ISA Authentication Bypass Vulnerability

As a researcher, Tyler Reguly, a senior security engineer at nCircle, is most interested in the ISA authentication bypass vulnerability. The severity of bypassing authentication on a Web page is often underestimated, he said. Considering the private corporate Web sites that are available through the Internet, and the amount of personal information contained on them, he deems this vulnerability scary.

"I think they had it right with missile launches -- two people, two keys. We live in an age where multifactor authentication should be mandatory. Fingerprint scanners + RFID cards are common for entry to offices, but a Web site takes a known username -- or worse, an e-mail address -- and a password, and that's just wrong," Reguly said. "Relying on a second method of authentication would make this vulnerability much less severe. Essentially, the second factor would still keep the attacker out even after this vulnerability had been exploited."

< Previous Page  |  1  |  2