Please note, that the Knowledge Base isn't translated to english completely at the moment. You will still find some german texts - we are translating permanently the outstanding parts! Thank you for understanding!

Passwords vs. OTP vs. PKI

		INFO & KNOWLEGDE

Authentication systems are security infrastructure and the Return on Investment (ROI) of an infrastructure is hard to quantify. Often even afterwards there isn't a reliable investigation possible. - empirical studies often show a long term interrelation between success and the use of certain infrastructure or technologies.

Sometimes this isn't even necessary, because it has to be done because of compliance reasons, business, or operational security. When was the calculation of ROI of your telephone system, your E-Mail-Server, your website or your accounting departement? How much yields infrastructure?

The return is hard to quantify, the necessary investment is easier to calculate, the Total Cost of Ownership (TCO).

		STUDY

Passwords vs PKI vs OTP

Security is a "Business Enabler" not a "Business Disabler", an existing password doesn't enable secure usage ord new fields of a secure use. But complexity an time can be lowerd conisderably using certain solutions or PKI-products - e.g. Autoenrollment in a MS-Enterprise-CA .

	Password	OTP - Hard Token	PKI - Soft Token	PKI Hard Token
Multi Factor Security	No	Yes	Pseudo	Yes
technical security	low	high	medium	high
System complexity	low	medium	medium	high
Enrollment complexity	low	high	medium	high
Enrollment time	short	long	short	long
operational effort	high	low	medium	medium
possible field of application	low	medium	high	high
secure usage by user	low	high	low	high

Authentication with PKI

Passwort Challenge Response

One-Time-Pass - Systems

Challenge Response with PKI

Security Economics

CobiT-system security with PKI

CobiT - authenticated data administration with PKI