Difference between revisions of "Account Recovery"

From MgmtWiki
Jump to: navigation, search
(Full Title or Meme)
(Context)
Line 3: Line 3:
  
 
==Context==
 
==Context==
 +
* The original [[Account Recovery]] challenge was
 +
 
[https://authenticatecon.com/authenticate-2021-day-three-recap/ The Challenge of Account Recovery at Authenticate 2021].
 
[https://authenticatecon.com/authenticate-2021-day-three-recap/ The Challenge of Account Recovery at Authenticate 2021].
  
Line 12: Line 14:
  
 
“What we don’t want to create is a gate that you can walk around, or walk through because we haven’t secured the gate with a fence all the way around the thing that we’re trying to protect,” Saxe. “So the recommendation is to register multiple authenticators, so you have a backup.”
 
“What we don’t want to create is a gate that you can walk around, or walk through because we haven’t secured the gate with a fence all the way around the thing that we’re trying to protect,” Saxe. “So the recommendation is to register multiple authenticators, so you have a backup.”
 +
==Problems==
 +
*The major issue with [[Account Recovery]] is the direct attack on the process to gain fraudulent control of the user's accounts.
  
 
==References==
 
==References==
  
 
[[Category: Glossary]]
 
[[Category: Glossary]]

Revision as of 06:13, 26 October 2021

Full Title or Meme

Perhaps the most difficult step to perform security is Account Recovery when the user has lost control of access to their accounts.

Context

  • The original Account Recovery challenge was

The Challenge of Account Recovery at Authenticate 2021.

A key challenge for user accounts is the issue of secure recovery. No matter how secure the authentication is to access an account, if there is a weak recovery system in place, an attacker will be able to bypass security.

“Account recovery is really just another form of authentication,” Dean Saxe, Sr. Security Engineer at Amazon Web Services stated.

In a session, Saxe detailed what he referred to as the Iron Triangle of Account Recovery, which includes the concerns of access continuity, security and privacy. Saxe noted that the account recovery mechanism itself should be reasonably secure, preferably as secure as the primary authentication.

“What we don’t want to create is a gate that you can walk around, or walk through because we haven’t secured the gate with a fence all the way around the thing that we’re trying to protect,” Saxe. “So the recommendation is to register multiple authenticators, so you have a backup.”

Problems

  • The major issue with Account Recovery is the direct attack on the process to gain fraudulent control of the user's accounts.

References