Are knowledge-based authentication systems doing more harm than good?

BROWSE BY TAG Identity Management and Access Control,   Password Management and Policy,   Enterprise Identity and Access Management,   Identity Management Technology and Strategy,   Expert Archive: Identity Management and Access Control,   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Identity Management and Access Control Is Identity Management as a Service (IDaaS) a good idea? How to log in to multiple servers with federated single sign-on (SSO) How to confirm the receipt of an email with security protocols Learn about enterprise strategy for server virtualization single sign-on Employee information security awareness training for new IAM systems Can you combine RFID tag technology with GPS to track stolen goods? Is there a free enterprise-caliber password-management tool? Cryptosystem attacks that do not involve obtaining the decryption key Can any firm or organization get a digital signature certificate? Should the CTO have domain administrator access? Password Management and Policy Two-factor authentication, vigilance foil password theft Group to shed light on secure identity management threats Brute force attacks target Yahoo email accounts Best Identity and Access Management Products Privileged account management critical to data security Making the case for enterprise IAM centralized access control How to prevent brute force webmail attacks Best practices for a privileged access policy to secure user accounts Mature SIMs do more than log aggregation and correlation PCI compliance requirement 2: Defaults Expert Archive: Identity Management and Access Control Enterprise password management policy: Finding the balance How to conduct a periodic user access review for account privileges Options for a mechanical door security system on a server room door Comparing access control mechanisms and identity management techniques User provisioning and SSO for PeopleSoft- and Unix-based products Could someone place a rootkit on an internal network through a router? Should a new user have to confirm an email address to gain access? Can home PCs provide a way for viruses and spyware to enter a corporate LAN? What should an enterprise look for in a password token and a vendor? Using batch files for temporary user access to the local admin group

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary graphical password  (SearchSecurity.com) identity chaos  (SearchSecurity.com) masquerade  (SearchSecurity.com) onboarding and offboarding  (SearchSecurity.com) OpenID  (WhatIs.com) salt  (SearchSecurity.com) session replay  (SearchSecurity.com) single-factor authentication (SFA)  (SearchSecurity.com) TACACS  (SearchSecurity.com) war dialer  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

Knowledge-based authentication (KBA) is about finding a balance between privacy, security and ease-of-use. Also called "secret questions," KBA is often used as a backup or retrieval system for users that forget their password. It works like this: when a user forgets his or her password, he or she can engage a KBA system, which prompts the user for the answer to a secret question. If answered correctly, the system either retrieves or resets the password. The prompt can be automated through a link on a Web site, or over the phone through a customer service or help desk representative.

Users, however, often set up the answers to their secret questions at the same time as their user ID and password. So months later, when they have to answer a secret question, they've already forgotten the secret answer too, defeating the whole point of KBA.

There are also design and implementation issues with KBA. How many questions should be used? Should a series of prepared questions be offered to users at registration, or should users be allowed to make their own up? Usability studies have shown that KBA systems often confuse users, and they do better when offered a set of canned questions to choose from. Other studies have shown that requiring users to answer two questions isn't much more secure than having them answer one.

There can be other complications with KBA as well. One is cultural issues, particularly if your company operates internationally. Questions that are perfectly reasonable in one country may be either irrelevant or offensive in another. Security is another matter. The famous "mother's maiden name" question has already been compromised by identity thieves. One of the first destinations of a credit card thief is often a genealogical Web site in order to obtain this information on their victims, using that small bit of information to eventually steal a victim's complete identity.

When it comes to formulating the perfect KBA question, unfortunately there is no formula. Questions fall into two categories: factual, like "What was the name of your high school?" or "What city were you born in?" or, they can be about preferences, as in "What is your favorite color?" or "What is your favorite food?"

If privacy is a concern, the best mix of questions should probably come from both categories. For factual questions, a best practice could be to use information that the enterprise already has, as you suggest.

An interesting product you might want to take a look at is ExpectID IQ from IDology Inc. ExpectID is a service that creates questions from public records. The product generates neutral questions, like information about someone's prior address.

It's worth noting that security guru Bruce Schneier has said that secret questions actually lower security. Schneier claims that answers to secret questions are actually weaker than passwords, since they are basically easily guessed words. And, since they're used for bypassing passwords, they weaken rather than enhance the security of user ID and password systems.

For more information: