Non-repudiation is Becoming Important in Cybersecurity—But Choose a Strong Solution

A perverse result of the skyrocketing breach rate is that it's easy for cyber-crooks to hide in plain sight—by claiming to be victims. Non-repudiation using behavioral biometrics solves this problem.

Internal actors are implicated in more than a third of recent data breaches. 

If you're an IT or security professional in the corporate world, that's an alarming statistic. And yet for many corporate cyberattack victims, catching and excluding internal bad actors is an increasingly difficult task. Why?

Because in too many organizations today, there is no necessary relationship between users and their authentication credentials—no way to prove that when a particular set of credentials was used, a specific person was using them.

Non-repudiation—the ability to confirm the particular individual behind a computing action or event, rather than just the user account that bears their name—is a growing need in cybersecurity. © Bulat Silvia / Dreamstime

As a result, once company accounts or systems have been compromised, it's easy for an internal bad actor to "blend in" with the background—to say that:

  • “I have no idea how this happened.”

  • “They may be my credentials, but I wasn’t the one using them at the time.”

  • “Since our credentials have been compromised, evidently the attackers were using mine!”

Worse, the more common cybersecurity incidents and data breaches become, the more plausible this defense becomes. After all, there are over three quarters of a billion sets of valid credentials in the wild already. 

Non-repudiation Strategies are Needed

What's needed is a way to definitively know who's responsible for activity carried out using a given set of login credentials. In other words, what's needed is a way to prove that:

  • A particular attack—

  • was carried out using a particular set of credentials—

  • that were demonstrably in use by a particular individual—

  • who is the responsible party.

At present, most companies can forensically demonstrate the first, second, and fourth bullets above—but not the third.

Unfortunately, it's the third bullet that matters most, enabling administrators to take clear action and ensure that the person responsible for a past breach won't have the access to initiate a future one.

Furthermore, the ability to prove that a particular person is responsible for a data retrieval, transmission, or modification event is often operationally, legally, and ethically important even in the absence of a breach event.

Traditional biometric technologies like fingerprint and face scans are a popular option, but have proven to be vulnerable in multiple ways. That’s bad for non-repudiation purposes. © Webarma / Dreamstime

This is true in a variety of industries, including:

  • Healthcare

  • Financial services and banking

  • Education

  • Critical infrastructure

  • Government and military work

So, given the growing importance of non-repudiation capability, what strategies exist for achieving it? Let's take a look.

Methods for Achieving Non-repudiation Capability

At the moment, only biometric forms of authentication can claim to tie a particular real-world individual to a particular computing session.

Every other kind of login authentication—username and password, hardware token, SMS code delivered by phone, access card, and so on—proves only that someone had the credentials to log in, rather than confirming just who that someone was.

Within the realm of biometrics, however, there are a range of possible choices in non-repudiation solutions, each with a particular level of non-repudiation certainty:

  • Weakest: Biometric authentication with fingerprint or face scans

  • Stronger: Behavioral-biometric authentication at login

  • Strongest: Continuous authentication using behavioral biometrics

Traditional biometric authentication is the weakest. It links a computing session to a real person only at login, after which claims of session theft and step-aways remain plausible. Worse, fingerprint and face scan solutions are known to be vulnerable in a variety of ways,  significantly compromising them as non-repudiation technologies—for the very same reasons outlined above.

Behavioral-biometric authentication at login is somewhat stronger. Biometric data of this kind is far less vulnerable to impersonation, theft, or reuse—a big plus. Unfortunately, when used only at login, behavioral biometrics again leaves the door open for claims of session theft either via technical means or as the result of an inadvertent walk-away.

With the right non-repudiation solution in place, the “It wasn’t me, my account was hacked too!” defense no longer works—and the parties responsible for breaches or other events can be definitively identified. © Studio Grand Web / Dreamstime

Continuous behavioral-biometric authentication is currently the best non-repudiation option available. It relies on behavioral-biometric data that makes impersonation, theft, and reuse difficult or impossible while at the same verifying identity continuously as work happens—thus preventing claims of session theft or compromise due to inadvertent walk-aways.

Choosing a Non-repudiation Solution

Though this discussion is probably new to some, for many organizations the problem isn't so much a matter of understanding non-repudiation needs, benefits, and technologies as it is finding a solution that's practical—one that's shipping, affordable, and compatible with organizational needs and infrastructure.

At Plurilock, of course, we offer both login-based and continuous behavioral-biometric solutions for non-repudiation, via our ADAPT  and DEFEND  products, respectively, and are able to support most cloud applications as well as ADFS, Mac OS, and Windows environments.

But whichever provider(s) your organization selects, given the points outlined above, we’d advise companies that are seeking non-repudiation capability to identify and consider solutions that:

  • Rely on behavioral biometrics for authentication

  • Perform this authentication continuously, at all times as work happens

Solutions that meet these two points enable truly strong non-repudiation capability.

They eliminate the "It wasn't me!" problem in cybersecurity, so that internal bad actors can be clearly identified—and their access to cause future havoc and harm can be ended. ■

Stay informed. Join our low-volume list for news and updates.

PLURILOCK IS THE LEADER IN ADVANCED AUTHENTICATION

Plurilock is the leader in advanced, risk-based authentication. We provide invisible, device-free MFA for corporate endpoints, Citrix sessions, cloud applications, and their users in finance, healthcare, education, and SaaS.

Follow

        

Contact Plurilock

Have a question or comment? 

© 2018 Plurilock. All Rights Reserved. | Plurilock Cage Code L02Z7; DUNS 248484623