Strikeforce Products at RSA2013
February 27, 2013, RSA Conference, San Francisco—We talked with Strikeforce Technologies about security for various devices. Protecting identity requires a suite of technologies including multi-factor, out of band authentication, anti-keylogging, and separate solutions for mobile security. The need for these tools is greater due to the advent of attack vectors like zero-day, APT, and dynamically changing file signatures.
The gap between the anti-virus vendors’ responses and the latest threats can be as high as a month, so during that time, many machines are unprotected. Adding tools that can operate safely in a compromised environment can reduce the risks and prevent the malware from forwarding valid data.
StrikeForce has a set of authentication technologies under the brand name ProtectID. This multi-factor out-of-band software is installed locally or in the cloud and uses out-of-band methods (the authorization is not through the same channel as the transaction) plus hard or soft-mobile tokens. The tools interface to other applications through standard tools like RADIUS. There are many applications such as account provisioning and password resets that can use the high security authentication, as well as a federated identity or OpenID.
Another tool accounts for the possibility of infections by encrypting the keystrokes, so even if a device is compromised, the attacker cannot log keystrokes. Keyloggers capture keystrokes before they get to the security of the app. This encryption prevents the malware from sending any useful data because all the keystrokes are sent as repeating sequences of 0-9. GuardedID prevents APTs and man-in-the-middle attacks from getting any useful information. This tool supports Windows, VPN clients, desktop applications, and most browsers.
Finally, MobileTrust for Apple and Android mobile devices puts these together and adds a strong password generator, support for OATH tokens, and an encrypted database for notes and other data. The password vault stored an unlimited number of passwords with associated websites.
