4 ms·
> Who are these people in the tech. departments making these decisions ? It is not the "tech. departments" making the decisions. It is a PHB [1] in the "secur
by pwg 4y ago
> Who are these people in the tech. departments making these decisions ?
It is not the "tech. departments" making the decisions.
It is a PHB [1] in the "security department" following a checklist of "recommended practices" and one of the checkboxes on the list is "add SMS 2FA".
I.e., you are looking at it as a technical decision where the pros and cons security wise are weighed and the better technical solution is selected.
Which is not at all how these decisions occur in the real world in real businesses, and esp. in stodgy ones like banks/finance. Instead the decision is driven not by technical merit but by what "options" are provided on the checklist they must follow, that checklist often being sourced from whatever govt. regulator provides their oversight.
The technical people building the solutions likely know all the problems, but are powerless to do anything but implement the directed solution, because the directed solution is the only one available on the "checklist" from which they are allowed to select.
[1] PHB = Pointy Haired Boss -- Dilbert cartoon reference
- hwbehrens 4y agoOne way that you can influence the situation is by addressing the PHB directly, in a language they understand: NIST 800-63B [0]. To reach Authenticator Assurance Level (AAL) 2, there are restrictions placed on PSTN-delivered OOB verification as described in Sec. 5.1.3.3. They explicitly state (in Sec. 5.2.10) that the validity of restricted authentication can change at any time, AND that organizations "SHALL" offer alternative MFA options that are not restricted. Specifically: "The use of a RESTRICTED authenticator requires that the implementing organization assess, understand, and accept the risks associated with that RESTRICTED authenticator" So now when you go to the PHB and say, the government says that we are potentially opening ourselves up to legal liability according to such-and-such document subsection whatever, you're much more likely to get allocated resources to implement alternative options. Plus, the government could potentially disallow phone-based 2FA at any time! Imagine how the board will react when they find that we didn't plan for this contingency and suddenly can't comply... [0]: https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html
- tssva 4y agoSince the document you link to is applicable to federal government systems only and neither opens you up to any legal liability nor implies the government will ban SMS 2FA for non-government systems at any time, the PHB will likely tell you to take a flying leap.
- ghaff 4y agoAnd it's also driven by solutions that will cause the least customer friction even at the cost of some (acceptable) loss of security. We need the tech equivalent of PHB for techies who think it's just about the best solution from a purely technical viewpoint.