Things have been very quiet here for a few months. Having some downtime from work and studies I’ve looked to spend time with family and make up for lost time with friends, rather than blog. But with the new year a new set of studies and an interesting workload I will be looking to pour my thoughts here a lot more.
The one thing that constantly puzzles me is the amount of people who say “wow, you travel a lot for work!” and then follow up with “how exciting it must be” or “how important you are to travel a lot”. My response is always, try it for 2 months and you will never want to travel again. I’m always reminded of a conversation I had with a colleague and friend about this very subject; whilst we were both separately on the road and on the phone together lamenting travel. He punctuated this by describing his dinner on said trip home being a sandwich purchased at a road stop. Glamorous indeed.
This isn’t a fully fleshed out thought. It is the beginning of some musings after looking at the Apple WWDC announcements and how they are building tighter integration between OSX and iOS. It was also spurred on by this article. As users are being driven by portability and the lag between feature parity of devices is shrinking, and looking at the history and trends of personal computing purchases, are we finally moving to the “single device”? What will this new “single device” look like and what affect will it have on the current trends in the market?
Personal computing kicked off in the 1980s with the personal computer. This was the first time that general and flexible computing was available to the average person.
In the 1990s mobile phones took off as did the personal digital assistant (PDA) in the mid to late ’90s. This took communications and personal computing mobile. Given the limited capabilities of the PDAs at the time, most people still had a desktop PC. Those lucky enough, also had access to laptops in the ’90s, these too had limitations and for the more powerful users, increased their device count further.
In the late 1990s PDAs merged with phones to create the first smart phone, reducing the number of devices a person carried.
The 2000s brought the advancement of laptops as the norm and in the latter part of the decade saw the introduction of net books and ultrabooks as a way of increasing the portability of computing, it also saw the paradigm (can’t believe I used paradigm) shift in mobile telephony with the introduction of the iPhone. This new interface saw people’s view of mobile computing change forever.
By 2010 tablet computing, on the back of smart phones, came to market and introduced another compromise to computing. This now sees people with 3 devices, notebook, smart phone and tablet computer, each needed for a specific purpose, notebook as the data entry and manipulation device, smart-phone for the all purpose device and a tablet as the compromise of the two, meeting somewhere in the middle.
In 2013 we now see the decline in PC sales and increase in smartphone sales with tablets of varying specification and size, trying to balance capability and portability, as well as smart-phones that are so large that the challenge the smaller of the tablets on the market. Why? This jostling and positioning is trying to meet the consumers needs what are these needs?
I argue that people are trying to get that balance right. Ideally they don’t want a phone and a tablet, but the phone screen is too big, or the tablet too big to always have with them. If this is truly the case then the real future is going to look a lot different from where we are now, reaching an almost sci-fi climax.
I think what will eventually happen is that the processing power that a mobile phone can have will be comparable with that of the ultrabooks of today. Once this happens is there really a need for everyone to have 16 devices? The new devices will be like the smart phone today with a docking capability to turn it into a powerful data entry and manipulation tool or a sleeve that allows it to have a bigger, interactive display like that of a tablet or laptop .
If this is the case, what are the implications to current enterprise trends?
Cloud Services - Today file sharing tools like box and dropbox allow us to share files with others, but most people tend to use them as a way of syncing and backing up their own personal data. In the single device world this won’t need to change. whilst the sync capability will be less of a concern, the sharing capability will increase as it does today, moving from file sharing to collaborative content creation and manipulation.
BYOD – the Bring your own device phenomenon,like cloud, is moving past the disruptive trend and becoming the norm. With a single device, the only barrier is compartmentalisation of work and personal. As mobile computing power increases so will the ability to have capabilities like personas or profiles. Allowing the seamless switching between contexts work and personal contexts
Security implications – This will cement the concept of the micro perimeter (see really crappy Figure 2 below). Mobile computing and secure code execution is becoming more and more mature, so too has the shift in desktop computing. We’ve moved from the personal firewall and the Hypervisor to the Micro-visor (see Figure 1 below) providing the ability to secure the execution of the operating system itself, as well as temporary sandboxed instantiation of the applications as they are used. Incorporating the Mobile device management (MDM) platform concept into a policy based micro visor, allows the seamless movement from personal device to multifunction device, with employers being able to specify policies for the components under their control.
