Authentication

		INFO & KNOWLEGDE

Authentication Systems

You need a credential for authenticating yourself to a data processing equipment. This credential can be 'something you know' (password), 'something you have' (card, certificate) or 'something you are' (biometrics) - or better - a combination of this possibilities. Of course these variants are offering varying security levels.

		PRACTICE

Workstation / Domain An IT-System authenticates the users with a password as credential. But the keyboard as input device has lost its position. Smart Cards and Token with certificates, or OTP-Based, even biometrics are on their way.

Application You want to authenticate your application users in a secure way? There are many solutions using different approaches to this.

Single Sign On Single Sign On Lösungen bieten zumeist einen zentralen Authentifizierungsserver der das One Time Passwort prüft und zentral anderen Applikationen dieses Authentifizierungsservice zur Verfügung stellt. OTP Lösungen unterscheiden sich durch unterschiedliche Token, die verwendet werden können und auch im verwendeten OTP-Verfahren.

Webauthentication There are many possiblities for webapplications to authenticate their users.By using SSL it easy to use client certificates, which are mapped to users on the server and granting access to services and data on this secure way.

Remote Computer What's is applied to local workstations and domains, this has to be applied to VPNs and Terminalservers essentially, because there is access to networks is granted and there is no physical presence necessary. For this reasons strong authentication for VPN and Terminal Server Sessions is necessary because risk is higher than it was ever on Wardialing in the stone age of Remote Computing.

		STUDY

If you want to some research about the solutions, do this also in our knowledge base. There you can find more about the basic concepts and functionality of the particular solutions, cryptographic basics and instructions for configuration and how you can successfully build these solutions into IT-Security Governance framework.