Large Scale Password Management With Hitachi ID Password Manager © 2020 Hitachi ID Systems, Inc. All rights reserved. Contents 1 Introduction 1 2 Why do we still use passwords? 3 3 How to compose and manage passwords securely? 4 3.1 Secret passwords .......................................... 4 3.2 Pass phrases ............................................ 5 3.3 Memorable passwords ....................................... 5 4 Password management guidelines for application developers 6 5 Multi-factor authentication 7 6 Usability, IT support cost and security 8 7 Basic password management 9 7.1 Password synchronization ..................................... 9 7.2 Password policy enforcement ................................... 9 7.3 Self-service password reset .................................... 10 8 Technical challenges 11 8.1 Users locked out of their PC (Windows login password) ..................... 11 8.2 Filesystem encryption and pre-boot passwords ......................... 13 8.3 Off-site users – expired and forgotten passwords ........................ 14 8.4 Locally cached passwords ..................................... 15 8.5 Replication delays between Active Directory domain controllers . 16 9 Network architecture 17 10 Maximizing user adoption 20 11 Access to Hitachi ID Password Manager from smart phones 22 12 Telephony integration (IVR) 24 13 Return on investment 26 i Large Scale Password Management With Password Manager 14 Platform support 28 © 2020 Hitachi ID Systems, Inc. All rights reserved. Large Scale Password Management With Password Manager 1 Introduction This document describes self-service credential management using Hitachi ID Password Manager. It links business problems to technology and describes the benefits of automation and self-service. The remainder of this document covers: • Why do we still use passwords? Many people wonder why password management is still needed? Aren’t passwords going away soon? This is an overview of why passwords will likely be with us for years to come. • How to compose and manage passwords securely? Given that users will have passwords for years, some advice on how to choose secure, memorable passwords is offered. • Password management guidelines for application developers It’s not only users who deal with passwords. Application developers must write password handling logic and user interfaces. Here is guidance for them. • Multi-factor authentication Passwords can be compromised, so multi-factor authentication is often recommended. Why this is so and what to do is summarized here. • Usability, IT support cost and security The impact of poor password management on organizations is high cost and weak security, as de- scribed here. • Basic password management Hitachi ID Password Manager automates basic password management processes, as described here. • Technical challenges Basic password management is great – but there are many scenarios where user location, use of encryption and cached passwords interfere. These scenarios, and how Password Manager addresses each one, are described. • Network architecture Password Manager is deployed to corporate networks, as described here. • Maximizing user adoption The value of password management hinges on user adoption. How to increase adoption rates and consequently maximize RIO is described here. • Access to Password Manager from smart phones Users increasingly prefer to interact with corporate services from their smart phones. This is sup- ported by Password Manager as described here. • Telephony integration (IVR) © 2020 Hitachi ID Systems, Inc. All rights reserved. 1 Large Scale Password Management With Password Manager Some organizations expose self-service management of passwords and PINs to a users via phone calls, and this is supported by Password Manager. • Return on investment Password Manager can generate real, measurable cost savings for organizations. This section shows how to estimate these savings. • Platform support Password Manager can manage passwords and other credentials across a wide range of systems and applications. © 2020 Hitachi ID Systems, Inc. All rights reserved. 2 Large Scale Password Management With Hitachi ID Password Manager 2 Why do we still use passwords? The end of passwords has been predicted for decades. Biometrics, smart cards, one time password tokens and more have been offered up as alternatives and many of these are gaining market share. In reality, passwords are likely to remain popular for a long time: 1. Passwords are cheaper to deploy than any alternative, though supporting passwords (forgotten, locked out) can be costly. 2. Some types of credentials can only be used on compatible devices and in certain circumstances: (a) Smart cards plug into card readers, which are mainly made for PCs (desktops and laptops) – rarely for tablets or smart phones. (b) One time password tokens only work where there is a network connection – this makes them unsuitable for signing into devices which are sometimes off-line. (c) Every kind of biometric requires a sensor – finger print reader, retina scanner, camera, micro- phone, etc. Not every device a user might want to sign into has the requisite sensors. (d) For every biometric, there are some users who physically cannot enroll – amputees, people whose fingers are too small, people with retinal or iris damage, etc. 3. In many cases, credentials other than passwords are combined with passwords to create stronger authentication. For example, tokens and smart cards are commonly combined with PINs (just numeric passwords). 4. Many solutions marketed as replacements for passwords really just externalize the login process out of an application, to a shared infrastructure, which in all likelihood does use a password. This is true of Kerberos, LDAP authentication, federation with OAuth and SAML, etc. 5. Many legacy applications are simply incompatible with any other credentials – user logins are with an ID and password and nothing else. Only when most applications can externalize their login process will organizations be able to seriously contemplate the end of passwords. © 2020 Hitachi ID Systems, Inc. All rights reserved. 3 Large Scale Password Management With Hitachi ID Password Manager 3 How to compose and manage passwords securely? A user choosing a new password should attempt to meet two somewhat contradictory objectives: 1. The password should be a secret – harder for others to guess. 2. The password should be easy to remember and reasonably convenient to type. 3.1 Secret passwords Truly secret passwords cannot be based on trivial choices: the user’s name, login ID, e-mail address, phone number or a dictionary word. The password should include enough characters, drawn from a large enough set of possible characters, that brute force password guessing will be infeasible. Given a set of characters S and a password length L, the number of possible passwords is SL. Here are some examples: Character set Size of set Password length Number of possibilities 4-digit PIN 0-9 10 4 10,000 Short, lowercase a-z 26 6 308,915,776 Longer, mixed-case a-z, A-Z 52 8 53,459,728,531,456 Longer, digits, a-z, A-Z, 0-9, 95 8 6,634,204,312,890,625 punctuation, symbols mixed-case, space These numbers sound large, and if an attacker must try out guessed passwords over a network, even a short lowercase password would be reasonably secure. The problem is that sometimes attackers can acquire copies of hashed (one way encryption) passwords and when this happens, they can test guesses against actual password hashes much more quickly – as much as 350 billion guesses per second with specialized hardware (multiple GPUs).1 How complex a password to choose depends on how much the user trusts the system they sign into to not be compromised, in the sense of encrypted passwords being extracted, and what the adverse outcome would be in the event of such an attack, undisclosed, followed by unauthorized access to the user’s account. Note that if a system is successfully compromised, but the attack is disclosed promptly, there isn’t much of a problem – just change the password before the account is compromised, which in all likelihood (assuming a reasonably complex password and assuming that attackers cannot afford specialized password guessing hardware) would take days or weeks. All that being said, it’s reasonably easy for users to choose passwords that are at least 8 characters long and include lowercase, uppercase, digits and punctuation marks. Changing these passwords periodically limits the amount of time that an attacker has to compromise the account, even in the event of an undisclosed compromise of the database of password hashes. 1https://arstechnica.com/information-technology/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ © 2020 Hitachi ID Systems, Inc. All rights reserved. 4 Large Scale Password Management With Hitachi ID Password Manager 3.2 Pass phrases Some people argue that pass-phrases - basically sentences comprising a few words - are a better approach. If users choose real sentences and type them in all lowercase letters, this is actually not true. There are about 60,000 words in the English language (in a relatively large dictionary). There are in principle 600005 possible 5-word sentences, but word frequency is very uneven and grammar further restricts legal sequences. In practice, each word represents about 10 bits of entropy2, so 5 words have 50 bits of entropy – 250 realistic combinations, or 1,125,899,906,842,624 combinations – less secure than the aforementioned