One of the major deliverables to consider as an application developer is a strong security feature that will resist any form of attack or injections. An application that is deployed without a strong security plan will be vulnerable to external aggression from hackers who are ever dynamic in their quest to break into the system. Application security could be enhanced with the use of stored procedures and views. These database objects enhance the security of applications by restricting the information that the users could have access to at a particular point in time. The creation of user roles and privileges apart from the SQL server in-built roles and privileges has also been helpful in restricting access to developed applications.
In addition, creation of sessions at the coding level as well as the use of system built controls like validation controls in Microsoft Visual Studio prevent attack such as SQL injections. A good application should also have an audit trail that can be used to keep track of user actions. These actions could be INSERT, DELETE, UPDATE, CREATE, TRUNCATE or ALTER operations.
There is gainsaying in the notion that despite all the aforementioned measures that seasoned programmers worldwide have employed to secure applications, they all have their peculiar shortcomings. Often time, the consumers of these new applications are so carried away with the pros to even think of the cons. Information Theft is common among several threats users are faced with.
Trillions of dollars are lost yearly due to the ingenuity of some few people known as Hackers. From the hackers in Russia down to the ‘Yahoo-Yahoo’ Boys in Nigeria, the modus operandi is to steal vital Information from unsuspecting victims.
It is a common thing to receive scam e-mails that prompts you to update your ATM information from faceless people. Few weeks ago, I read in one of the dailies that a company spent over 100million naira to sensitize the public on the need to protect their ATM PINs from fraudsters. And to show how serious they are, some hackers recently took over the website of one of the popular dailies for weeks.
Two months ago the security vendor, Kaspersky, had its site hacked by SQL injection, possibly exposing email addresses and up to 25,000 product activation codes.
The widespread incidence of network infiltration by unauthorized individuals (hackers/crackers) poses an increasingly serious threat to data integrity and security. Hackers and crackers have devised various ways of decrypting encrypted information sent via network.
Web Applications security is faced with SQL injection. Exploitation of websites vulnerable to SQL injection has increased from an average of a few thousand per day to several hundred thousand per day at the end of 2008.
SQL injection is a technique that exploits a security vulnerability occurring in the database layer of an application. This vulnerability is present when user input is manipulated for string literal escape characters embedded in SQL statements or user input is not sufficiently filtered and thereby unexpectedly executed. With the aid of Web Proxy Tools, filtering cannot be guaranteed. SQL injection is, in fact, an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. This condition results in the potential manipulation of the statements performed on the database by the end user of the application which violates security policy. Such manipulation is difficult to detect since there is usually no error being reported when this happens.
Until now, there are no known technologies that can reduce or eliminate the need to host password fields in applications. With the use of web proxies, the IP address, identity, or location of a hacker is easily camouflaged. An anonymous SQL injection attack of purportedly "authenticated" user access represents a very serious security risk that has been virtually ignored by most IT security professionals. There is a gaping hole in cyber security caused by the unauthorized use of passwords obtained by fraudulent means. Hackers have a wide choice of freeware that can enable them to crack passwords, inject SQL strings into username and/or password fields, and generally cause havoc for application administrators trying to protect their web applications and databases.
Activities of terrorists and hackers have really made it necessary for developers in the world to come to terms with the reality that they need to be more proactive in their quest to make the world a better place for all. The impact of terrorist attack and increasing rate of Information theft that are the major threats to Human existence formed the basis for the development of a more responsive and functional biometric solutions that could be embedded in applications for different purposes.
Biometrics as the Holy Grail?
According to Wikipedia, the word Biometrics refers to methods for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits. In information technology, in particular, biometrics is used as a form of identity access management and access control. It is also used to identify individuals in groups that are under surveillance.
Biometric characteristics can be divided in two main classes:
Physiological are related to the shape of the body. Examples include, but are not limited to fingerprint, face recognition, DNA, hand and palm geometry, iris recognition, which has largely replaced retina, and odor/scent.
Behavioral are related to the behavior of a person. Examples include, but are not limited to typing rhythm, gait, and voice. Some researchers have coined the term behaviometrics for this class of biometrics.
