The Perils of Mobile and Cloud Security: An Argument for Centralized Smartcards
Government agencies have moved more into the app- and cloud-centric culture that is increasingly common in most enterprises. Now, privileged rights previously reserved for an administrative user are undergoing a transition where those rights are being segregated among a number of administrators for role separation requirements. That makes user authentication more important than ever when accessing mission-critical information.
Federal mandates such as OMB’s 30-day Cybersecurity Sprint and the Cybersecurity Strategy and Implementation Plan (CISP), along with technology trends like the Internet of Things and Bring Your Own Device, put greater emphasis on identity and authentication technologies. The CSIP in particular requires derived credentials solutions and other strong authentication solutions for mobile devices, to improve mobile device management on a broader scale.
Of course, mature applications and workflows still require public key infrastructure (PKI) credentials. Smartcards work well for authentication at traditional endpoints. Smartcard-based encryption and authentication is also effective for end users’ laptop and desktop computers, and for applications such as secure email, virtual private network access, PKI-enabled Web servers, and network smartcard logon.
For mobile devices, however, smartcard-based authentication is more complicated. PKI credentials on smartcards do not translate efficiently to the mobile environment.
As endpoints increasingly address multiple mobile devices–laptops, desktops, thin clients, smartphones, tablets, and more–smartcards with PKI credentials are no longer the best solution. Smartcard readers can be cumbersome, microSD cards can be easily lost, and embedded PKI only works on specific smartphones. Software-based credentials must be replicated onto each one of a user’s devices.
What’s more, these approaches typically require their own management solution, which can be an administrative and security nightmare.
Securing PKI Credentials in Mobile and Virtual Environments
Because smartcards such as the Common Access Cards (CAC) and Personal Identity Verification (PIV) cards are not easily used with a mobile device, many agencies are looking to move to a “derived credential” model. In derived credentials, user identity credentials are presented in alternate form factors that are more mobile device friendly. The typical form factors proposed as solutions are external hardware and embedded hardware or software security modules.
Unfortunately, external hardware such as microSD cards and USB tokens often have inconsistent mobile device support, and are susceptible to being lost or stolen. Embedded security modules can be simpler to use, but they present credential management issues–every end user devices requires a separate credential to be provisioned, audited, and maintained.
Virtual desktop environments improve security for many agencies, but they also make smartcard-based PKI operations complicated. Each thin-client endpoint (including mobile devices) may need custom driver software to connect between the attached smartcard and the applications running within the virtualized environment.
This is all made more complex still when a single endpoint is used to simultaneously access multiple virtual environments by having to share a single physical smartcard. If each virtual environment issues its own identity credentials, users may have to swap smartcards in and out of their local smartcard reader, accessing only one virtual environment at a time.
Some enterprises try to avoid smartcard usage simply by deploying software-based PKI credentials. This can solve some problems, but they still face the security risks of software-based keys, with multiple user credentials sent to each user’s various endpoints.
The case for “centralized smartcards”
A more appropriate and more easily managed approach to security would be what might be called “centralized smartcards.” This type of security management allows administrators to issue users a single identity, accessible from a range of devices. Users’ PKI credentials are maintained in a secure, centralized server, with crypto operations handled from that hardware.
When an end user needs to perform a smartcard operation, the application on the endpoint would connect to a virtual smartcard reader. This would redirect crypto operations to the appropriate virtual smartcard in the centralized smartcard server. An additional security layer between the endpoint and the smartcard server provides secure transport and permits use of a variety of authentication methods for selection of an end user’s virtual smartcard.
A centralized smartcard approach would need no changes made to endpoint virtual smartcard or the PKI-enabled applications that require smartcard authentication or digital signatures. By centrally maintaining each user’s PKI credentials, users can use their same PKI keys and certificates from any endpoint.
With this approach, all PKI credentials are housed in a central location, greatly simplifying security infrastructure audit and reporting needs. User credentials (including derived credentials called for in the CISP) are never at risk of theft or loss of a separate hardware credential or the mobile device itself. A single user credential can be accessed from any and all end user devices.
In virtual environments, a centralized smartcard would considerably improve smartcard management realm. End user PKI credentials would be centrally located in a secure environment, just like the virtual desktop infrastructure model. And without the requirement to use a physical smartcard reader, the end user is free to access multiple virtual environments using a different credential, or derived credential, for each environment.
As the endpoint continues to evolve, agencies must provide a simple way for users to access everything from external cloud applications to internal secure networks from a wide variety of devices while meeting security requirements and compliance mandates. A centralized smartcard approach could greatly simplify authentication, providing users with secure access to the many networks and applications being used in our increasingly mobile and cloud-centric world.
Bill Becker is the technical director for SafeNet Assured Technologies. He can be reached at Bill.becker@safenetat.com