From: Carl-Johan Bostorp (carl-johan.bostorp@hps.se)
Date: Fri Jun 29 2007 - 03:37:44 EDT
> What are the pros and cons for using hardware RSA SecureID/Other and
> software with the same characteristics?
Main argument for using hardware: Security. There's no feasible way for
an attacker to get the seed value. If it's software, then compromised
machine => compromised seed value => attacker can login whenever he/she
choose to.
A con would be that the token can be forgotten or lost, whereas if it's
software then depending on where you have it (PC, cell phone) you'll
always have it available. If the device with the software crashes, you
can always just install it elsewhere and enter the seed value again.
I also believe the price favors the use of software.
Another option to discuss is whether it's perceived as easier by the
end-user with a physical token or a software installation. This might
depend on where the software is installed. If it's a browser toolbar and
you're logging on to a web site, then I guess that's pretty nice. But if
it's installed on a cell phone or PDA, a physical token would probably
be perceived as easier since the numbers are readily available without
any extra steps.
Greets,
CJ
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Swap Out your SPI or Watchfire app sec solution for
Cenzic's robust, accurate risk assessment and management
solution FREE - limited Time Offer
http://www.cenzic.com/wf-spi
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:55 EDT