In general, a biometric solution is non-intrusive. Using biometrics, the fingerprint image is extracted into a binary template, then converted into an encrypted template and either stored onto the hard drive or sent over the network to a matching server. Reverse engineering to convert this data back into the fingerprint image is virtually impossible. Recent advances in capture hardware, such as some of the newer fingerprint devices, are producing better images with a smaller mechanism at a lower price compared to just a few years ago while, at the same time some can detect "aliveness" of the fingers to help prevent enrollment or authentication by a dead or fake finger.
An additional consideration should be the ability of a system to operate seamlessly in multiple application environments, and across multiple devices from different vendors. This is known as interoperability. To be truly interoperable, a biometric solution should be able to operate on many databases, web application servers and many biometric capture devices.
The Case to Utilize Fingerprint Biometrics:
Fingerprint biometrics are a leading digital technology that can be utilized in digital identity authentication. Those in a point of service (P.O.S) setting that use fingerprint biometrics do so by scanning a customer's ID through a system and instructing the customer to use a keypad to match fingerprints with a stored fingerprint identity. Fingerprint biometrics can help increase the chances that the person in front of you presenting an ID is that ID's true identity. The result is an ability to capture and link fingerprints to a single ID record, which will increase fraud prevention and help ensure fraudsters do not attempt to use multiple identities.
Biometrics in general can prevent SQL injection, so long as the biometric system can replace the use of a password field. Any Biometrics system that does not take a user name or password as an input parameter and is able to resolve the identification of users can be effective as a preventative measure against this type of attack.
Looking back, do you remember the day you decided to switch from dial-up to broadband technology? Biometrics will have the same effect once adopted by the masses.
In the password world, the same analogy applies. What if you could achieve higher security combined with added convenience and efficiency without ever using passwords? Is this a good justification for another major revolution? Perhaps not yet, because many react to implementing security only after experiencing a crisis. Biometrics provides an additional layer of security, efficiency and convenience for both users and IT administrators alike.
Areas where Biometrics could be used.
Network / PC Login Security: Biometric Logon for PC and Networks is now well developed with a number of players in the market. This totally eliminates sending authentication information via network. This will eliminate the stealing of ATM pins and passwords of vulnerable end-users of Solutions. Web security could also be enhanced using Biometrics by ensuring that all user sessions are managed by Biometric authentication.
Employee Recognition: There are many employee recognition systems available but Biometrics provides a cheaper alternative to most, very few people lose their fingers or eyes when compared with those who lose smartcards or forget passwords. Biometric solution allows each employee to be uniquely identified thereby removing the possibility of Ghost workers in an establishment. Biometric solution could be implemented on Human Resources System to uniquely identify all workers in the establishment.
Time and Attendance Systems: Time and attendance has always been a problem in some industries. Biometrics can effectively eliminate problems with buddy clocking by ensuring that the employee in question is present. As part of a company Policies, each employee would be given the order to always clock-in and out of the premises. The resultant information could then be used to calculate remuneration and or compensation due to such employees. For example, Biometric solution could be implemented on Payroll system of a Company.
Voting Solutions: The management of voters to ensure no one votes twice has been a difficult process, however recent development of integrating biometric solutions have allowed developed countries adopt a high degree of security to prevent such a problem. Biometric solution can actually remove the problem of multiple voting thereby enhancing the integrity of our electoral system.
The Conclusion
After all said and done, all systems have their own peculiar pros and cons. Biometric Solutions are no exception.
Some of the issues in Biometric will occur at the implementation stage. Just recently I witnessed its implementation at one of the ICT firms in Lagos. The solution should have ordinarily removed the problem of queuing at the examination centers but this was not so. Authenticating the students became a nightmare for the organizers as the system was not developed to cater for the large turn-out. Proper requirement analysis would have removed this bottleneck and save both the examiners and the candidates valuable time while the integrity of the examination is maintained.
During the UAT of a Biometric solution developed for a client sometimes ago, the finger print of one of the staff could not be clocked-In, this sometimes happen but it is one in a million incident.
Identity fraud is a crime that costs all of us one thing or the other. As measures have been increased in recent years to mitigate identity fraud, so has the level of sophistication of the fraudulent acts. Persons that were dedicated to committing fraud had the upper hand for some time, but technology is now catching up on these predators.
Conclusively, Biometric solution in view of its many benefits is that ‘Holy-Grail’ Developers, Business Executives and seasoned Information Technology Professionals should embrace. If this is done, we all can use ATM machines, transact online and administer information that are important to our living without fear or trepidation.
No comments:
Post a Comment