Dual passwords can keep phishers at bay
Connecting state and local government leaders
The all-too-easy hack of South Carolina's Department of Revenue could have been prevented by a dual-password system. How does it work?
The system that South Carolina’s Department of Revenue is adopting reportedly will cost just $25,000- a bargain, considering that the state is paying $12 million to help residents buy protection for their potentially compromised Social Security numbers and financial information. South Carolina officials aren't saying what dual-authentication system it will use for fear of tipping off hackers. It has only revealed that Mandiant http://www.mandiant.com/products/mcirt-managed-defense/ Corp. is doing at least some of the implementation work.
After South Carolina’s Department of Revenue was hacked in November, exposing 3.8 million Social Security numbers, 387,000 credit and debit card numbers and 657,000 business tax filings, state officials announced plans to implement a dual-authentication password system to better protect information.
What the state had at the time of the attack offered next to no security: a single-password security system, with almost none of the data encrypted.
A simple phishing attack gained access to one employee’s user name and password, and the hackers were off to the races, allegedly accessing the financial system at will for well over a month before the hack was discovered, according to The State newspaper.
Federal agencies have two-factor authentication, the second factor in the form of a token such as a Personal Identity Verification card (civilian agencies) or Common Access Card (defense). But public-sector agencies without that kind of protection could turn to dual password systems.
There are two main dual-authentication password systems in use today, outside of biometrics.
The method frequently used by banks, online games and any site with high-value transactions is called one-time password. It’s almost always used as a second line of defense behind the usual name and password protection. The key is that the second password changes very often, sometimes as quickly as every minute, but certainly no less than every 90 seconds. A security server uses a mathematical algorithm to keep changing the password. Of course, users need to know that changing password, and this information is given to them via a portable device that can both keep track of time and has the same mathematical formula as the server. So the mobile device and the security server come up with the same numbers at the same time.
For a user to get access to a protected system, he has to enter the right password at the right time. Some fancy password systems include a USB key or a smart card as part of the mobile device, and a user has to insert the token into a system he is using to access the data, whereby the password is automatically applied.
If the password on the token matches the current one on the security server, access is granted. This makes it almost phishing-proof because even if a user somehow gives out the second password, it’s only valid for a very short time. And in the case of the automatic passwords, a user probably never actually knows what the rotating passwords are. He just inserts his key to gain access. A phisher or hacker who gains the primary password doesn’t get into the system, and attempts to break the second password after the first is approved will trigger alarm bells in any halfway decent monitoring setup.
The second method involves encrypting all files and folders with a program such as BitLocker, in which encryption acts like the second password. If a hacker is able to access a system, say, by using a phishing attack, he still doesn’t get anywhere. All the files will be encrypted gibberish.
The value of this system is that even if someone steals all of the files, he likely won’t be able to make use of them because of the encryption protecting the data. It also makes data monitoring systems more effective because they can detect if someone accesses a system properly, but then runs into walls each time he tries to use a file.
In truth, a system like the one in South Carolina that protects Social Security information and tax records can never be too protected. It should probably have both secondary password methods in use, for a triple-security login, plus system monitoring. But either of the two methods alone would have stopped the rather unsophisticated attack on the South Carolina system had it been in place at the time of the breach. The state just made it easy for the hacker, and provided a valuable lesson in what not to do.