Helpful first: Kerberos: signing in with tickets
Thirty days to Halcyon · Case 10: The flat network · Episode 6 of 7
The control room door at Station South is getting a biometric reader in place of its four-digit code. Two vendors each say theirs is "99.9 percent accurate".
Priya Nair, Propulsion Lead, has one requirement. "My engineers get in first time, every time. What does a false alarm cost me in days?"
Sloane Sterling, Head of Compliance, slides a list across the table. Forty-one accounts can sign in to the antenna controller. Three belong to people who have left. Which problem do you take first?
By the end you can
- Compare FRR, FAR, and CER, and tune a reader for a high-security door
- Tell the three NIST assurance levels apart: IAL, AAL, and FAL
- Spot privilege creep and say how reviews and just-in-time access remove it
Two ways a reader can be wrong
A password either matches or it does not. A biometric reading is different. Two scans of the same finger are never identical, so the reader reports how close the match is. An administrator sets a threshold for how close is close enough.
That threshold trades one error against another. A false rejection turns away an enrolled person. It is called a Type I error, and its rate is the false rejection rate, or FRR. A false acceptance lets in an impostor. It is called a Type II error, and its rate is the false acceptance rate, or FAR.
Tighten the threshold and FAR falls while FRR rises. Loosen it and the reverse happens. False rejections cost time and patience, which is Priya's concern. False acceptances let the wrong person in. For a high-security room, false acceptance is the more dangerous failure, so you tune FAR as close to zero as you can.
"99.9 percent accurate" does not say which threshold the vendor used. To compare two readers fairly, use the crossover error rate (CER). It is the point where FRR equals FAR. A lower CER means a more accurate reader.
Loose
- FRR low
- FAR high
- Staff rarely refused
- Impostors sometimes accepted
Crossover
- FRR equals FAR
- This rate is the CER
- Lower is better
- Use it to compare readers
Tight
- FRR high
- FAR low
- Staff sometimes refused
- Right for a high-security door
| Rate | What happens | Rule to remember |
|---|---|---|
| FRR, false rejection rate, Type I | A legitimate user is denied. | Frustrates users and reduces availability. Rises when sensitivity is tightened. |
| FAR, false acceptance rate, Type II | An impostor is granted access. | The most serious security failure. Minimize it for high-security rooms. |
| CER, crossover error rate, also called EER | The point on the sensitivity curve where FRR equals FAR. | The main measure for comparing readers. Lower is more accurate. Iris and retina scans do best. |
SORT IT OUT
The new reader has been on the control room door for a day. Sort four entries from its log.
Show the answers
- False rejection (Type I). An enrolled person was turned away. That is a false rejection, and it costs time.
- False acceptance (Type II). Someone who was never enrolled got in. This is the failure a control room cannot afford.
- Working as intended. Refusing an unenrolled person is the reader doing its job.
- False rejection (Type I). The person is legitimate and the reading was not close enough. That is still a false rejection.
Three separate questions about a sign-in
A door reader is one authenticator. Sign-ins to systems use three classic kinds of factor: something you know, something you have, and something you are. Multi-factor authentication needs factors from at least two different kinds.
How much should you trust a sign-in overall? NIST SP 800-63 splits that into three independent questions. Each is rated from 1 to 3.
Identity assurance level, or IAL, asks how carefully the person's real-world identity was checked at registration. Authenticator assurance level, or AAL, asks how strong the sign-in mechanism is. Federation assurance level, or FAL, asks how well an assertion is protected when one system vouches for a user to another.
The three move separately. An account can have a strong hardware key and still belong to someone whose identity nobody checked. AAL3, the highest authenticator level, needs a hardware-based cryptographic key that resists impersonation of the verifier. A FIDO2 security key is one example.
IAL
- Identity proofing
- Asked at registration
- Is this a real, checked person?
AAL
- Authenticator strength
- Asked at each sign-in
- AAL3 needs a hardware key
FAL
- Federation assertion strength
- Asked between systems
- Is the assertion protected?
Access that outlives its reason
A perfect sign-in still goes wrong if the account should not exist. Sloane's list has three accounts for people who left Meridian. Each one signs in correctly. None of them should.
Every identity has a lifecycle with three stages: joiner, mover, and leaver. When someone joins, automated provisioning gives them the standard access for their role. When someone leaves, deprovisioning removes all of it.
The mover stage is where trouble collects. A person changes teams and gains new access, and nobody takes the old access away. This is called privilege creep. After a few moves, one person holds access from three jobs.
The fix is a regular access review. A business manager looks at who holds what and signs to confirm it is still needed. Anything unconfirmed is removed.
- JoinerProvision standard access for the role
- MoverAdd new access and remove the old
- ReviewA manager confirms what is still needed
- LeaverDeprovision everything
SPOT THE PROBLEM
This is part of Sloane's list of accounts that can sign in to the antenna controller. Flag the entries that should not be there as written.
Show the answers
- t.okafor left Meridian in March operator account active A leaver's account was never deprovisioned. It still signs in.
- r.adeyemi moved to Propulsion in May antenna-admin kept from old team Privilege creep. The move added new access and nobody removed the old.
- j.lindqvist contractor, contract ended maintenance account active The reason for the access ended with the contract. The account should have ended too.
Admin rights only when there is work to do
Administrator accounts need the most care. An administrator's access can change or stop a system, so stale admin access is the most dangerous kind.
Privileged access management (PAM) is the practice of controlling those accounts. Its goal is zero standing privileges. Nobody holds admin rights all the time.
Engineers sign in with a standard account for ordinary work. When a change is approved, an engineer checks out a temporary admin credential from a vault. The credential works for a limited time. The vault records the session and rotates the password afterwards. This is called just-in-time access.
A related idea limits what the credential can do. Just-enough administration grants only the rights the task needs.
PUT IT IN ORDER
Kael Cho, Staff Infrastructure Engineer, needs to update the antenna controller. Put the just-in-time steps in order.
- A change ticket for the controller is approved
- He does the work while the session is recorded
- The credential expires and the vault rotates the password
- Kael, signed in with his standard account, checks out a time-limited credential from the vault
Show the answer
- A change ticket for the controller is approved
- Kael, signed in with his standard account, checks out a time-limited credential from the vault
- He does the work while the session is recorded
- The credential expires and the vault rotates the password
Approval comes first, because the vault releases a credential only for an active change. Recording covers the work, and expiry leaves no standing access behind.
CHECK YOUR JUDGMENT
Four vendors offer biometric readers for the control room door at Station South. Vendor A reports a CER of 2.5%, Vendor B 0.4%, Vendor C 4.1%, and Vendor D 1.8%. Once the most accurate reader is installed, Sloane wants it tuned to keep intruders out, even at some cost to convenience. Which do you choose, and how do you tune it?
CASE FILE · CASE 10 · ENTRY 6 OF 7
Answer the closing question correctly to add this entry to your case file.
Lowest crossover, strictest door
Compare readers by crossover error rate, tune the control room door against false acceptance, and remove access the day its reason ends.
Next episode: Everyone is who they say they are. Tomorrow Kael plugs the demo laptop back into the lobby.
Review sheet: exam notes and quick reference
NEXT EPISODE