Identification and Authentication: Technology and Implementation Issues

Abstract

Computer-based information systems in general, and Internet e-commerce and e-business systems in particular, employ many types of resources that need to be protected against access by unauthorized users. Three main components of access control are used in most information systems: identification, authentication, and authorization. In this paper we focus on authentication, which is the most problematic component. The three main approaches to user authentication are: knowledge-based, possession-based, and biometric-based. We review and compare the various authentication mechanisms of these approaches and the technology and implementation issues they involve. Our conclusion is that there is no silver bullet solution to user authentication problems. Authentication practices need improvement. Further research should lead to a better understanding of user behavior and the applied psychology aspects of computer security.

Current State of Information Security Research In IS

“…Bento and Bento [2006] empirically tested a hacking model based on attacks and hacker behavior. Zviran and Erlich [2006] compared a variety of authentication mechanisms and discussed the problems associated with each of them. Beebe and Clark [2007] created a discriminant model for predicting hacker behavior.…”

The effect of computer self-efficacy on security training effectiveness

“…This led to an evaluation that determined which of the above tasks was actually the utilization of security tools. Usage of these tools was studied in previous research [1,9,20,24] allowing comparisons to prior work, and are the necessary tools needed to protect computers from the cyber-crimes that are currently the most costly [6,10]. People often do not use the tools presented in Table 1, and leave their computers vulnerable to intruders [11].…”

An Extended Perspective on Individual Security Behaviors

“…onto individuals' computers is by taking advantage of social networking sites. (Zviran and Erlich 2006;Zviran and Haga 1999) Operation System and Programmatic Security Features (Furnell et al 2006) Privacy Protection Tools (Furnell et al 2007) Protective Technologies (Dinev and Hu 2007) Vulnerability Management (Al-Ayed et al 2005) Wireless Security Management (Woon et al 2005) For example, a Facebook.com user could share a link to a YouTube video with a number of friends, a video that may require the user to download an "update" to view it. In downloading the "update", the user is in fact downloading malware that infects the computer being used with a bot, making it part of a larger botnet (Ahamad et al 2008).…”