Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

According to my own experience, most companies selling security tokens for authentication like RSA, Verisign or Aladdin share little information about the internals of their products like algorithms and backend infrastructure. How can I compare those companies and their products to each other? How can I make an educated decision, which product fits my requirements and provides the best security?

share|improve this question
    
When you say tokens are you talking about for multi-factor authentication or are you talking about key management server? Or something else completely? –  M15K Oct 5 '11 at 14:03
    
I am talking about multi-factor authentication. I added a link to Wikipedia to clarify that as well. Thanks for asking! –  Demento Oct 5 '11 at 15:24

3 Answers 3

up vote 5 down vote accepted

How can I compare those companies and their products to each other?

It's quite difficult. You are not going to be able to do a variable to variable comparison. In cases like this I sugges you go for second order effects. Who are their customers and how closely do their authentication needs match yours? How do the companies who offer tokens deal with issues technical and non technical?

How can I make an educated decision, which product fits my requirements and provides the best security?

Depending on how forthcoming their sale team is will to be it may be difficult. Try to understand the risks you are mitigating with multi-factor authentication and the consequences of failure. See of the companies offer insurance in the case of failure and what form that insurance would take. Will they help you detect a breach? What about containment and remediation? Where do they stand on user training? Will they help keep you aprised of relevent threats? If you cant get at the specifics of the technology try to understand the larger benefits and drawbacks. Technology only implements security policy, make sure that their technology will implement the policy you desire.

share|improve this answer

You can compare the properties they do publish, but I agree with you that it's a hard problem. Especially after RSA was hacked last year (http://it.slashdot.org/story/11/03/17/2321226/rsas-servers-hacked) and they said it wouldn't influence the security of their tokens, but when after that Lockheed Martin was hacked (http://www.dailytech.com/Reports+Hackers+Use+Stolen+RSA+Information+to+Hack+Lockheed+Martin/article21757.htm) it turned out that information stolen at the RSA hack had been used to compromise the tokens used by Lockeed.

There are some open implementation of such tokens however, like Yubikey (http://yubico.com/yubikey). You can evaluate more of their implementation, all the software is open source. Moreover, you can build your own authentication infrastructure using their devices.

share|improve this answer

+1 for open-source. https://www.wikidsystems.com/community-edition.

Any solution such as RSA that uses shared secrets has the potential issue that there is more than two copies of the secret. This is why the google authenticator pam plugin doesn't scale well. Each server either needs a separate secret or you share them across servers.

Asymmetric encryption where the keys are generated on the device avoid this reliance on a 3rd party. (Insert 'weakest link' analogy here.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.