Digipass Plug-In for IAS Product Guide - Vasco

Digipass Plug-In for IAS Product Guide Digipass
Some Possible Guidelines
Guideline Pro Con
Backup Virtual Digipass disabled for all - enabled
for individual Users as required.
Backup Virtual Digipass enabled for all - either
time/number of usage limit set.
Backup Virtual Digipass enabled for all - no limits
set.
Table 5: Backup Virtual Digipass Example Guidelines
Low text message costs Manual enable for each User
and circumstance. Possible
heavy administration load.
Predictable text message
costs
2.7.7 Resetting Virtual Digipass Restrictions
Administrator may need to reset
limits frequently – medium
administration load.
Lighter administration load Possible high text message
costs.
When a User has reached their limit of Virtual Digipass use, an administrator must reset their
limit.
2.7.8 Virtual Digipass Login options
A decision must be made as to how Users will log in using Virtual Digipass. In particular, Users
with a hardware Digipass and the Backup Virtual Digipass enabled must be able to request an
OTP to be sent to their mobile when required, but to login using the hardware Digipass at
other times.
The simplest method for the User is to allow a 2-step login process, where the User enters
their User ID and static password only, triggering an OTP Request, and are redirected to a
second login page to enter the OTP sent to them. To use this method, though, your system
must be set up to allow 2-step logins. Check with your system administrator if unsure.
Alternatives to the 2-step login are a sequence of two 1-step logins or the use of the OTP
Request Site.
See the Administrator Reference for information on possible login permutation.
2.7.9 Location of OTP Request Site
If the OTP Request Site is to be used, its location must be decided. You may choose to install
the Web Site onto any web server, bearing the following in mind:
If the Web Site is installed onto a web server in the DMZ, you need to permit TCP/IP
access from the web server to the IAS Plug-In on port 20003. This is the recommended
option.
The Web Site can be used on the Internet, however it would be essential to provide SSL
(or TLS) encryption for access to it. Otherwise, an attacker could discover static
passwords and PINs. The other point to take into consideration is that publishing the
Web Site on the Internet would allow anyone in the world to send requests to the IAS
Plug-In – this would provide the potential for denial of service and brute force attacks. It
would be strongly advised to protect the Web Site from general use in some way.
If the Web Site is installed onto a web server that communicates over a WAN link to the
IAS Server(s), the WAN link must be encrypted. For example, an IPSEC-based VPN
connection would be sufficient.
© 2005 VASCO Data Security Inc. 41