What are good security questions for resetting your password?

I picked up on this website from commentary on another blog and thought I would pass it on. I have had customers ask me this same question on numerous occasions when they are employing some sort of a self-service password reset product like Quest Password Manager, for example. The site is appropriately named: Good Security Questions. I like their approach to the problem of what a good security question is:

Thus, security questions have both benefits and liabilities. Poor questions create security breaches and confusion and cost money in support calls. Good security questions can be useful in the current environment, but are not common.
However, there really are NO GOOD security questions; only fair or bad questions. "Good" gives the impression that these questions are acceptable and protect the user. The reality is, security questions present an opportunity for breach and even the best security questions are not good enough to screen out all attacks. There is a trade-off; self-service vs. security risks.

So what is a good security question? Here’s their definition:

Good security questions have four common characteristics. The answer to a good security question:

1. cannot be easily guessed or researched (safe),
2. doesn't change over time (stable),
3. is memorable,
4. is definitive or simple.

An example of a good versus a not so good question would be “What was the name of the school you attended for Grade 6” versus “What was your high school name.” In this case, it’s a bit harder to research what school you attended in Grade 6 versus your high school which can easily be found on Facebook, Classmates.com or a number of other places.

This is an informative web site that can help you to determine what self-service password reset questions are the best for your organization. If you have or are planning on implementing a self-service password reset product I strongly recommend spending some time on the Good Security Questions website. It’s well worth it.

Technorati Tags: identity management,password reset,self-service,security,Quest Software,QSFT,Quest Password Manager

Choosing the Right Strong Authentication Option for Your Scenario

This webcast is happening today so if you can attend...

Webcast: Finding the Right Strong Authentication Option for Your Scenario
Date:  Tuesday, July 20 11:00 a.m. EDT / 8:00 a.m. PDT

Strong authentication doesn't have to be very expensive, difficult to implement and hard to sell to users. That's because there's been an explosion in imaginative and exciting options, as well as convergence on important interoperability standards.

In this informative live webcast, Randy Franklin Smith will describe the wide variety of strong authentication options available today, and provide you with a detailed approach to help you zero in on the best choice for your organization.

Register today

Technorati Tags: Active Directory,Defender,two-factor authentication,OTP,Quest Software,QSFT,identity management

Authentication crack could affect millions

A friend of mine brought this article to my attention a few days ago…

Researchers Nate Lawson and Taylor Nelson say they've discovered a basic security flaw that affects dozens of open-source software libraries -- including those used by software that implements the OAuth and OpenID standards -- that are used to check passwords and user names when people log into websites. OAuth and OpenID authentication are accepted by popular Web sites such as Twitter and Digg.

The researchers are going to disclose their results at the upcoming Black Hat conference in Las Vegas. Since both OAuth and OpenID are in use by major providers and potential by cloud services it will be interesting to see how much of a stir their work causes.

Technorati Tags: identity management,security,cloud,authentication,OpenID,OAuth

IAM exam results so far: 9%

I just finished a customer tour in Calgary, Canada. I met three customers a day for three days. All significant customers. Of those 9 customers here’s what they were using for identity management in their environment:

• Sun’s Identity Manager: 6 customers
• Novell DirXML: 2 customers
• Novell Identity Manager: 1 customer

The customers who were using Novell DirXML were looking to migrate to something else. Yes, they were using Novell DirXML – not Novell Identity Manager. The customer who was running Novell Identity Manager was quite happy with it and planned to continue to use it. The DirXML customers were migrating because they were migrating from Novell anyway. All the customers who were using Sun’s identity manager were unhappy and either had thrown out Sun or were in the process of finding an alternative. None of the Sun customers was looking at Oracle.

What were the common threads across these 8 customers?

• We never progressed further than the proof-of-concept. We didn’t POC our whole environment and when we tried to expand the POC scope into production we failed. We never saw the ROI we were promised.
• Every time we needed a change to the product we had to pay far too much.
• Everything required too much care and feeding to ensure the product was working.
• We needed specialized talent to keep it running.
• The consultants treated Active Directory as if it was only an LDAP directory. They did not understand Active Directory.
• Every time we need to change the structure of Active Directory we had to pay to re-code all of the scripts that were written.
• I was paying more in maintenance and re-programming the product than the cost of hiring a few people to do it manually. So I hired some staff and threw the product out.

 This was a great illustration to me of how far our little industry segment needs to improve. None of these customers were trying to do anything fancy. They had fancy plans originally but they were failing on basic provisioning or password management and were never able to progress further. It also further reinforced my view that there’s a great opportunity for a solution that doesn’t require a couple of busloads of consultants to get it (and keep it) running. A solution that delivers immediate value. A solution that customers are happy to have. A solution that is my dream…

Technorati Tags: identity management,jackson Shaw,QSFT,Quest Software,ACtive Directory