Company XYZ has decided to make use of a cloud-based service that requires mutual, certificate- based authentication with its users.
The company uses SSL- inspecting IDS at its network boundary and is concerned about the confidentiality of the mutual authentication.
Which of the following model prevents the IDS from capturing credentials used to authenticate users to the new service or keys to decrypt that communication?
Click on the arrows to vote for the correct answer
A. B. C. D.B.
The best option among the given alternatives to prevent IDS from capturing credentials and keys is to use smart cards that store x.509 keys, signed by a global CA (Option C).
Smart cards are secure physical devices that store digital certificates and private keys. They provide a higher level of security than passwords or other traditional authentication methods. The use of smart cards ensures that the private key used for authentication is not exposed, making it difficult for an attacker to steal the key. Also, smart cards are tamper-proof and can be used to protect against phishing and other types of attacks.
X.509 is a standard that defines the format of public key certificates. A certificate authority (CA) is a trusted entity that issues digital certificates. Global CA's are trusted by most devices and applications, providing a level of security and trustworthiness.
Option A is not a suitable solution because OATH (Open Authentication) is not designed for mutual, certificate-based authentication. OATH is an open standard for two-factor authentication using one-time passwords.
Option B, Active Directory Federation, is designed to allow secure authentication between different organizations or domains. However, it may not be suitable for mutual, certificate-based authentication, which is required in this scenario.
Option D, a third-party, SAML-based authentication service, may provide secure authentication, but it may not prevent IDS from capturing the credentials or keys used in the communication.
In summary, the use of smart cards that store x.509 keys signed by a global CA is the best option for preventing IDS from capturing credentials and keys in mutual, certificate-based authentication in a cloud-based service.