Containerize the User:
All system design should consider a variety of things, each of them unique.
What works very well for any of the systems is having a function that is out of the loop,
and keeping elevated functions inside of the loop.
So the answer for the zoom / video chat is to make it so that out of the loop changes, from external actors are not possible.
Each of these platforms offer some control over that, if the video connection was on a web page, like a Jitsi-embed, access controls could be placed at the WAF, Network, and user permissions inside the web application. While zoom and google would require administrative changes in some ‘Control Panel’, what I see is that many organizations use such a variety that the chaos is in the salad, how do you secure the platforms just this time?
A policy that prohibits using unauthorized services for internal events like verification, or escalation is a good enforcement mechanism, and introduces the speed-bump because the operators will want to follow the policy.
This addresses a social engineering attack that is ‘Just use our chat’, likely the validator will know the policy and stick to the policy of only approved platforms. If this fails then the attack will move to it’s next phase.
But I want to focus on the out of band part
The yubi key, is an excellent example of an out of band proof solution, however it won’t work for every component of validation but it should score high on the list.
In Energy and building systems Lock Out Tag Out is the parallel that helps with system design, energy like a computer or data system at the layers across the lifecycle of interactions we can likely create other useful lock out, tag out or cool down.
The circuit breakers in your house have unique areas they break, and of course a main breaker if the source of the problem is TOO big, the break occurs across all of the breakers. We want that same process in escalation, with absolute granularity on the system to Fail Safe.
The more out of the “box” the process is, the more effective the measure is.
This effectiveness is counterbalanced by the time it takes for implementation.
In my experience if the engaged business units have by in and good operational process, this can be resolved in a manner that does not add too much time, to resolution.
I think looking at systems, and what we see today that likely a better approach to computer users, is to containerize their systems, that have jump hosts to escalated privileges, services and accounts.
A developer could easily run a container for a development environment, with the layered provisions inside a container, write that code, and then move that code off the environment to the larger environment, this however is not as catchy as modern IDE and the plugins that are part of the access control nightmare, everywhere.
In previous industry experiences a call to a third party (HR, Security, Operations), with specific identity questions that would only be answerable by the individual were often what the company used. The questions across Energy and Financial sectors were different, but shared the traits that it would be difficult for an outsider to answer these questions effectively.
Mathematically we want this transaction between the requester and authenticator to be a Zero Knowledge Proof the puffin example in this video is a great example of two people proving something based on a revelation of the unique piece of data.
