Threat

Description

Solution

Technologies

Theft of the identity

Theft of a user identity consists to take advantage of the weak access rights constraints to the information system or the lack of users’ IT knowledge and then obtain their credentials to the information system.

In case the attacker got credentials of an authorize user as the username, it is imperative to make it hard to him to get access to the sensitive data of the information system. The proposed solution is to use something that belongs to the user meaning the biometric technology.

The iris biometric is the recommended one. It is known as the best biometric in term of accuracy (the image match incertitude is less than 1%).

Alteration of an authentic document

The attacker may use a replay technique by altering an original and authentic document received from the information system.

The solution consists to stamp a shared document with a date and a unique code. The code is uniquely recorded in the system and it is signed with a private key. Any shared document has a validity of 24 h maximum.

The size of the code is an important factor in the solution. A 512 bits is challenging enough when it is coupled with a RSA encryption algorithm.