Recently I have got a question about providing "silent login" to the business application using "generic" user account. Here is my opinion.
What this company is going to do would be called disabling "user authentication” and providing “anonymous access” in security jargon. User authentication (as part of the access control) can provide three functions: Identification, Authorization, and Accountability. In real life these functions are usually mixed together.
Examples:
Identification – Google Start Page (http://www.google.com/ig) wants you to log in - so they will be able to identify you in order to customize your start page (and of course to be able to shoot customized ads). It has nothing to do with your or their security – this is pure business feature.
Authorization – Windows wants you to log in - to make sure you are the owner (or authorized user) of your computer. This is pure security feature.
Accountability – Point of Sale application prompts the cashier to log in – in order to link his/her name to each transaction and make him/her responsible (or accountable) for POS transactions (to balance the cash at the end of shift, for performance reports, complaints, fraud protection etc.). This is both security and business feature.
If they think that no one of the functions above is required for their business, then they can eliminate the access control and allow anonymous access. There are many applications without access control (for example, Windows calculator). I would not make this “feature” as a part of the generic functionality provided by the application though - because most customers still want their employees to be identified, authorized, and accountable, and this “feature” may become a security “back door” for them.
I think Integrated Windows Authentication would be suitable option for them - it is common security practice which provides both “silent login” and access control features at the same time (example – SQL Server Integrated Windows Authentication). However, it is important to make sure they don’t confuse the Integrated Authentication with completely eliminated authentication (“anonymous access”). If they just remove user authentication completely, Windows logon will not protect the application because ANYONE who installs the application client (or anyone who knows the URL in case of web app) can anonymously access this application.
What this company is going to do would be called disabling "user authentication” and providing “anonymous access” in security jargon. User authentication (as part of the access control) can provide three functions: Identification, Authorization, and Accountability. In real life these functions are usually mixed together.
Examples:
Identification – Google Start Page (http://www.google.com/ig) wants you to log in - so they will be able to identify you in order to customize your start page (and of course to be able to shoot customized ads). It has nothing to do with your or their security – this is pure business feature.
Authorization – Windows wants you to log in - to make sure you are the owner (or authorized user) of your computer. This is pure security feature.
Accountability – Point of Sale application prompts the cashier to log in – in order to link his/her name to each transaction and make him/her responsible (or accountable) for POS transactions (to balance the cash at the end of shift, for performance reports, complaints, fraud protection etc.). This is both security and business feature.
If they think that no one of the functions above is required for their business, then they can eliminate the access control and allow anonymous access. There are many applications without access control (for example, Windows calculator). I would not make this “feature” as a part of the generic functionality provided by the application though - because most customers still want their employees to be identified, authorized, and accountable, and this “feature” may become a security “back door” for them.
I think Integrated Windows Authentication would be suitable option for them - it is common security practice which provides both “silent login” and access control features at the same time (example – SQL Server Integrated Windows Authentication). However, it is important to make sure they don’t confuse the Integrated Authentication with completely eliminated authentication (“anonymous access”). If they just remove user authentication completely, Windows logon will not protect the application because ANYONE who installs the application client (or anyone who knows the URL in case of web app) can anonymously access this application.
RSS Feed