I think that the trends of today are not going to change much or slow down, each seems to fuel the other in regards to personal computing. There are still niches in the market to be had to help consumers and businesses ease into this new paradigm (there you have it I use paradigm)!
UPDATE – 18/6/13: After a brief twitter exchange with Brian Katz (@bmkatz) and Ian Bray (@appsensetechie) I realised that I conflate the concept of Mobile Device Management, Mobile Application Management and Device Data management into the MDM terminology.
I see Mobile Device Management, device control, as the initial stage in the evolution of dealing with the data management problem. Application management is controlling the conduit to the data via enforcing trusted applications (another potential flaw). Ultimately the data is the only thing that anyone truly cares about. This is an oversimplification of the problem as there are other concerns and factors that come into it.
UPDATE – 22/6/13: Further comment from Tal Klein (@VirtualTal) reminds me that there will always be a multi device driven by consumption/creation as well as an aggregation and administration drive to consolidation of devices. I can see that there will continue to be those that have specific needs and require multiple devices (driven by technology adaptation, or scenarios). I’m also driven by watching my family’s adoption. I’m the only one that really has multiple machines, everyone else really utilises dual devices, and only uses the secondary device due to lack of feature parity on the primary iDevices.
As you may have noticed there have been a lot of website and business breaches in the last 3-4 months where usernames, passwords and occasionally some personal information has been taken. You can see a consolidated, and up to date list here at liquidmatrix.org. Given that passwords are so easily “lost” these days, are they doing much more than security theatre?
This has been an ongoing topic of discussion for several years inside the info-sec community and I thought I’d get my current thoughts out on the subject as it seems to be coming to a head again.
It is becoming generally accepted that users cannot be trusted/expected to look after their credentials and more and more businesses are looking at offering additional ways in which to secure user accounts beyond the humble password.
A bit of Background, the issue is really comprised of 2 parts, the businesses supplying their services and the people that use these services.
Part of the problems is that the businesses breached don’t always take the appropriate care when managing credentials, these are stored in plain text (readable by anyone) or in a poorly encrypted form (that allows the passwords to be cracked or reversed).
This is not always something that is malicious and there can be any number of reasons why this happens. For example, the people building these websites are web developers and not security people, they don’t necessarily know that the standard library or function that they call when building a web application is 10 years old, calls a deprecated function/hashing algorithm and doesn’t do what is required in this day and age.
A more pessimistic take is that you can see, historically, businesses that have been caught out by these breaches in the past don’t always take a hit financially (unless it leads to privacy violations and they are fined or sued) and weigh up the cost of doing things right vs. the likelihood of something going wrong and having to pay compensation. This attitude is definitely changing, as be described. More and more businesses are beginning to offer alternatives.
The other factor in this is that users tend to reuse their passwords across multiple sites. Users tend to do this for any number of reasons, mostly because it is convenient to only have to remember a small set of credentials to get around work and social media sites.
This too is understandable as most people don’t realise that once there is a breach, and your credentials are leaked, people (hackers or script kiddies) will automatically try them against other popular sites or even your place of work (as apparently one Dropbox employee found out).
What’s the hoopla anyway?
Those that say, yeah great for clear text passwords, but mine is/was encrypted, how does that cause an issue? For a great overview of the problem with password breaches and cracking, head over to Ars Technia. The summary of the article, however, is that with the cracking tools available today, each breach feeds the beast and makes it easier to crack each time there is another breach.
The other issue today is that Microsoft (live), Facebook, Google, and Yahoo!, to name a few, offer the ability to provide federated authentication services through OpenID, SAML, OAuth or similar services.
This means that you can use your credentials, username and password, for one of these systems to authenticate (verify you are who you say you are) to another completely separate system that then authorises (provides permissions to do things based on who you authenticated as) you. So if your Facebook account is compromised and you use it to login to any other account with your credentials that you have linked to Facebook.
