resource center
  See your link here
|
Computerworld -
Organizations are discovering an easy way to reduce the workload of IT and help desk administrators -- password self-service.
According to Gartner Inc., password-reset and user-identification problems represent 15% to 35% of help desk call volume -- with a typical cost per call of $10 to $31. Even this humble author, looking through his recent trouble tickets, must sheepishly admit to four requests for resets over the past nine months.
By enabling end users to reset their own passwords and unlock their Windows accounts, businesses can free up time for administrators to concentrate on more valuable pursuits.
The typical self-service system provides a Web page where end users can answer questions to authenticate their identities and then reset their passwords.
This requires an initial setup to register users and establish the correct responses to challenge questions. Depending on the implementation, the reset may affect one platform, typically Windows, or accounts on multiple platforms and applications. While the latter system is the ultimate nirvana, organizations that choose this approach must be reconciled with the need to roll out agents, incur higher purchasing costs and have a longer implementation duration, yet still leave out some applications that can't be cost-effectively integrated.
Most security breaches are internal. Strong, secure passwords are the best defense against these attacks. In their attempts to weigh the technical costs and benefits of self-service systems, organizations often overlook the fact that, above all, any password self-service system must be secure. The return on investment of self-service dissipates the instant a system is hacked due to a lack of security.
Paramount to ensuring security is protecting the password-related data. In general, organizations should have a few standard rules for protecting this data:
Once you have ensured that only secure questions are used for authentication, it's important to make certain that the responses are equally secure. Asking hard-to-guess questions isn't of much value if the end user configures his profile with easy-to-crack responses. To avoid this possibility, duplicate responses must be prohibited and minimum length requirements enforced.
Automated password-cracking systems present another threat that must be thwarted. Only one randomly sequenced question should be presented per page to make automated cracking more difficult. In addition, after three failed attempts to authenticate, the self-service site must lock out the user. In the rare case where a user is locked out for this reason, he must make the costlier call to the help desk to reset his password. However, focusing on total cost reduction means implementing self-service that doesn't reduce your security posture.
One last line of defense to help mitigate exposure when an account is hijacked is through notification. The self-service system must send e-mail to the account owner on all password-reset attempts—successful and unsuccessful. This ensures that when an account is hacked, the user is notified and remediation measures can be deployed quickly.
For this to work securely, the e-mail address must be configured during the initial profile setup. Some systems allow the e-mail address to be entered during the reset attempt. This means that if a hacker is able to falsely authenticate himself, the account owner will never receive e-mail notification of the password change.
Although the need for such security precautions might make self-service seem overwhelming, this reasoning overlooks the inherent security flaws of using a human intermediary for password management. How does your organization establish authenticity for users calling in for resets today? How likely are overburdened administrators to conform to corporate guidelines for validating authenticity, and how susceptible are your help desk personnel to social engineering attacks?
Password self-service systems can help IT departments implement strong password policies. Ironically, strong passwords can lower internal security because end users will often write down rapidly changing, complex passwords on sticky notes. Policies can be established restricting users from doing this, but IT departments find them difficult to enforce. With a self-service system, IT can demonstrate that end users aren't being asked to wait for password resets and therefore have no reason to write down their passwords.
A secure password self-service system not only provides organizations measurable cost reduction; it can also help create a safer computing environment. Ultimately, securing a self-service site is easier than ensuring that employees conform to security best practices. So discover the joy of practicing safe resets, and find out how secure password administration through self-service can benefit your organization.
Indy Chakrabarti is product marketing manager at NetIQ Corp., a provider of systems and security management and Web analytics offerings in San Jose.
 | |||
|
