Archive

Posts Tagged ‘authentication’

The Five A’s of Security

September 7th, 2009
No comments

Personal and online security is a desirable state and a complex idea. This guide offers a general overview of the main idea that, when used together, help us establish a level of security that makes us comfortable using our computer in an online world.

A is for Awareness

Awareness

The first subject in talking about security is awareness. We need to be aware, for example, that we are not always safe in the world (online and offline). When we are online, most people are aware that there are certain dangers such as viruses, phishing, and spam that threaten our safety (personal, financial, or data). Once we know that problems exist, we are more likely to learn about and take steps to avoid danger and keep ourselves safe and secure.

A is for Authentication

Authentication

Authentication is the process of verifying that you are the real you. Your friend may authenticate you to other friends by saying something like “this is my friend Chris” (or whatever your name is). You may prove that you’re who you are to a business entity by answering questions that only you would know the answer to. You are usually being authentic when you speak honestly, from your perspective, to someone you love.

A is for Authorization

Authorization

When you are authorized, you have access to a computer system. Verifying users of your computer, or your work’s computer, or any storage systems or online accounts, can help you track the activity in files and resources. An unauthorized user can be prevented from gaining access to your information. Authorization is the process of assigning permission to use certain files and resources.

A is for Access Control

Access Control

Setting permissions on files, directories, accounts, or computers can establish limits to these resources. You may wish to be the only person that read and update your personal finances, for example. This is referred to as individual read-write access (only the owner of the file can read or update). At work, your group may have access to read and maybe edit a collaborative document. Most of the web pages offer global read-only access. Individual, group, or global access can be set to allow reading, editing, and/or other permissions.

A is for Auditing

Auditing

As individual computer users, we don’t often think about the clues that we can use to track where we’ve been and what we’ve been doing. However, whenever we visit a web site, the site’s server automatically keeps a record of things like our domain name or IP #, the time and date of our request, the page or file requested, a code indicating success or error, the number of bytes transferred, and more. As the visitor, we don’t have such tracking tools (and in many cases, don’t need them). However, as our habits and travels on the Internet are increasingly scrutinized by the sites we visit, we have a stronger case for understanding what is being compiled about us.

Coaching moment: In reality, these five A’s are somewhat intertwined. For example, it doesn’t make sense to have Authentication without Authorization. Access control doesn’t happen without Authentication and Authorization, and none of these make sense without Awareness.

What does this have to do with digital identity? These are the pieces that make up our digital records, including who we are and what we’re allowed to do. Sometimes we have control over these decisions, and sometimes control is in the hands of others. It depends on the context of where we are and what we need.

[del.icio.us] [Facebook] [LinkedIn] [Ma.gnolia] [Technorati] [Twitter] [Email] More »

history, records, tools , , , , , , , , , , , , ,

Authentication

November 18th, 2008
No comments

When something is authentic, that means the claims made about it (or by it) are true. To authenticate something or someone means to gather evidence sufficient for you to believe that it is as claimed.

For example, I may be authenticated by seeing and talking to me (if you know me), or by my DNA (if there is some reason to require that level of certainty). A driver’s license will also work as authentication to prove I have sufficient privileges to drive or buy adult beverages.

In the case of ATMs and debit cards, you need to prove who you are by providing your card and a secret PIN (personal identification number). Similarly, when you log into most online services, you have a user name and a password. This is called two-factor authentication. That means you need two pieces to prove who you are.

Two factor authentication is supposed to be more secure than single factor (one bit of information). However, many of us use the same user name and password for many or all of our online sites. In this case, it is easy for others who know (or learn) your combination to access many of your services. Is this a risk you are comfortable taking?

Contrast that with people who use different names, passwords, birthdates, and other data on each site. These people may have a hard time remembering all of the different data that they’ve provided, so it might be hard for them to prove that they are who they say they are. Has this ever happened to you?

Coaching moment: There are tools being developed to help you maintain and control your passwords. You might be interested in checking out Vidoop or Sxipper for two browser-based approaches. In a future post we’ll also look at OpenID as a different approach to authenticating yourself.

[del.icio.us] [Facebook] [LinkedIn] [Ma.gnolia] [Technorati] [Twitter] [Email] More »

friends/family, records, tools , , , ,

NYTimes on Passwords

August 13th, 2008
No comments

Yesterday the NY Times ran an article on passwords as access tools for our online accounts. The author rightly points out that passwords have problems:

Password-based log-ons are susceptible to being compromised in any number of ways. Consider a single threat, that posed by phishers who trick us into clicking to a site designed to mimic a legitimate one in order to harvest our log-on information. Once we’ve been suckered at one site and our password purloined, it can be tried at other sites.

The solution urged by the experts is to abandon passwords–and to move to a fundamentally different model, one in which humans play little or no part in logging on. … In short, we need a log-on system that relies on cryptography, not mnemonics.

The article continues, extolling the virtues of Identity cards and bemoaning the security distraction caused by OpenID. I think the author is missing the point about how we have choices as to combining tools. No single tool is going to be a silver bullet.

The Times article also rightly points out the challenge in adopting any alternative access system: users must adopt tools that are workable for them, and the websites must allow access to their services through these tools. This is really the more significant problem.

Coaching moment: Your passwords control pieces of who you are. In your hands, they give you power to do certain things. In the hands of another, the power is no longer yours.

[del.icio.us] [Facebook] [LinkedIn] [Ma.gnolia] [Technorati] [Twitter] [Email] More »

history , , , , , , ,

Switch to our mobile site