Celestix MSA 4200 Series Installation Guide download pdf (Page 55)

51 | Page Celestix HOTPin Appliance Installation Guide

To access token provider properties:

Navigate to HOTPin|Providers. 1.

Select a provider from the list. 2.

Click Properties. 3.

Properties will vary among the different providers. See the individual provider’s

section for details about configuration.

Provider Security Considerations

This section discusses some issues that system administrators should review

when considering the use of token providers in a HOTPin system deployment.

You should evaluate the risks to determine whether provider options are

acceptable for your organization.

A token provider is as secure as the encryption method for the technology being

used. If email is sent in plain text, or the HTTP provider is not deployed with

SSL/TLS, then the sent token code is vulnerable. Both email and HTTP traffic

can be sniffed or intercepted while traveling over the Internet; you should

consider whether using HTTPS options provide the necessary level of security.

SMS messages are handled by third-party service carriers and you should

review the technology for any issues that may compromise secure access to

your network resources.

Please Note: To use a stolen code, the malicious user would need to know

where to log in as well as the user name and PIN* for the account

the intercepted code belongs to (*if PIN requirement is enabled).

To decrease potential risk for provider options, the next available token code is:

 Sent only once to the user.

 Valid for a limited amount of time. See Configure System Settings :

Token Provider for Sent Code TTL (time to live).

It is also important to note that the loss of a single token code does not

compromise the system as it does not provide information that would allow a

hacker to guess the next token value. A lost user device with active client

software, for example, does represent a security issue (thus for client software

deployments, users should be instructed to report lost devices immediately).

System administrators can also improve security by incrementing a user's

authentication failure counter each time a token provider sends the user a token

code. When the maximum is reached the account is locked out (see Configure

System Settings : Authentication : Maximum Authentication Failures).

1 2 ... 50 51 52 53 54 55 56 57 58 59 60 ... 100 101

No comments

Celestix MSA 4200 Series Installation Guide Page 55