5 ms·
Question for security folks out there: So often I see these kinds of phishing attacks that have hugely negative consequences (see the MGM Resorts post earlier
by hn_throwaway_99 3y ago
Question for security folks out there:
So often I see these kinds of phishing attacks that have hugely negative consequences (see the MGM Resorts post earlier today), and the main problem is that just one relatively junior employee who falls for a targeted phishing attack can bring down the whole system.
Is anyone aware of systems that essentially require multiple logins from different users when accessing sensitive systems like internal admin tools? I'm thinking like the "turn the two keys simultaneously to launch the missile" systems. I'm thinking it would work like the following:
1. If a system detects a user is logging into a particularly sensitive area (e.g. a secrets store), and the user is from a new device, the user first needs to log in using their creds (including any appropriate MFA).
2. In addition, another user like an admin would need to log in simultaneously and approve this access from a new device. Otherwise, the access would be denied.
I've never seen a system like this in production, and I'm curious why it isn't more prevalent when I think it should be the default for accessing highly sensitive apps in a corporate environment.
- deleted 3y ago[deleted]
- fireflash38 3y agoYou're looking for quorums, or key splits. They aren't super common. You see them with some HSMs (need M of N persons to perform X action).
- joshxyz 3y agonot good with acronyms, what is hsm here?
- coderintherye 3y agoHardware security module https://en.wikipedia.org/wiki/Hardware_security_module https://en.wikipedia.org/wiki/Hardware_security_module
- justaddwater 3y agoHardware Security Module
- joshxyz 3y agoi wonder on this too if people really use shamir secret sharing as part of some security compliance
- aberoham 3y agoTeleport has two person rule + hardware token enforcement, https://goteleport.com/resources/videos/hardened-teleport-access/ https://goteleport.com/resources/videos/hardened-teleport-ac...
- hn_throwaway_99 3y agoReally, really appreciate you sending this! I will dig in but this seems to be exactly what I was asking about/looking for. I'm always really curious why the big native cloud platforms don't support this kind of authentication natively.
- johngalt 3y agoMechanisms like this exist, but they probably aren't integrated into whatever system you are using, and delays which involve an approval workflow add a lot of overhead. In most cases the engineering time is better spent pursuing phishing resistant MFA like FIDO2. Admin/Operations time is better spent ensuring that RBAC is as tight as possible along with separate admin vs user accounts.
- landemva 3y agoTransactions (messages) can be required to have multi-sig, if that is desired. There are smartphone apps and various tools to send a multi-sig message: https://pypi.org/project/pybtctools https://pypi.org/project/pybtctools
- SoftTalker 3y agoI've worked in places where to get access to production or other sensitive stuff, an employee would need to submit a request which had to be approved by whoever was designated to approve such things. Then the employee got a short-lived credential that could be used to log in. Everything they did was logged. Once used, the credential could not be used for subsequent logins. Their session was time-limited. If they needed more time, they needed to submit another request.