Security risk analysis and mitigation for online password management platform

口令是目前在线使用的最流行的身份验证机制形式 系统。尽管基于密码的身份验证存在臭名昭著的缺陷，但大多数用户主要依赖于此 保护他们的在线账户的方法。这是因为密码提供了最高级别的可用性 与其他更强大的身份验证机制相比。然而，由于密码的泛滥 由个人用户处理时，有更大的倾向于使用容易记住的简单密码。 这些简单的密码很容易成为黑客攻击的目标，因此创造了更多的安全机会 违规行为。该项目的行业合作伙伴已经开发了Kitestring密码管理器工具，该工具 通过提供用于存储和管理的在线存储库来解决密码激增问题 代表用户和组织的密码。这允许用户选择复杂的，从而更安全 他们不需要记住的密码。同时，作为有价值的证书的中央储存库， 密码管理器系统对黑客来说是一块磁铁。拟议的Engage项目的目标是 调查密码管理器系统设计和操作中固有的安全挑战，并进行 在此基础上，进行了KiteStrings平台的安全风险分析和渗透测试。选举的结果是 将研究新的安全风险概况和评估程序，以显著提高安全性 密码管理系统的级别。

Passwords represent the most popular form of authentication mechanism currently being used in online systems. Despite notorious flaws in password-based authentication, most users depend primarily on this approach to protect their online accounts. This is because passwords provide the greatest level of usability compared to other much stronger authentication mechanisms. However, due to the proliferation of passwords handled by individual users, there is a greater tendency to use simple passwords that are easy to remember. These simple passwords represent easy target for hackers and as such create more opportunity for security breaches. The industry partner for this project has developed the Kitestrings password manager tool, which solves the password proliferation problem by providing an online repository for storing and managing passwords on behalf of users and organizations. This allows users to select complex, and thereby more secure passwords that they don't need to memorize. At the same time, as central repositories for valuable credentials, password manager systems represent a magnet for hackers. The goal of the proposed Engage project is to investigate security challenges inherent in the design and operation of password manager systems, and conduct accordingly the security risk analysis and penetration testing of the Kitestrings platform. The outcome of the research will be new security risk profiles and evaluation procedures that will improve significantly the security level of password management systems.