Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

We have a system (e.g. purchasing) where there are multiple access points. One is a back-end desktop application only accessible by employees within the LAN, the other is an Internet accessible Web Application by a subset of employees as well as customers. Both require authenticating with a Username and password.

The Web Application requires a stricter password policy than the back-end application, however we want to allow the Employees to access both with at least the same Username (at the moment they log in as a different user).

Should we be requiring the employees to use different password when logging in via the Web Application? Or should we use the same password but require the stricter password policy for the subset of employees for the back-end application as well?

share|improve this question

3 Answers

up vote 2 down vote accepted

Why do you have a password policy in the first place ? It is to avoid passwords which are "too weak" (in the sense of: "too easily guessed"). Do weak passwords suddenly cease to matter on the Web site just because the very same username+password also provides access to the back-end application ?

If the password policy on the Web site is to make any sense at all, then it must apply to all passwords which work on the Web site.

On the other hand, a stricter policy for the back-end than for the Web site may make sense: passwords which grant access to both are, technically, "more powerful" passwords, so it is conceivable that they should be "stronger". But that's a hand-waving argument.

My advice is the following: if the Web application and the back-end application grant access to the same data, then the password policies should be identical for both. I.e., enforce the stricter rules everywhere. If you can force customers to follow these rules, then surely you can do the same with employees ?

share|improve this answer
To answer your question - Because of potential business requirements. The Customer of the system (employees) require a particular password policy. However one or more of their customers require that they use a more stringent password policy when authenticating via the Internet. – Nick Brooks Oct 13 '11 at 1:27
What about different passwords? We could have the same password policy but still require two distinct passwords. Is that a recommended approach as we've seen Lotus Notes for example have that functionality (one password for Internet access, one password for back-office access). – Nick Brooks Oct 13 '11 at 1:34
@NickBrooks - If the web application requires a stronger password make that the overall password policy. – Ramhound Oct 13 '11 at 11:28
up vote 1 down vote

Perhaps you need two factor authentication in scenarios that require stronger validation in 'risky' scenarios such as VPN and web.

RSA, Arcot and Symantec are a few that come to mind that offer dual factor

share|improve this answer
up vote 0 down vote

Are you using one authentication system? Or do you have to create accounts on each system for users?

If you have one authentication system, then require everyone to sign up from the web application (strict policy) and turn off the password setup/change functionality on the back end. The password policy is enforced at create/change time, so there should be ONE place their passwords are created and changed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.