Symantec™ Security Gateways Reference Guide - Sawmill

84 Controlling user accessAuthenticationDefender solves the password problem by providing two-factor authentication that uniquely authenticatesusers without forcing them to remember another password. Defender is an industry standard, and uses achallenge/response mechanism to create a one-time password that is far more secure than staticpasswords. For an attacker to correctly compute the response for a challenge, they need not only the user’sPIN, but also the unique client software. Without both pieces, potential intruders cannot calculate therequired response. Even if the response is viewed when entered, it serves no purpose, as the response isonly valid for that session.Defender also supports a synchronous password method similar to RSA SecurID. When the token issynchronized with the Defender Security Server (DSS), an internal clock generates an unpredictable stringthat changes every minute. The DSS also uses an event counter and increments this counter each time anew challenge is generated. This event counter is used in conjunction with the unpredictable string, a userspecificsecret key, and an encryption algorithm to generate the challenge to be issued. Because the eventcounter always rolls forward, the one-time password is truly only valid one time, and not susceptible toreplay attacks like some other time-based synchronous password methods are.Note: Defender supports static passwords, but you should not use them. One of the strengths of theDefender authentication method is its single-use passwords.How Defender authentication worksDefender, a strong authentication system, is commonly used as extended authentication for VPNconnections. Defender authentication uses the following components:Defender Security Server (DSS)Maintains a database of Defender users and their information pertinent to theirtoken. Requests are compared against information contained in the DSS userrecord.Defender Management Console (DMC) Used by the administrator to create and synchronize new tokens, or updateexisting user information.TokenTakes the form of either a client disk, a hand-held token, or SmartCard. Eachtoken is unique.Personal Identification Number (PIN)Normally known only to the user, and must be entered each time the token isused for authentication.