Digipass Plug-In for IAS Product Guide - Vasco

Digipass Plug-In for IAS Product Guide Digipass
2.5.1.1 Self-Assignment
A Digipass may be assigned to a User by their own action. The User must log in and include
the serial number, Windows static password and One Time Password. This informs the IAS
Plug-In of the assignment, and provided that the User enters the details correctly, a link will be
made between the Digipass record and the User account. A grace period is not used for this
method.
2.5.1.2 Auto-Assignment
The IAS Plug-In can automatically assign an available Digipass when a Digipass User account
is created using Dynamic User Registration (DUR). The correct Digipass must then be
delivered to the User. A grace period is typically set, which allows a number of days in which
the User may still log in using only their static password.
2.5.1.3 Manual Assignment
A selected Digipass is manually assigned to a specific Digipass User account. The Digipass
must then be sent out to the User. A grace period is typically set, during which the User may
still log in using only their static password.
2.6 Security Levels
The following will affect the security level of your setup for the IAS Plug-In:
Using the Windows Static Password instead of a Server PIN
You can configure the authentication process so that a User is required to use their Windows
static password in place of a Server PIN when logging on through a remote access server. This
is a valid two-factor authentication combination, but it is important to consider the security of
the machines from which the User will log in. If there is a risk of key logging for example, it
would still not be possible for the hacker to log in, but they would have captured the Windows
static password of the User. If a PIN was used, they would only have captured the PIN.
This has to be balanced against the need for a User to learn and remember an additional item,
the Server PIN.
© 2005 VASCO Data Security Inc. 38