Guidelines For Designing Authentication For Web Sites And Servers

By Author: Jasmine
Total Articles: 286
Comment this article

Follow these guidelines when designing authentication for become mcitp Web sites and servers:
Use Windows integrated authentication on the local intranet where there is less risk of credentials being captured and cracked.
Use digest authentication only if all clients are members of the same domain or trusted domain as the IIS server and only if other authentication techniques are not preferred.
Use anonymous authentication when public access is required. No user will need to provide credentials.
Use certificate authentication when highly secure access is required and a mechanism for secure certificate distribution is available. Certificate authentication, when properly designed and managed, has been shown to be less vulnerable to attack than password authentication.
Use SSL to secure basic authentication where basic authentication must be used.
Examples of this are the use of Outlook Web Access for remote mailbox access.Basic authentication passes credentials in clear text. When SSL is used, the credentials and other communications are encrypted.
...
... Use VPNs to protect administrative access and content management access. Using a VPN ensures that the communication is protected and can, if IPSec is used,
ensure that the connection is from an authorized online MCITP certification administrative console.
Use RADIUS for authentication, authorization, and audit of Web site access via VPNs to Web sites. RADIUS can provide centralization of remote access policies
when multiple remote access devices are used. It also provides the ability to protect wireless access, and it provides additional services such as quarantine control.
Restrict access to SMTP virtual servers by requiring authentication for relaying and providing authentication for use of SMTP services. This will prevent the use of SMTP in sending spam. It also ensures that access is limited to authorized connections.
Protect remote basic authentication to FTP sites by using VPNs and LAN basic authentication FTP access using IPSec. Basic authentication free practice questions passes credentials in the clear. Using VPNs and IPSec will encrypt these credentials.