People also tend to cascade the linking of their accounts so that when you’ve forgotten your password you have Facebook , Twitter or Apple email your Gmail account with the password reset token, allowing the compromise of one account open up the possibility of access to a lot more.
Whilst you can point the finger and blame the companies that were breached, your username and password, and the management of them, are ultimately your responsibility.
What can you do?
Given that this looks like the sky is falling and that every password leaked means that it becomes easier and easier to get into systems, what can you do? You can invest in a password generation and management tool or look at 2 factor authentication methods offered by vendors.
The first thing you can do is start using a password generation tool like LastPass or 1Password. Most of the tools out there have the ability to generate passwords given a number of different parameters like whether it is pronounceable, includes numbers, capitalisations, hyphens, etc (see the example below of 1Password browser plugin for password generation).
Couple this with a tool that remembers your passwords and you now have the ability to generate new and unique passwords for each and every application and website you can think of.
Most of these applications have browser plugins too that automate the entire process so there isn’t even the need to do more than follow the prompts.
Passwords – becoming too hard
Given that all of this is very complicated and relies heavily on you to do the work, more and more businesses are realising that trusting their user base to create unique passwords is not necessarily the best thing and offer a number of additional mechanisms to assist in the protection of themselves and the authentication of their users.
This second factor authentication mechanism is something that you should always take advantage of.
What is 2-Factor authentication? Two factor authentication takes the something you know (your password) and then adds in either something you have (like a security token) or something you are (biometrics).
The “something you have” can be any number of things:
- Digital certificate;
- Smart card (generally stores a digital certificate);
- Physical Token (generates a one time password or pin on a screen of a device);
- Soft token (generates a one time password or pin via an application); or
- SMS (short message service) one time password or pin.
The something you are is exactly that, something that is uniquely you:
- Retina scan;
- Palm print;
This second factor when coupled with your password makes it a lot harder for your account and personal information to be compromised should one or the other components be lost.
Most financial organisations offer a number of options for 2 factor authentication. The most common of these are SMS based one time passwords for transactions. Others opt to provide their customers with physical tokens that generate one time passwords.
Other organisations have started offering 2-factor authentication methods for their users -
Google offers both SMS and soft tokens for unauthenticated devices or services across their services like Reader, Gmail, etc.- http://googleblog.blogspot.com.au/2011/02/advanced-sign-in-security-for-your.htm
Dropbox have just added soft tokens for previously unauthenticated devices - https://blog.dropbox.com/index.php/another-layer-of-security-for-your-dropbox-account/
WordPress are now offering Vasco tokens - http://www.scmagazine.com.au/News/313736,wordpress-adds-vasco-one-time-password-technology.aspx and support for the Google Authenticator application – http://wordpress.org/extend/plugins/google-authenticator
Facebook now supporting SMS based tokens for unauthenticated devices- http://www.facebook.com/note.php?note_id=10150172618258920
The above list is certainly not exhaustive, but shows that there is now a move away from the old Username and Password as the way in which to authenticate a person.
What should I do?
The short answer to this is as follows:
- Never reuse passwords. Ever;
- Be aware of the risks in linking accounts to each other;
- Use a password manager; and
- Take advantage of 2-factor authentication.
Following these 4 simple things won’t guarantee that you and your accounts will not be compromised, but it will guarantee that the damage will be mitigated.
I realise that things have been a bit quiet here. As I do from time to time, I have my head down working on things; addressing the bits in life that are important. I read a post by Rich Mogul of Securosis on his priorities in life at the moment and have an almost identical one. Between flying around the country and doing my day job I’ve been silly enough to pick up some additional vocational education and this is taking up my spare time. My version of the priority list looks a little like:
- Everything else in my life
During the rare moments of down time I have I’ve managed to get several bit posts put together and hope to start to flesh these out in the coming months.
Sometimes I wonder if I bite off more than I can chew to see if I’ll break.