Everything about Self-service Password Reset totally explained
Self-service password reset is defined as any process or technology that allows users who have either forgotten their
password or triggered an intruder lockout to authenticate with an alternate factor, and repair their own problem, without calling the
help desk. It is a common feature in
identity management software and often bundled in the same software package as a
password synchronization capability.
Typically users who have forgotten their password launch a self-service application from an extension to their workstation login prompt, using their own or another user's web browser, or through a telephone call. Users
establish their identity, without using their forgotten or disabled password, by answering a series of personal questions, using a
hardware authentication token, responding to a
password notification e-mail or, less often, by providing a
biometric sample. Users can then either specify a new, unlocked password, or ask that a randomly generated one be provided.
Self-service password reset expedites problem resolution for users "after the fact," and thus reduces help desk call volume. It can also be used to ensure that password problems are only resolved after adequate user authentication, eliminating an important weakness of many help desks:
social engineering attacks, where an intruder calls the help desk, pretends to be the intended victim user, claims that he's forgotten his password, and asks for a new password.
There are many software products available to allow employees to self-reset passwords, from vendors such as
Special Operations Software
,
NetPro,
Ensim and
Quest Software.
Vulnerability
On the other hand, self-service password reset that relies solely on answers to personal questions can introduce new vulnerabilities, since the answers to such questions can often be obtained by social engineering,
phishing techniques or simple research. While users are frequently reminded never to reveal their password, they're less likely to treat as sensitive the answers to many commonly used security questions, such as pet names, place of birth or favorite movie. Much of this information may be publicly available on some users' personal home pages. Other answers can be elicited by someone pretending to conduct an opinion survey or offering a free dating service. Since many organizations have standard ways of determining
login names from real names, an attacker who knows the names of several employees at such an organization can choose one whose security answers are most readily obtained.
This vulnerability isn't strictly due to self-service password reset -- it often exists in the help desk prior to deployment of automation.
Self-service password reset technology is often used to reduce this type of vulnerability, by introducing stronger caller authentication
factors than the human-operated help desk had been using prior to deployment of automation.
Accessibility
A major problem with self-service password reset inside corporations and similar organizations is enabling users to access
the system if they forgot their primary password. Since SSPR systems are typically web-based, a user must launch a web browser
to fix his problem -- but the user can't log into his workstation until the problem is solved. There are various approaches
to addressing this Catch-22, all of which are compromises (for example, desktop software deployment, domain-wide password reset
account, telephone access, visiting a neighbour, continuing to call the help desk, etc.).
Further Information
Get more info on 'Self-service Password Reset'.
|
External Link Exchanges
Do you know how hard it is to get a link from a large encyclopaedia? Well we're different and will prove it. To get a link from us just add the following HTML to your site on a relevant page:
<a href="http://self-service_password_reset.totallyexplained.com">Self-service password reset Totally Explained</a>
Then simply click through this link from your web page. Our crawlers will verify your link, extract the title of your web page and instantly add a link back to it. If you like you can remove the words Totally Explained and embed the link in article text.
As long as your link remains in place, we'll keep our link to you right here. Please play fair - our crawlers are watching. Your site must be closely related to this one's topic. Any kind of spamming, dubious practises or removing the link will result in your link from us being dropped and, potentially, your whole site being banned. |
