Today I was attempting to convey my needs/requirements for an application that will essentially capture a software release oriented details in an incremental fashion. For eg. what percentage of new features are really requested by customers as enhancements and what percentage of new features are influenced by competitor product or both and the cost of staffing for the same. I had to source data from twenty different managers, from thirty different applications from a very heterogenous background and I needed a simple yet secure way for information to be entered.
I began my design for a good single sign on system. Industry has so many providers, including those SAML specific open source solutions. But what would influence my purchase of a good secure single sign on system?
Will my secure authentication (rather THAT one login and password) work across the legacy systems of accounting, financials, training-competence skills repositories? I understand there are 'connectors' to all these kind of systems based on .NET, Cobol, C, Windows, Mainframe, Visual Basic etc. Will these connectors connect and be the single gateway to get into all these systems? Is security inbuilt into the system which will check for multi-access such as accessing the database via backdoor using SQL script when a robust SSO sits waiting for users to authenticate?
If some of my data sourcing applications are upgraded, will my security gaurd still be able to work without a recheck and a cold failover? If I add a few more data sources, then again can they be 'hot pluggable'?
It is possible that legacy systems were not coded with secure coding practices - for example exposing possible access information as external parameters, URL parameters, hardcoded strings dumped in log files etc. Can my SSO software detect, poll and find out for me? In essence I'm asking not just for a security guard but a CIA advanced agent who will also do security guard duty for me? Too much? Well, there is another popular term for 'you are asking for too much' and that is 'out of the box'.
Has the software been tested with scaled users? How's performance when 500 users login at the same time? I have seen numerous industry specific benchmarks but you rarely get that kind of performance when you deploy it. This is much like an automobile's mileage under 'test' condition!
Finally, do SSO deployments handle authentication such as identity cards with the same robustness as pure login authentication. No, no, forget biometrics for now. I want simple yet fully secure systems.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment