A 2021 independent penetration test by Secure Network Technologies of Power LogOn GOV-COA v5.5.29 found no weaknesses.
December 08, 2021 – Access Smart hired Secure Network Technologies, Inc. (SNT) to assess the security of Power LogOn GOV-COA, Power LogOn Certificate-based Offline Authentication (COA) for air-gapped workstations. Power LogOn GOV-COA works with contact PIV and CAC cards.
Power LogOn GOV-COA brings logon with the PIV or CAC credential’s existing digital certificate to air-gapped Windows workstations. Power LogOn GOV-COA uses the credential’s existing PIN and never stores it. Power LogOn makes no changes to the card’s data, so the agency’s cards don’t have to be reissued or revalidated. That saves the agency time and money, and deployment is immediate. Typical installation takes less than two hours.
SNT testing used digital forensics and hacking tools to attempt to bypass Power LogOn security and to verify that credential data are not stored in plain text. The main focus was on making sure that neither the Smartcard nor the software can be compromised.
SNT focused on 5 major non-Administrator vulnerabilities:
- No Storage of Unsecured Sensitive Data (e.g., credentials)
- No transmission of Unsecured Sensitive Data (e.g., credentials)
- No Security Bypass (e.g., evade controls)
- No Disabling of Controls (e.g., tamper with application)
- Enforcement of Policies (e.g., disable card access after logon failures)
Test results: SNT found that the applications function as expected. No efforts to bypass any functionality by a non-administrator user were successful.
The examination of memory and whole disk drives with forensic tools found no instance of credential pairs (username/password) in either memory or disk.
“It is SNT’s conclusion that the Power LogOn applications operate securely and introduce no vulnerabilities that could be exploited to bypass its security functions,” Robert Clary, Secure Network Technologies, Inc. “Power LogOn GOV-COA had a positive score of five out of five on all of the criteria. Even with our best efforts to hack using various approaches, Power LogOn did not display any weaknesses.”
About Access Smart: Access Smart, LLC makes Power LogOn, an IT-managed centralized enterprise password manager. 4049 Northwood Pl, The Villages, FL 32163-2293. Contact Access Smart.
