Some more multi-factor authentication debate

There has been some recent debate over the effectiveness of two-factor authentication. Specifically, when used in authenticating to banking sites, it has been shown to be vulnerable to a man-in-the-middle attack. I weighed in on my personal blog about multi-factor authentication coupled with single sign on and got smacked around a little by Chris Hoff (though I agree with him that it was simply a discussion). There was a little back and forth between us, and Mike Rothman got involved as well (links here, here, and here).

I mention all of this because I was asked by a friend who works for an ID management company to write something up for a healthcare client who was thinking of a SSO solution, but they wanted to only use RFID cards without a PIN or password. Basically, single-factor authentication (something you have), but even less secure than username and password. Their argument was that HIPAA on required each user have a unique username and password (this argument goes back to my assertion that compliance with government regulation often hurts security). Below is what I wrote for them. Take in consideration that this was written for a layperson and is not the most technical in nature and does not take into consideration all the arguments since they wanted it short. I just thought I would share it.

The typical method for logging into a network is a username and password. This is considered to be a single-factor authentication method because both a username and password are "something you know". This is becoming a weaker and weaker form of authentication because of the capabilities of hackers to guess and "crack" passwords using sophisticated tools. Because of this, many companies are moving to multi-factor authentication. This is defined as combining two or more authentication techniques together to form a stronger or more reliable level of authentication (something you know - password, something you have - RFID card, something you are - fingerprint).

 

Having said the above, the proposed solution of using only a badge with no PIN or password is even LESS secure than a username and password. Although both are single authentication methods, it is much simpler for a malicious person (this could be anyone from a hacker to a disgruntled employee) to steal your badge than to guess or crack your password. And in the case of an "insider" (someone working in your organization) who does not have the technical expertise of a hacker, it is infinitely easier for them to steal your badge and authenticate to the network as you (the network would have no way of knowing that the person logged in is not you, so whatever that person does on the network - read patient records, delete files, send "flame" emails, etc. - would appear to come from you).

 

In regards to the HIPAA security rule, it has been stated that §164.312(2)(i) only requires that each individual be given a unique username and password. This is not entirely true. §164.312(c)(2) states that the covered entity should "implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed". Single-factor authentication, even a username and password combination, is considered to be inadequate by many security professionals to verify identity of an individual. In case of legality, the Federal Financial Institutions Examinations Counsel ("FFIEC") has recently concluded "single-factor authentication, as the only control mechanism, to be inadequate in the case of high-risk transactions". Though this does not apply specifically to HIPAA, it does give a strong indication as to where all federal regulations are headed.

 

Simply said, requiring an easily remembered PIN number in addition to the RFID card adds virtually no complication or time to the login process, yet the security benefits are very high. It protects your patient data (your most valuable asset) and secures your network, and it would be a favorable layer of security in case of a HIPAA audit.

BTW, the company my friend works for is Encentuate. From what I have seen, they have a great solution. You really need to check 'em out.