Computer Security

[Tripper]

Can you elaborate a bit tyrist

[tyrist]

Can you elaborate a bit tyrist

What else did you want to know?

[Tripper]

Do you use 2-factor?
What type?
Doses dell provide the hardware for the 2-factor, or do they provide the computer that some other device attaches to?

[garplay]

IANALEO, but I am a serious computer security expert...

This option:

or “Risk-based Authentication” that includes a software token element comprised of a number of factors, such as network information, user information, positive device identification (i.e. device forensics, user pattern analysis and user binding), user profiling, and high-risk challenge/response questions.

is, to put bluntly, bull**** fake 2-factor authentication. If whatever authentication system deployed doesn't include either a physical device, paper cards, an app on your phone (where the access is not from the phone), etc, its not a real 2-factor system.

[sl4ck3r]

IANALEO, but I am a serious computer security expert...

This option:


is, to put bluntly, bull**** fake 2-factor authentication. If whatever authentication system deployed doesn't include either a physical device, paper cards, an app on your phone (where the access is not from the phone), etc, its not a real 2-factor system.

like hes saying. something you know + something you have.

[code33]

what?

IANALEO

[socalblue]

Originally Posted by epilepticninja
Back in the day, my only access to CLETS was via a dispatcher...If only....

When I first started we still had the typewriter that created the paper strips that were sent to CLETS ....

[Tripper]

IANALEO, but I am a serious computer security expert...

This option:


is, to put bluntly, bull**** fake 2-factor authentication. If whatever authentication system deployed doesn't include either a physical device, paper cards, an app on your phone (where the access is not from the phone), etc, its not a real 2-factor system.

And your recommendation of hardware/software is???

[garplay]

And your recommendation of hardware/software is???

IANALEO -> I am Not a Law Enforcement Officer

I'm a computer security researcher.

I haven't looked into what specific offerings are in the area for your specific application, but I have looked at the area in general.

All commercial solutions that I know of are vulnerable to session hijacking, which is why the ideal solution (which does not exist in commercial practice) is public key based transaction-authentication tokens, where the user doesn't authenticate the login but authenticates the individual transaction request. (There have been some prototypes, e.g. the ZTIC from IBM, but nothing in production AFAIK.)

But as the right solution doesn't exist, and all the real almost-right solutions are effectively equivelent in security, I'd focus on usability and ubiquity: As long as it is real 2-factor, pick the one which meets the requirements and is easiest to set up, and pick the one everyone else uses so that you can't be blamed if something goes wrong. [1]

I'd probably go with RSA SecurID tokens because of their ubiquity, and they are horribly bad on the UI but no worse than the competition and, critically, you can provide people with software tokens that run on the mobile phone, so they don't have to deal with half-a-dozen dongles sitting on their keychain.


[1] Not kidding. A lot of security engineering is not making the system secure, but making sure you, as the person in charge of security, can't get blamed when it fails. Just as nobody got fired for buying IBM, nobody has gotten fired for using SecurIDs, even when the chinese hacked them.

[tyrist]

Do you use 2-factor?
What type?
Doses dell provide the hardware for the 2-factor, or do they provide the computer that some other device attaches to?

Dell just provides the computer. We have smart cards and passwords. Use of agency hardware is required to access the database.

[BigDogatPlay]

I'm not in the LEO business any longer but do operations stuff in high tech now. We access our enterprise apps worldwide through VPN using an RSA virtual token to control access. It works very well, and does save a bunch of money over the physical tokens we used to use. The token on the machine is tied to the individual user in our case.

Not sure how that would work in a fleet deployment where in field equipment might not be issued on a one to one basis to officers, but I'm betting there is a solution for it.

[Tripper]

@tyrist, what vendor for the smartcard, is it an extra device plugged in via USB that you plug the smart card into, or is the card reader built in to the MDT?

[tyrist]

http://shop2.sprint.com/assets/pdfs/en/solutions/case_studies/LAPD.pdf

[socalblue]

http://shop2.sprint.com/assets/pdfs/...udies/LAPD.pdf

Bio-metric devices, esp an easily hackable bluetooth device, is a joke. Fingerprint scans are reduced to an unchanging numerical value. Bluetooth encryption can be broken by readily available tools.

Better than nothing but there are far superior solutions. The issues are cost, field support & ease of use.

[tyrist]

Bio-metric devices, esp an easily hackable bluetooth device, is a joke. Fingerprint scans are reduced to an unchanging numerical value. Bluetooth encryption can be broken by readily available tools.

Better than nothing but there are far superior solutions. The issues are cost, field support & ease of use.

The finger print devices are not for security. They are for suspects.