The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why?
UPDATE What are the pros/cons of smart cards, compared to other methods?
|show 2 more comments|
CAC cards themselves are used only by the US Department of Defense. But similar cards are used elsewhere. By 'similar' I mean embedded-chip plastic cards that carry a picture and other secure identity information and that use PKI.
As you can see it tends to be governmental organizations that have traditionally issued other forms of ID that are the ones most strongly adopting CAC-style cards.
I know of a range of organisations who use smartcards either for access to buildings, access to computers or terminals (eg citrix) or for both. It is the sort of organisations you would expect - ones that have a high impact if unathorised access is gained by an attacker.
Also, as @ewanm89 commented, most European bank cards are now smart cards - and some banks use this authentication (eg one of my banks will require me to insert my card into a card reader, input my PIN, and then input a number from a payment authentication page and type the number some crypto function on the card gives me back into the page to prove I physically have the card, as well as knowing the PIN)
Many companies use various hardware devices (e.g., RSA SecurID) for authentication. I don't know how many other organizations use smartcards (like the CAC card) for security.
One limitation of smartcards and CAC cards is that they do not protect against malware on your PC (e.g., the man-in-the-browser attack). In particular, malware on your computer can record your PIN using a keylogger (since that is typed on your keyboard and only then sent to the smartcard), and then can send arbitrary requests to the smartcard for signing. This is basically a man-in-the-middle attack, with the malware getting in the middle between the user and the smartcard. Since the smartcard has no independent input channel or output channel, it has no way to know it is being fooled in this way, and the smartcard will sign anything the malware asks. Thus, malware on your PC completely defeats all security benefits of the smartcard. (The same is true of RSA SecurID devices as well.)
This means that, arguably, the primary benefit provided by a CAC card or smartcard is that it supports secure authentication to a remote site, as long as there is no malware on your local machine. However, many other hardware devices (e.g., RSA SecurID) provide similar benefits, so the added value of a smartcard is debateable.
In the last 18 months the company that makes that RSA security tokens was compromised. information on hundreds of thousands of their devices ( in use by their customers ) was leaked. This information allowed the criminals who gained access to this information, access another companies information ( although to be fair there was a social engineering aspect of that attack also ) provided that information stays save the RSA security devices is one of the most secure ways of electronic device access.
Common Access Cards ( aka Smart Cards ) contained a pki security certificate. I cannot speak to who else uses them, I have seen them used by both a defense contractor and the govenment agencies.
As pointed out there is one weakness to the cards, the human element, the password and/or pin used to decrypt the information encrypted by security certificate can be harvested. There is/was an exploit in one of the clients that provides a means to extract the certificate information on the card.
The important aspect about these smart cards is you must have access to the certificate which is only contained on the card. When the card no longer is visible to the system, the certificate is remove fromt he system, proper system configuration is a must.
A man in the middle attack can be prevented, but if it happens the attacker only has access, while they have the ability to use the certificate.
Certificates that expire within a small amount of a time ( 2 to 3 years ) is a must.