If compromised, passwords can make an organization’s systems insecure; they also mean that the organisation cannot hold their users accountable for activities that they really did perform. Should a user be taken to task for a mistake or fraudulent action that was perpetrated under their username and password, that individual can always deny or 'repudiate' that they did it. They can always claim that someone else must have stolen or discovered their password, and impersonated them.
Many companies keep audit trails of on-line activities to allow them to investigate suspicious activities, but without the ability to hold users accountable for those activities, the audit trail becomes essentially useless. The solution is to combine the user password with some form of authenticication.
Burnbank recommend Signify secure Identity Management software and Managed Authentication services which allow you to positively identify your staff, clients and other individuals who need authorised access to your sensitive information and systems. The Signify service gives its customers a simple and comprehensive solution to these problems:
- By implementing a rigorous set of processes for rolling out SecurID strong authentication to the customer's user community, Signify can provide assurance that all users have received their digital identities safely.
- The two factor authentication system makes it almost impossible for an attacker to guess or steal a user's digital identity, so it is more difficult for a user to repudiate an action.
- Signify provides a set of 'End User Rules' which the customer should incorporate into their employment or other contract.
- These rules clearly state that the user must take care of their token and secret PIN, and that the user may be held liable if they are compromised and are then misused.
- All operations carried out by the customer's users administrators are logged and can be audited should there ever be a problem