3 ms·
One issue in the critical infrastructure space is that many of these MFA solutions are less robust and resilient than no MFA. Anything based on calling out to a
by g_p 5y ago
One issue in the critical infrastructure space is that many of these MFA solutions are less robust and resilient than no MFA. Anything based on calling out to an external service (Duo, for example) is likely to be less resilient [1] than the static, no-external-dependencies system they use for plain password Auth.
Clearly moving towards complex systems like RADIUS and SAML introduce even more moving parts that sit with interconnects between trusted and untrusted, internal and external components. That becomes a point of failure in the eyes of infrastructure companies.
The challenge here seems to be getting the IT world to understand the focus on availability in critical infrastructure - historically, the focus has been on availability first, integrity second, confidentiality third.
You could argue this shouldn't apply to VPN interfaces in to manage systems, but given the external dependencies of these systems, they feel far less likely to remain available than the kind of solutions the sector expects.
On a separate note though, critical infrastructure need to re-think their budgets to pay for their increased availability needs, given most of the commercial solutions are third party hosted "as a service" offerings.
[1] https://status.duo.com/history?page=2 https://status.duo.com/history?page=2
- goodoldneon 5y agoUnavailability of Duo’s MFA product is extremely rare. But when it does happen, IT admins can switch to “bypass” mode to only require the 1st factor. So even though Duo doesn’t have 100% uptime, you’re no worse than no MFA
- g_p 5y agoScrolling through their incident feed, it seems to be a bit more frequent than "extremely rare". Remember that critical industry is a sector where patching software is viewed as risky, because changing anything when it works is seen as unnecessary, and would often have weeks or months of pre-deployment testing. They work on a different time-base to the IT world. The ability to do a "bypass" is nice in theory, but the need for this option will resonate with the "old guard", who will be able to use this external dependency to keep it out. Personally I prefer smartcard-based solutions for MFA, since you can do all verification offline without requiring any third party to inject themselves into the chain. I found a good example of a vulnerability this year in Duo that just shows their validation logic is complex enough that one user was able to pass 2FA as another user [1]. That's probably your second worst case scenario, with the worst being an outsider being able to pass 2FA. A well-implemented smartcard scheme shouldn't fail in this way, as you're distributing validation logic to each device, rather than centralising it and relying on a "trusted outsider" to give a "yes or no". [1] https://sensepost.com/blog/2021/duo-two-factor-authentication-bypass/ https://sensepost.com/blog/2021/duo-two-factor-authenticatio...
- sofixa 5y agoPersonally i prefer TOTP. It can be phone or card based, but it's very easy to use, deploy, and rotate. The logistics of shipping and rotating physical smartcards to employees, not to mention having said employees carry that smartcard around with them, seems too much for basically no gain.
- g_p 5y agoOne downside of TOTP is that there's no phishing protection - a TOTP credential can be phished, relayed and replayed in real-time.