You leave work and find your car parked where you left it. What you don't know is that your friends, as a joke, carried your car to another spot. But then, remembering your reaction last time they pulled a prank, they moved it back. When you approach your car, nothing seems amiss--after all, your keys were in your possession all day. Your expectations are met, and you drive home happily. This is a fundamental exercise in what we know and, more important, what we take for granted.
Now pick a user account at random from your Microsoft Windows NT Domain or Active Directory, see when the user last logged in (if you're not logging Logon/Logoff events, stop reading this right now and start logging), and without getting up from your desk, try to determine if that ID was used by the person to whom it is assigned. How confident are you that it was Joe Bob (user ID: jbob) accessing that account?
If Joe Bob is a low-level user with no access to critical business resources, such as internal data, business plans and financial and HR information, you might not need much assurance that user jbob is really Joe Bob. But if Mr. Bob can modify data, access HR records or manipulate financials, that's a whole different ball of wax: Knowing that users are who they say they are is what authentication is all about.
FYI
Next time a user complains that he just can't remember complex passwords, pass along this hint published by the Bergen County, N.J., Technology Center: Take a phrase you like and will remember. Now use the first letter of each word. Add any appropriate capitalization, punctuation and other character manipulations. For example: "Three blind mice, see how they run" would end up as "3bm,shtr."
The AAA Triptych
We've said it before and we'll say it again: You will never have a totally secure network. The best you can hope for is that your security strategies will minimize exposure to attack, and if you are hit, the damage can be contained. Plenty of point products are available to help eliminate avenues of attack. Firewalls, VPNs, SSL, host- and network-based IDSs (intrusion-detection systems), and virus scanners all bar entry points. Encryption protects data in storage and in transit. But none of these technologies helps you let only authorized users in, only where they should be. Authentication is where this starts, and access control and accounting close the loop (for in-depth information on these three pillars of network security, see "New Security Threats--Stronger Defenses").
Access control and accounting are possible only if authentication takes place, but without all three processes, you can't implement a policy that stipulates who can access what, when, where and how, nor can you track who did what, when, where and how. Authentication--matching a user ID to an individual--is fundamental to security. Without knowing for sure that a user really is who he says he is, all your efforts toward access control and accounting are worthless.
Three basic user characteristics establish authentication:
• Something the user knows, such as a password or a PIN;
• Something the user has, such as a token or a smartcard;
• Something the user is, established biometrically.
Access control goes hand-in-hand with authentication, and in fact, the two sometimes dance in one another's wake. Without authentication, access control gives you only the "where and what"--where users are going, where they are coming from, what services they are trying to reach--but not the "who." User-based access control adds that piece of the puzzle and further restricts access to resources, files on a network share or options in management applications, for example, based on who a user is or with what group he or she is affiliated.
And accounting creates a historical listing of who authenticated when and, in some cases, for how long. Accounting also notes failed login attempts. The terms "auditing" and "accounting," though often confused, have different meanings. Accounting is simply listing login information; auditing adds details about what a user did while connected and creates a trail that can be reconstructed. You can do accounting with auditing data but not vice versa.
REPORTS
Analyize In-Line NAC strategies and products.
ANALYTICS Plan and design your enterprise blade server deployments
2009 IT Salary Survey: Meager Raises, Solid Prospects
Though raises are notably smaller than a year ago, and job security’s shrinking, IT careers are looking safer than many others in this economic downturn. Get all the findings in InformationWeek's 2009 IT Salary Survey. Available FREE for a limited time.
REPORTS
ANALYTICS
Follow 
