Cluster Local Account Authentication Under SIEM Login Alerts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for local accounts in computing clusters are vulnerable, particularly during network or identity provider outages, making them a weak link that adversaries can exploit, leading to potential data breaches and damage.
Innovation Solution
Implement a system that dynamically switches from weak to strong authentication methods across a cluster in response to potential attacks, disabling weak methods and enabling strong ones, and closing sessions to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If weak authentication methods are used for local accounts, then ease of operation is improved, but security is worsened
Solution Approach 1:
The system dynamically adjusts authentication strength based on detected threats. When suspicious activity is detected, the system transitions from weak to strong authentication methods for affected accounts, and can propagate this change across the cluster. This dynamic adaptation resolves the contradiction by making authentication strength flexible rather than fixed, allowing ease of operation during normal conditions while ensuring security during threats.
Solution Approach 2:
The system changes the authentication parameter (strength level) based on security conditions. By monitoring login patterns and detecting anomalies, the system modifies the authentication method from weak (e.g., password-only) to strong (e.g., multi-factor authentication), effectively changing the security parameter while maintaining operational ease when conditions are normal.
2Reliability
If strong authentication methods are enabled for all accounts, then security is improved, but device complexity is worsened
Solution Approach 1:
Instead of applying strong authentication uniformly across all accounts, the system applies it locally only to accounts exhibiting suspicious behavior or located on affected nodes. This targeted approach maintains security for vulnerable accounts while avoiding the complexity overhead for the entire cluster, resolving the contradiction between security and complexity.
Solution Approach 2:
The system implements strong authentication partially - only for specific accounts or nodes where threats are detected, rather than applying it excessively to all accounts. This partial action provides sufficient security coverage for vulnerable areas while minimizing the complexity burden on the overall system.
3Reliability
If authentication methods are dynamically adjusted, then security is improved, but ease of operation is worsened
Solution Approach 1:
The system takes preliminary action by detecting suspicious patterns and preemptively strengthening authentication before actual breaches occur. This prevents security incidents while maintaining ease of operation for legitimate users, as the dynamic adjustment is triggered only by detected threats rather than universally.
Solution Approach 2:
The system uses feedback from monitoring login patterns and detecting anomalies to trigger authentication changes. This feedback mechanism ensures that ease of operation is maintained for normal users while security is enhanced when the feedback indicates suspicious activity, resolving the contradiction through condition-based responses.
Data Source
AI summary
Techniques described herein relate to a method managing accounts in a cluster. The method includes identifying, by an alert manager, an account login alert associated with an account and a node of a cluster, wherein the cluster comprises a plurality of nodes, wherein the node is one of the plurality of nodes; in response to the identification: making a first determination that the account login alert exceeds an alert threshold; in response to the first determination: disabling a weak authentication method for the account; enabling a strong authentication method for the account; disabling weak authentication methods for other accounts on the plurality of nodes; enabling strong authentication methods for other accounts on the plurality of nodes; making a second determination the account is associated with multiple sessions; and in response to the second determination: closing the multiple sessions associated with the account.