1 Securing Embedded Passwords
Business and technical challenges; Hitachi ID Privileged Access Manager approach.
2 Baseline scenario
2017 Hitachi ID Systems, Inc. All rights reserved. 1
Slide Presentation
3 Plaintext passwords
2017 Hitachi ID Systems, Inc. All rights reserved. 2
Slide Presentation
4 Basic approach
2017 Hitachi ID Systems, Inc. All rights reserved. 3
Slide Presentation
5 Catch-22?
How does the script or application authenticate itself to the Hitachi ID Privileged Access Manager
system?
Using an ID and password?
Unattended processes cannot use a token or smart card ...
If using PKI then a password is needed to unlock the private key / certificate ...
Havent we just replaced one password with another?
6 Analysis
There is no silver bullet for this problem.
Just like perpetual motion machines.
Somebody "invents" a new one every year.
How do we make life more difficult for an attacker?
Assume hes compromised:
The applications source code...
The servers filesystem...
Backup media...
It seems we cant get away from a password at some point in the process.
How about changing this password often?
Like every time its used!
And verifying that connections come from a server at the expected location.
7 Hitachi ID Privileged Access Manager API authentication
One time password:
Use a password to sign into the web service.
Change the password at every successful login.
IP subnet filtering:
API client must come from the right subnet.
Audit logs.
2017 Hitachi ID Systems, Inc. All rights reserved. 4
Slide Presentation
8 Authentication
9 Real world complexity
Need to store current value of the OTP.
Serialize API access:
Avoid race conditions.
Must know which "new OTP" is valid.
Caching to reduce API service workload:
Imagine 100 apps, each needing passwords 10,000 times/second.
1,000,000 web service calls/second?
Cache passwords fetched from the API.
Bonus: resiliency in the event of service disruption.
Encrypt cached passwords and current OTP:
Local storage, formatting.
Key generation.
2017 Hitachi ID Systems, Inc. All rights reserved. 5
Slide Presentation
10 Authentication
2017 Hitachi ID Systems, Inc. All rights reserved. 6
Slide Presentation
11 API wrapper
Important layer to manage:
Complexity of SOAP.
OTP change management and serialization.
Password caching.
Encryption and key generation.
The wrapper is available as:
Windows native and .NET.
Linux, Unix native and and Java.
Command-line and .so/.DLL library.
12 HiPAM: PAM API CMD
Animation: ../../pics/camtasia/pam-api-cmd/pam-api-cmd.mp4
500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: [email protected]
www.Hitachi-ID.com Date: 2017-03-15 | 2017-03-15 File: PRCS:pres
