How to Use PIV as a Cyber Defense Tool

This article provides a practical plan for implementing PIV technologies to immediately bolster your cyber defenses. We have structured this plan to provide fundamental countermeasures against the latest cyber threats while also recognizing organizations require time to fully adopt PIV throughout their entire ecosystem. Therefore, all components of this plan can be implemented using vendor supported point and click configurations and do not require software code modifications. Advanced topics related to PIV software application fortification will be covered in a subsequent article.

Why the latest attacks are succeeding

The latest attacks originate in the form of: malware delivery, credential theft or compromise of an internet accessible system. These attacks work because of insufficient access control or message integrity validation where the attacker either surreptitiously obtained a credential or tricked a legitimate user into installing malware which permitted access to the system. Furthermore, these attacks go from bad to absolutely devastating because of the nature and volume of the data stolen. For example, an organization can rebuild a compromised network server, but they can never recall the intellectual property stolen or repair the negative psychological impact to their customers.

PIV as a countermeasure

Many security features of PIV are underutilized simply because their benefits have never been clearly articulated or explored. The fact is, the rigorous identity proofing protocols that a person goes through to even receive a PIV credential combined with the PIV credential authenticity technology features, provides a remarkably useful tool to stop most attacks before they can even get close to your organization. Below are some of the security features of PIV:

• Enables deny all by default security policies: Many organizations must keep services available to anyone on the internet. For example, they allow a web browser or VPN connection to be accessed by anyone so that they can reach the password entry screen. With PIV, new cryptographic controls can be implemented to only let those with a valid PIV credential to even access the sign on page. This is critical because now the organization can block anyone without a PIV credential before they can even get to your services.
• Prevents credential theft: Every relevant attack we have analyzed involves some form of credential theft from an identity repository. Subsequently, these credentials are used by the attacker to masquerade as a legitimate user rendering security systems useless. With PIV, the credentials are only stored in a tamperproof container that is physically possessed by only the approved PIV user which can only be accessed with their biometric or PIN. Therefore, by using PIV, attackers no longer have the luxury of stealing credentials from an identity database.
• Permits trusted communications: Many attacks occur because a well-intentioned user receives a message from a seemingly trustworthy person and they open an attachment that launches malware. It is critical to understand that these new generation of attacks use a combination of social media harvesting, consumer behavior pattern analysis and psychological trust features to actually make the user believe they are helping their organization by opening a message. By using PIV, an organization can only allow attachments that have been signed by a valid PIV credential to enter their organization thus drastically decreasing the potential of a user accidentally distributing malware.
• Locks down Devices: Many attacks will focus on business partners, home networks or actual theft of a physical device such as a laptop or mobile device. By using PIV technologies, data can be encrypted so even when someone outside of the control of your security is breached, your data can remain safe.
• Makes data unusable to attackers: Even if the data is stolen, data is useless unless you possess the PIV card and PIN that encrypted the data.

PIV Protection Plan

Our plan strategically implements PIV at critical locations in order to eliminate many of the popular attack pathways traditionally used to gain access. Our strategy is to mitigate the threats by 1) removing the attack launch points, 2) eliminating common credential theft schemes 3) removing traditional malware distribution channels, and 4) making the data worthless even if stolen.

Fortify boundary: Block any remote transaction that is not PIV based.

Eliminate passwords: Eliminate the password authentication option so that stolen passwords cannot be used.

Lock data: Make data unusable to those without a PIV credential.

Stop malware distribution: Only permit signed attachments from trusted parties.

PIV protection implementation steps

Our goal of this fundamental plan is to enable organizations to start protecting their infrastructures immediately with PIV credentials. Therefore, each of the following steps can be implemented through standard guidance from the vendor and will not require software code changes. For example, Microsoft active directory, Apache web server, Cisco VPN and Apple iPhone all support the use of PIV digital certificates via standard configuration.

Conclusion

PIV technologies can provide extremely effective countermeasures to prevent system compromise and deter attackers before they even begin. However, these features must be adopted and utilized otherwise attackers are only one stolen password, malware infected email or stolen device away from completely devastating an organization and their customers with the next wave of cyber attacks.