Once IS Enough: Single Sign-On

For eons, passwords have been the gatekeepers to information and data located that is behind a ‘locked door’ or stored in a secret location. It is no different today, as passwords are a key to secrets, however, what is different today is the number of passwords that one needs to construct, recall and keep safe. This multiplicity has created a memory overload for the user, less secure passwords, and often, a strain on computer help-desk staff. Password technologies that reduce the need for multiple passwords are evolving; their developers claim that the technologies lessen the security risk to a system due to a reduction in the number of passwords required to get through the day-to-day work of a 21st century citizen. Smart cards, biometric devices, and Single Sign-On (SSO) systems are the most promoted alternatives. Specifically, Single Sign-On password systems are of interest to the study presented here. Single Sign-On allows end users to access multiple services and systems with a single username and password, therefore reducing the cognitive load on the end user and thus supposedly, reducing end user frustration which is turn reduces password-related security risks. This paper presents the results of a study conducted within two businesses that explored the influence SSO password systems have on system security

Balancing usability and security in the business cloud authentication

Jatkuvasti suosiotaan kasvattavat pilvipalvelut luovat monia uusia mahdollisuuksia etätyöntekijöille, yhteistyökumppaneille ja hakkereille päästä käyttämään yrityksen työkaluja ja asiakastietoja. Kun pilvipalveluissa olevan tärkeän yritysdatan määrä kasvaa, myös palveluiden tietoturvavaatimukset kovenevat. Pilvipalveluiden tietoturvallisessa suunnittelussa tulee ottaa huomioon lukuisia erilaisia hyökkäysreittejä monella eri palvelun tasolla aina verkon rajapinnasta yksittäisten ohjelmistokomponenttien haavoittuvuuksiin. Yksi isoimmista hyökkäysvektoreista on myös reitti, joka on pakko jättää osittain avoimeksi palvelun varsinaisia käyttäjiä varten – autentikointi, eli käyttäjien todentaminen palveluun kirjautumisen yhteydessä. Diplomityön tavoitteena oli löytää tasapainokohta ja siihen vaikuttavat tekijät pilvipalveluiden käytettävyyden ja tietoturvan väliltä. Käyttäjän autentikoinnin tulee olla tarpeeksi tietoturvallinen, etteivät mahdolliset hyökkääjät pääsisi käsiksi järjestelmän arvokkaisiin dataan ja resursseihin. Samaan aikaan autentikoinnin tulee olla myös tarpeeksi käytettävää, jotta varsinaiset käyttäjät pääsevät palveluihinsa tehokkaasti ja ilman tarpeetonta turhautumista. Aihetta lähestytään kirjallisuuskatsauksella aihealueen keskeiseen tutkimukseen ja pilvipalveluihin sopivien autentikointimenetelmien kartoittamisella. Näiden lisäksi työssä suunniteltiin ja järjestettiin kuudelle osallistujalle käytettävyystesti, jossa mitattiin käyttäjien suhtautumista neljään erilaiseen autentikointimenetelmään ja niitä yhdistelevään monen menetelmän autentikointiin (multi-factor authentication). Samalla käyttäjiltä kartoitettiin puolistrukturoiduilla haastatteluilla erilaisia tekijöitä, jotka vaikuttavat heidän kokemaansa käytettävyyden ja tietoturvan tasapainoon. Tutkimuksessa tunnistettiin useita tapoja parantaa käytettävyyden ja tietoturvan tasapainoa yritysten pilvipalveluissa. Monen keskivahvan autentikointimenetelmän yhdistelmän havaittiin olevan käyttäjäystävällisempi kuin samaan tietoturvan tasoon yltävän yhden menetelmän vahvan autentikaation. Käyttäjien kouluttamisella ja tietoturvan tavoitteiden selkeällä kommunikaatiolla oli myös iso merkitys, etenkin epävirallisten, tietoturvaa heikentävien ”kiertoteiden” välttämisessä. Unohtuneiden käyttäjätunnusten uudelleenasettaminen on myös eräs usein liian vähälle huomiolle jäävä tekijä, jolla on iso vaikutus sekä järjestelmän käytettävyyteen että tietoturvaan.Increasing wave of cloud services is creating many new ways for remote workers, outsourcing partners and hackers to access the essential tools and business data of the cloud-enabled companies. As the amount of business critical data in the cloud services increase, so does the need for securing it. Securing a cloud service needs balanced defenses against many different attack vectors in various levels of the service, starting from the edges of the public network and continuing deep inside the individual design of the each software component of the cloud service. One of the biggest attack vectors is also the one route that has to be left open for the legitimate users to use the service – user authentication. The goal for this thesis was to find balance between making the user authentication in business cloud services secure enough and usable enough. Authentication has to be secure enough to prevent malicious attackers from gaining access to the valuable data and resources inside the service. At the same time it has still to be usable enough for the legitimate users to be able to access their cloud services without unnecessary frustration. The topic is approached through literature review of relevant research and relevant authentication methods. In addition, several (n=6) usability tests are performed in combination with half-structured interviews to evaluate the user preference in authentication method selection and the factors affecting the experienced balance of security and usability. In addition, the thesis evaluates other important factors, in addition to the authentication method itself, that are affecting the security – usability –balance of the entire authentication process. As a result the thesis presents several ways to improve the balance of usability and security in business cloud services. Multifactor authentication is observed to be more usable than equally secure single-factor authentication. Educating the users and communicating the security needs clearly helps to reduce the unsanctioned security “shortcuts” that reduce the overall security. Authentication resetting is often neglected, but really essential factor both as usability hindrance and possible attack vector

Organisational and cross-organisational identity management

We are all familiar with the overwhelming number of usernames and passwords needed in our daily life in the networked world. Services need to identify their end users and keep record on them. Traditionally, this has been done by providing the end user with an extra username and password for each new service. Managing all these isolated user identities is painful for the end user and work-intensive for the service owner. Having out-of-date user accounts and privileges is also a security threat for an organisation. Identity management refers to the process of representing and recognising entities as digital identities in computer networks. In an organisation, an end user s identity has a lifecycle. An identity is created when the user enters the organisation; for example, a new employee is hired, a student is admitted in a school or a company gets a new customer. Changes in the end user s affiliation to the organisation are reflected to his identity, and when the end user departs, his identity needs to be revoked. Organisational identity management develops and maintains an architecture that supports maintenance of user identities during their life cycle. In crossorganisational identity management, these identities are used also when accessing services that are outside the organisation. This thesis studies identity management in organisational and cross-organisational services. An organisation s motivations for improving identity management are presented. Attention is paid to how the person registries in an organisation should be interconnected to introduce an aggregated view on an end user s identity. Connection between identity management and introduction of more reliable authentication methods is shown. The author suggests what needs to be taken into account in a usable deployment of single sign-on and PKI for authentication. Federated identity management is a new way to implement end user identity management in services that cross organisational boundaries. This thesis studies how to establish a federation, an association of organisations that wants to exchange information about their users and services to enable cross-organisational collaborations and transactions. The author presents guidelines for organising a federation and preserving an end user s privacy in it. Finally, common use scenarios for federated identity management are presented

Adaptive Privacy Management System Design For Context-Aware Mobile Devices

While mobile technologies can provide great personalized services for mobile users, they also threaten their privacy. Such personalization-privacy paradox are particularly salient for context aware technology based mobile applications where user's behaviors, movement and habits can be associated with a consumer's personal identity. In this thesis, I studied the privacy issues in the mobile context, particularly focus on an adaptive privacy management system design for context-aware mobile devices, and explore the role of personalization and control over user's personal data. This allowed me to make multiple contributions, both theoretical and practical. In the theoretical world, I propose and prototype an adaptive Single-Sign On solution that use user's context information to protect user's private information for smartphone. To validate this solution, I first proved that user's context is a unique user identifier and context awareness technology can increase user's perceived ease of use of the system and service provider's authentication security. I then followed a design science research paradigm and implemented this solution into a mobile application called "Privacy Manager". I evaluated the utility by several focus group interviews, and overall the proposed solution fulfilled the expected function and users expressed their intentions to use this application. To better understand the personalization-privacy paradox, I built on the theoretical foundations of privacy calculus and technology acceptance model to conceptualize the theory of users' mobile privacy management. I also examined the role of personalization and control ability on my model and how these two elements interact with privacy calculus and mobile technology model. In the practical realm, this thesis contributes to the understanding of the tradeoff between the benefit of personalized services and user's privacy concerns it may cause. By pointing out new opportunities to rethink how user's context information can protect private data, it also suggests new elements for privacy related business models