Printable View
I'm looking for a small business password solution. The recent Lastpass breach concerned me, then I read this article http://mylok.ii2p.com/blog/cloud-bas...they-safe.html
and am almost over the fence on using a hardware based solution for our employees.
Does anyone have any experience in using either method on a business level? Success/Failure?
For business and home I've always used PC's with a trusted platform module (hardware) that allows the use of security devices such as SecurID cards and biometric devices.
I'm now retired but I would neither recommend using cloud services for any business critical function nor recommend storing data in the cloud. The two primary reasons are security and loss of control.
steve is a douche, but he's right...usually companies use cards, as opposed to biometrics...'swipe your ass on the door game'.
My daughter works for a printing company (mostly forms and labels) that uses biometrics extensively for simply things such as time clocks, door access, etc. Surprisingly they have no security on their PC's, just a userID and password. That isn't real security.
@bludgeon
I don't know which Steve you are referring to since Mr. Jones didn't post in this topic. No matter, lay off the personal attacks.
But what about a USB device? You have control and they don't utilize a cloud based system. A private company I previously worked for used cards but also had a serious security breach a couple years back.
Security is only as good as the administration thereof. Every security system has weaknesses. The networks I managed/consulted were Orange Book C2 secure with all removable media devices disabled, if they were present. We used time-synchronous authentication where the password changed every 60 seconds. I retired in 1998 so I'm sure there are better methods today though my bank still offers it to their customers for online banking.
Well, I guess I have used most variants.........plastic keys, RFID, swipe cards, tokens, user ID and passwords.
I think that you need to distinguish between physical (access) security and system security.
Biometrics and keys are fine for physical access, with biometrics being superior in that you cannot lend them to anyone or lose them :D
RFID is pretty good as you can use it to control doors and track a persons whereabouts, so you know if there is a non-registered RFID device on the premises or if a person is in two places at the same time.
Tailgating is a problem with a lot of these systems, as once the door ois open there is usually no control over how many people pass through.
This can be catered for and biometric systems are probably superior in this area as well.
In a small business this shouldn't be an issue as everyone should know everyone else?
For systems security I would go for a card but the plug-in type rather than a swipe (they are more reliable in my experience). This is worn round the neck and if removed without logging out will lock the workstation. Make sure that the door access is driven by the same mechanism or one permanently attached to it. That way you force them to logout or lockout if they want to leave the room ;)
Otherwise I would use a token (RSA for example), that continuously generates one variable part of a two part authentication.
In both cases you must have a regular user ID and password so that you need both parts to gain access.
USB is not a security solution, it is a connection type, and a singularly unreliable one at that................I would steer well clear.
I am not so sure, I was using it many years after that! :)Quote:
We used time-synchronous authentication where the password changed every 60 seconds. I retired in 1998 so I'm sure there are better methods today
Actually it is probably perfectly adequate given properly implemented physical security and effective HR. You would still have to get into applications, which have their own user ID and password.Quote:
My daughter works for a printing company (mostly forms and labels) that uses biometrics extensively for simply things such as time clocks, door access, etc. Surprisingly they have no security on their PC's, just a userID and password. That isn't real security.
I am assuming that only machines in particular locations are permitted to connect to specific servers and applications suites, and that users are similarly restricted.
Your mention of tailgating reminded me of Barnett Banks of Florida, now part of Bank of America. On their headquarters campus they eliminated tailgating by a) tracking a person's location, b) controlling access in both directions through a door and c) using single person turn styles or rotating doors on all entrances and exits for each campus building. If one got caught someplace where the computer did not have them located, they had to call security to get released. A security infraction was a major black mark for employees and visitors alike.
True, I'm talking system security. I've seen security tokens, but we're not near that level. I want to make sure our passwords and files are secure, without it being too complicated. You know the type...Quote:
Originally Posted by nihil
A little too big-brother-ish for me, that's crazy.Quote:
Originally Posted by ua549
Well they do come with varying levels of complexity and so I suppose, security.Quote:
I've seen security tokens, but we're not near that level.
A simple solution is the plastic key or card that you issue to each user. The management software will check that it was issued to the user ID and password (the "account") that is entered. You need a fancy keyboard to read them, and a device to write them.
You don't say, but I am guessing that you use Windows............you can set password complexity and life rules in there. You should also be able to set which workgroups or accounts are allowed to access what areas of your systems.
After that look at the security features in your various software applications to decide which users/groups are allowed what privileges.
Good luck! :)