/databases.

For more information about single sign-on and encryption, see Carol Woodbury's three-part series on this topic, starting here and ending in this issue of MC Mag Online.

Beyond Passwords

Most analysts agree that security systems will ultimately evolve toward more cost-effective methods of biometric authentication. However, that transformation is still quite a ways away. Retinal scanners and fingerprint recognition systems--though existing in the most secure environments--are still much too expensive for common business use. DNA matching for security is still in the realm of sci-fi. So, until biometric technology becomes cost-effective, our computer security systems will continue to rely upon basic password authentication techniques.

As a result, thwarting the Ali Baba Syndrome of escaped passwords will also continue to be the priority of most security administrators well into the future. As new hacking techniques and virus infections spread through our connected systems, mitigating their impact will likewise occupy more and more attention.

Keep Ali Baba at Bay!

Ali Baba was a simple woodcutter who overheard a couple of magic words. With that power, he overthrew the regime of the 40 thieves and grew rich beyond his dreams. Make certain you are protecting your systems from the Ali Baba Syndrome. Strengthen your password security, build user awareness of the risks, and mitigate your exposure with time-tested password security techniques.

Thomas M. Stockwell is Editor in Chief of MC Press Online, LP.

Thomas Stockwell

Thomas M. Stockwell is an independent IT analyst and writer. He is the former Editor in Chief of MC Press Online and Midrange Computing magazine and has over 20 years of experience as a programmer, systems engineer, IT director, industry analyst, author, speaker, consultant, and editor.  

 

Tom works from his home in the Napa Valley in California. He can be reached at ITincendiary.com.

 

 

BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: