Access your Pro+ Content below.
USB security tokens may not be as secure as you think
This article is part of the July 2004 issue of Information Security magazine
Strong multifactor authentication is crucial for high-security environments. Even strong password policies can fail in the face of cracker tools and users who carelessly share passwords or write them on Post-it notes. USB security tokens give security managers the proverbial "something you have" and "something you know." Further, the token provides secure storage for multiple login credentials, so users need to remember only a single password or PIN to access a VPN, network login, sales and marketing intranet or employee Internet site, making the USB token an attractive authentication solution. Information Security tested tokens from ActivCard, Aladdin Knowledge Systems, Authenex, DataKey (using a SafeNet token) and Griffin Technologies on ease of setup and configuration, administration and the range of supported applications (see "About This Review"). The upshot? Although the tokens themselves are secure, we found disturbing security weaknesses in the client software. Each of the tested tokens has flaws that could allow an ...
Features in this issue
While physical security at the Olympics is paramount, information security for its vast IT network is also a major challenge.
USB tokens aren't as strong as you think. Multifactor authentication is meaningless when the supporting software is insecure.
Learn why setting comprehensive email acceptable use policies can help minimize email risks and secure your email applications.
Will intrusion prevention ever live up to its promise?
In this tip, Web security guru, Nalneesh Gaur examines how hackers are using phishing scams to exploit financial sectors of the industry, why you should care and what you can do to prevent these attacks.
Columns in this issue
Enterprise security managers need to think like warriors when it comes to protecting their systems. Lawrence Walsh explains why.