Skip to main content

Belts and Suspenders Security

Posted by: admin 9 years, 10 months ago

I continue to be astounded that one server without two-factor authentication caused the JP Morgan breach.  If a sophisticated organization like a major US financial institution can get hacked like that, what are the chances for everyone else? If you were an incoming CIO or CISO, what can you do to avoid such a disaster?

Obviously, JP Morgan is reviewing the status of all their servers (for a start).  As I mentioned before, automation and infrastructure as code will help create idempotent servers so you can be sure that they meet security requirements .  Any servers outside that level of management, should be segmented and brought in line eventually.  But I think it will increasingly make sense for servers to have two-factor authentication for remote access and administrator rights.  This is simple to do on *nix servers as services that use PAM - ie sshd, sudo, login etc can all easily require two-factor authentication.  Copying these configuration files via management tools is quite simple.  By using RADIUS as the authentication protocol, you can perform authorization in Active Directory or LDAP.  If I were going into Sony, I would require two-factor authentication for egress as well.

Certainly, this would break some things.  But that's the idea. The breaks should show you were you have issues. You need to address those issues.

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom