This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Knowledge Based Authentication Performance Metrics Project"
(→Main) |
Luisenriquez (talk | contribs) (→Main) |
||
| Line 12: | Line 12: | ||
==What is KBA-PMP == | ==What is KBA-PMP == | ||
| − | There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication. | + | There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective. |
| Line 23: | Line 23: | ||
<!--From Wikipedia— "Knowledge-based authentication, commonly referred to as KBA, is a method of authentication which seeks to prove the identity of someone accessing a service, such as a website. As the name suggests, KBA requires the knowledge of personal information of the individual to grant access to the protected material. There are two types of KBA: "static KBA", which is based on a pre-agreed set of "shared secrets"; and "dynamic KBA", which is based on questions generated from a wider base of personal information."--> | <!--From Wikipedia— "Knowledge-based authentication, commonly referred to as KBA, is a method of authentication which seeks to prove the identity of someone accessing a service, such as a website. As the name suggests, KBA requires the knowledge of personal information of the individual to grant access to the protected material. There are two types of KBA: "static KBA", which is based on a pre-agreed set of "shared secrets"; and "dynamic KBA", which is based on questions generated from a wider base of personal information."--> | ||
| + | |||
| + | <!-- In this project, we are focused on Dynamic KBA. However the methodology described here can also be suitable for static KBA. Data is such a broad category. We live in the Big Data era, and information is gold. Today, KBA service providers can get data sources from public records, social networks, and many others. Tose sources can be used for remote identity proofing. | ||
| + | |||
| + | However, legal restrictions such as personal data protection and the right of privacy, are legal restrictions in the fields of data transfers to third countries, data retention, data processing, and so on. The methodology established on this standard tries to solve these privacy issues. | ||
====KBA-PMP Project Supports the NSTIC Guiding Principles ==== | ====KBA-PMP Project Supports the NSTIC Guiding Principles ==== | ||
| Line 75: | Line 79: | ||
[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br> | [https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br> | ||
| − | |||
| − | |||
| − | == | + | == Standard DRAFT == |
| − | |||
| − | + | <!-- This is an open project, so you can check a draft of the document and contribute. The document is currently hosted on github: [https://github.com/luisenriquez/kbapmp]<br> --> | |
| − | |||
| − | |||
==== AGENDA ==== | ==== AGENDA ==== | ||
All Meetings are Open and All are Welcome | All Meetings are Open and All are Welcome | ||
| − | * | + | * We are currently debugging draft v12. Join us on github. Don't forget to commit. |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
== KBA-PMP Project Metrics == | == KBA-PMP Project Metrics == | ||
| Line 132: | Line 99: | ||
<!--== Quick Download == | <!--== Quick Download == | ||
| − | == | + | == [https://github.com/luisenriquez/kbapmp] == --> |
== Classification == | == Classification == | ||
Revision as of 09:15, 21 April 2016
News and EventsPlease see the News and Talks tabs What is KBA-PMPThere is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.
KBA-PMP Best Practices2. Identity solutions will be secure and resilient.
Related Projects[[1] Choosing and Using Security Questions Cheat Sheet] OWASP NIST NSTIC Initiative LicensingCreative Commons Attribution ShareAlike 3.0 License
|
Project Leaders
Join our Mailing List
Standard DRAFTAGENDAAll Meetings are Open and All are Welcome
KBA-PMP Project Metricshttps://github.com/KBA-PMP-ADMIN
Classification
| |||||
May 19-20, 2015
Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/.
May 21, 2015
Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/
OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project
Goals - To meet the requirements of the IDESG KBA Solicitation:
KBA PROJECT PHASES (PROPOSAL) Dear KBA collegues, we propose an action plan divided in the following phases:
FIRST PHASE: SCANNING THE MARKET The goal of this first phase, is to understand how KBA is working today (static and dynamic), and how KBA methodologies have been implemented by KBA providers. I think this a good departure point.
- 1. Footprinting the KBA market providers.
- 2. Identifying the KBA product providers used by the main market players.
- 3. Identifying the advantages and drawbacks of KBA provider's methodology.
- 4. Draw the document's structure.
- Complete document structure v1
- 5. Initial Timeline
- 5. Launch Participant Outreach
SECOND PHASE: DEVELOPMENT Once the advantages and drawbacks of the KBA market have been clearly identified, it would be necessary to have our own platform for testing purposes. This will give us the right perspective about developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest building an open wiki, to get community feedback.
- 1. Setting an Application for KBA testing purposes.
- 2. Build an open wiki for community feedback.
- 3. Test the KBA proposals in our test application.
- 4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).
THIRD PHASE: EDITION This phase is very important, as it concerns the text edition. Once all proposals have being tested in our lab, we should translate them into a clear document.
- 1. Edit the contents of the sources (sources such as the wiki).
- 2. Release the version 1.0. and license it under the terms of a suitable license.
Initial Overview
- Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
- Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
- Survey and research other standards groups and their interests.
- Phase I footprinting
- Phase II Development
- Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
- Research Licensing models //
1. Knowledge Based Authentication: Paradigms and Challenges https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"
Contributors
Luis Enriquez Project Co-Leader
How can I participate in your project?
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.
If I am not a programmer can I participate in your project?
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.
