RSA Authentication Manager 6.1 Administrator's Guide - The Ether ...

RSA Authentication Manager 6.1 Administrator’s Guide• Tracking the “high water mark.” The high water mark is a record of the last goodpasscode used for the token. The Authentication Manager accepts passcodes thatoccur after the last good passcode. The token record can still store the high watermark (as in previous releases), but you now have the option of leaving this taskentirely to the Lock Manager. To configure your Authentication Manager not torecord the high water mark in the token record, click System > Edit SystemParameters and clear Store time of last login in token records.Detecting a Replay AttackIn a replay attack, an intruder attempts to gain access with a captured passcode bysetting the server system clock back, then reusing the passcode at the appropriatesystem time. The RSA Authentication Manager software warns you of any change insystem time that may indicate a replay attack.When the RSA Authentication Manager software detects that the server system clockhas been set back, it puts the following warning message in the log database:“*** System clock setback detected”. This message can be viewed through DatabaseAdministration application Activity or Exception reports. This message is also addedby default to the Event log and can be tracked and identified with a commercialnetwork management tool.Note: Because this message may indicate a serious security breach, RSA Securityrecommends that it not be removed from the list of message types sent to the Event log.Data EncryptionRSA Authentication Manager 6.1 uses data encryption in several ways to ensure thesecurity of your system:• All messages and data exchanged between the Primary and Replica are encryptedduring transmission—the more sensitive data with the secure RC5 block cipherand the less sensitive data with a DES encryption key that changes every tenminutes.• Communications between any Agent and a Primary or Replica are encryptedusing a unique key (the “node secret”) known only to the specific Agent and to theAuthentication Manager. This prevents an unauthorized machine from passing foran Agent, a Primary, or Replica. For more information, see “Node Secret File” onpage 228.• Communications between separate RSA Authentication Manager systems(realms) are encrypted using a unique “realm secret” known only to the twoAuthentication Managers participating in the exchange. For more informationabout the realm secret, see “Creating and Modifying Realms” on page 85.• Sensitive token data, for example, a user’s PIN, is encrypted so that no one,including system administrators, can view it. Token serial numbers, which are notencrypted, enable administrators to specify tokens for administrative purposes.1: Overview 19