Authentication

Security Standard: Account Management

Security Standard: Account Management

Scope

This standard applies to all RIT Information and Information Resources.  

 

Requirements for All Accounts

The following security controls are required to be implemented on all accounts:

1.      Account Authentication

1.1.   End user account authentication should use the enterprise identity and access management service when the system or application processes Private, Confidential, or Critical Process information. 

1.2.   The use of the enterprise authentication service by an application should be authorized by the Authentication Service Provider and the security reviewed... ...

Account Management Standard

Account Management Standard

The Account Management Standard provides requirements around creating and maintaining user and special accounts. The primary audience for the standard is account administrators. However, there are reporting requirements pertaining to personnel and roles and responsibility changes for managers as well.

Documented Standard

Current Account Management Standard (reflects 2015 operational changes, comply by 1/23/15)
  • ... ...

Multi-Factor Authentication

Enabling multi-factor authentication is one of the best things you can do to make sure your account information is not compromised.  Passwords alone will not always protect you, but using two or more steps to verify you are the account holder will help keep your accounts secure.

Common actions that lead to your password being stolen are:

  • Using the same password on multiple websites.
  • Downloading software from the Internet without verifying its legitimacy.
  • Clicking on links in phishing email messages.

The following is an example of multi-factor authentication on Google.

... ...

Using LinkedIn’s New Two-Factor Authentication

Using LinkedIn’s New Two-Factor Authentication

The growing trend in sites adding two-factor authentication to their log in process has many feeling more secure in their social media and other online interactions.

With passwords being easy to compromise with phishing attacks, many users have been hoping for something more secure.  Two-factor authentication gives a double protection on your account, requiring you to know something (your password), and have something in your... ...

Authentication Service Provider Standard (Retired)

Authentication Service Provider Standard (Retired)

The Authentication Service Provider Standard contains requirements for administrators, especially those using the RIT centralized authentication system.

Important

The Authentication Service Provider Standard was retired on January 23, 2015.

Effective January 23, 2015, the Account Management Standard superseded the Authentication Service Provider Standard.... ...