Implementing zero trust security

 

Why the attack engages server resources

Problem: Your servers trust a static ‘token‘ and not a person.

The attack could have been launched by a country involving their resources (i.e. computers and network) but the issue is: they were able to engage your resources. How ?

It was claimed that the attack was a DDoS attack but on a social media platforms, the attacker(s) can create any number of valid accounts and sign up from those accounts using automated script(s).

Replay attack:

Once they have successful login(s) and static JWT authentication token(s), they can flood the servers with authenticated requests. Countless (apparently) valid requests could be sent using just 1 JWT token because the backend is not counting the attempts. Moreover, the attacker can invoke refresh token API to obtain more valid tokens and amplify the attack.

Impact:

The attack propagates deep into the internal servers, data stores and third party integrations (if any). What's more, the auth layer is responding with a success response, hence the firewall presumes it to be a good session. Thus the attack keeps propagating, amplifying and prolonged.

Such an attack will engage most of the resources layer by layer ranging from front line servers to backend servers because the requests seem legitimate to the authentication layer.

If your authentication layer is capable of limiting the API usage on a per user basis, the attacker script can only engage a limited number of servers. The flood of requests shall be stopped at the front doors and the attack could not propagate deep inside your server state.

What is the solution

Solution: A dynamic authentication ‘token‘ armoured to neutralize a token replay attack before it even starts.

Mukta Labs presents a patented solution OTA (One Tick Ahead) which is ideal for such conditions. So that you can eliminate malicious sessions and genuine users continually get a smooth experience.

How OTA works:

OTA (One Tick Ahead) is a patented, time-sensitive authentication token computed in lockstep by both client and server from a blend of device identifiers, session nonces, and the current time slot.

Each token is unique, generated and consumed in a single request before being irrevocably discarded, so replay attacks become impossible. Moreover, the new token builds on the previous one, so the server also verifies a short history of the most recent tokens, instantly flagging any anomaly.

This lightweight, HMAC-based approach requires only a few cryptographic operations per request, and is about five times faster than conventional JWT flows, and no external SDK or infrastructure. 

With OTA, any attempt at token forgery or unauthorized access is detected and halted before a breach can inflict damage, keeping your platform secure and your compute resources uncompromised.

How OTA defeats token replay attack:

Firewall should know about a bad session so it can limit the attack to propagate. With OTA, the response code of request’s response indicates that the session got corrupted, the gateway shall not allow such session(s) to propagate. The firewalls can be programmed to entertain only the valid sessions. This ensures the backend servers are not overloaded with bulk requests generated by hackers.

Result:

• Attack neutralized before it even starts

• Right use of firewalls

• Healthy server state

• Even if the device is cloned, you can defeat the attacker

Watch our demo

Watch OTA live in action at : https://muktalabs.com/live-demo

#ZeroTrustSecurity #EndpointProtection #CyberResilience #RealTimeSecurity #CyberDefense #SecureByDesign #OTASecurity #AuthenticationMatters #ReputationSecurity  #MissionReadySecurity #BeyondJWT #NextGenAuth #JWTReplacement #JWTisObsolete #OTAvsJWT #RewritingAuthentication #StopReplayAttacks #DefeatTokenTheft #PhishingResistant #PreventLateralMovement #ZeroTrustReady #MitigateSupplyChainRisk #KillSessionHijack #EliminateStaticTokens #ResilientByDesign #ProtectThePerimeterless #newproject #PreventLateralMovement

कागज की मुद्रा का चलन विश्व के ज्ञात इतिहास का सबसे बड़ा धोखा है ।

Introduction of the paper currency was the biggest fraud in known history.

- Upendra Jariya
  4 June 2013

Better to get paid for your work, rather than your obedience !!!

~ Upendra Jariya
14 Feb 2012

When you have an algorithm, every language is perfect

When you have an algorithm, every language is perfect,
when you do not have an algorithm, no language is capable.

~ Upendra Jariya
10-Feb-2011

The steps to solve real life problems

1) Keep aside emotions

2) Keep aside emotions

3) Be sincere

4) Think logically

Context Theorem in Propositional Calculus

For an arbitrary but well formed context 'C', there exists a Proposition 'P', howsoever elementary and/or trivial, such that the entire Group 'G' influenced by context 'C' agrees upon some particular aspect of proposition 'P'

(KG --> KKP) + 1s ==> (KP --> KKG) + 1ns ==> (KNP --> KKLG)

~ Rahul Sharma (http://sabir-ki-shayri.blogspot.com/)
14-Feb-09

Context: humans and the memory

This is a generalization to the previous post:

Human beings operate within their context… this context or surrounding could be categorized by below mentioned two perspectives
1. Physical/Mental:
Objects and concepts from the world i.e. the physical context are conceived by the brain (with a certain perspective and including some loss of information) and thus brought into the mental context which becomes a part of our personal memory.

2. Active/Passive:
Every thing which is present in the context (physical or mental) is not always needed; content frequently used by the brain belongs to the active context. Information from the passive context if needed - is brought into active context first (by remembering, searching or otherwise) and used afterwards.

~ Upendra Jariya
14 Mar 2007