Computer password authentication is a way to protect organizational resources including data from unauthorized access at almost the lowest level i.e. end user level. Every time Users login to their computers they need to enter a password to establish their identity so that unauthorized access to computer could be prevented. However, we are just looking at the positive side of the scenario, on the negative side, it can result in massive productivity loss for the reason that an employee may forgot his password and cannot log into the system resulting in employee downtime.
Taking into picture the scenario that most of the projects require team effort and employees work in collaborative environments, absence of an employee from project arena, for even a little time, could lead to failure in achieving project milestones.
Traditionally, such issues are handled by the organizations’ IT helpdesk team which consumes a significant chunk of their effort and time. The problem becomes even more critical for bigger organizations since they have a large employee base and such issues keep the helpdesk team busy taking up a bigger chunk of helpdesk support hours.
According to various studies conducted to determine the actual extent of time and money that goes into resolving password reset requests, almost 30% to 40% of the helpdesk support hours and tens of dollars per ticket goes into resolving such issues. Of course, these figures may vary depending on the geography and the industry in which your organization is operating.
To address the problem, you can use User self-service password reset facility in Active Directory by enabling Azure Active Directory Premium and Basic. Self-service password reset for users allows end users in your organization to reset their passwords automatically without calling an administrator or helpdesk for support.
There are various others self password resetting tools that allow employees to reset their own forgotten password instead of calling up the helpdesk or logging a password reset issue. This power delegation approach solves the problem to a great extent as Users can now reset their own passwords avoiding downtime and the resulting productivity loss.
As you might have guessed it right, this approach also creates security loopholes which could lead to unauthorized access as someone else may reset the password at the end user’s computer. As a counter measure, these applications ask Users to validate their identity before they can reset their passwords mitigating the risk to a large extent.
Usual method that these AD self-service tools use for identity verification is answering a set of pre-defined questions whose answers only the concerned employee is suppose to know. Users need to answer these questions before they can reset their passwords. These questions are determined by the administrator and employees have to enter the correct answer at the time of registration/enrollment. So, in some way this leads to re-consolidation of power in administrator’s hand. Administrators, on their part, must ensure that they create identity verification questions that meet the compliance requirements and provide enough cushion against security breach. Some of the points that are important to consider here are:
Taking into picture the scenario that most of the projects require team effort and employees work in collaborative environments, absence of an employee from project arena, for even a little time, could lead to failure in achieving project milestones.
Traditionally, such issues are handled by the organizations’ IT helpdesk team which consumes a significant chunk of their effort and time. The problem becomes even more critical for bigger organizations since they have a large employee base and such issues keep the helpdesk team busy taking up a bigger chunk of helpdesk support hours.
According to various studies conducted to determine the actual extent of time and money that goes into resolving password reset requests, almost 30% to 40% of the helpdesk support hours and tens of dollars per ticket goes into resolving such issues. Of course, these figures may vary depending on the geography and the industry in which your organization is operating.
To address the problem, you can use User self-service password reset facility in Active Directory by enabling Azure Active Directory Premium and Basic. Self-service password reset for users allows end users in your organization to reset their passwords automatically without calling an administrator or helpdesk for support.
There are various others self password resetting tools that allow employees to reset their own forgotten password instead of calling up the helpdesk or logging a password reset issue. This power delegation approach solves the problem to a great extent as Users can now reset their own passwords avoiding downtime and the resulting productivity loss.
As you might have guessed it right, this approach also creates security loopholes which could lead to unauthorized access as someone else may reset the password at the end user’s computer. As a counter measure, these applications ask Users to validate their identity before they can reset their passwords mitigating the risk to a large extent.
Usual method that these AD self-service tools use for identity verification is answering a set of pre-defined questions whose answers only the concerned employee is suppose to know. Users need to answer these questions before they can reset their passwords. These questions are determined by the administrator and employees have to enter the correct answer at the time of registration/enrollment. So, in some way this leads to re-consolidation of power in administrator’s hand. Administrators, on their part, must ensure that they create identity verification questions that meet the compliance requirements and provide enough cushion against security breach. Some of the points that are important to consider here are:
- Challenge questions must be difficult to guess. For example, you might not want to include a question such as: What is the color of your car? As this could be answered by co-workers as well.
- Keep the number of questions in the challenge set quite high to minimize the security breach probability.
- Minimum length of answers should be on higher side.
- Disallow same answers to all questions or selecting the answer phrase from the question itself.
- For roaming and disconnected Users, you can provide browser based password resets. In that case, ensure that answer to questions doesn’t get saved in the web page fields.
- You can also use other methods for validating the identity such as sending a verification code on User’s registered mobile number. In that case ensure that all Users keep their updated mobile number in the database.
- Another alternative is sending the password reset link in the User’s email Id.
- For enhanced security, you can use a two-tier verification method where a User has not only to answer challenge questions but also undergo mobile verification.
Active Directory Self Service Password Reset can easily be done using Lepide software. To find out more about this software click on this link. Also, check out this Youtube video to see it, Live in action on how it can be achieved easily using Lepide software.
Comments
Post a Comment