Kenneth C. Laudon,Jane P. Laudon Management Information System 12th Edition pdf

Authentication

refers to the ability to know that a person is who he or she

---

Chapter 8

Securing Information Systems 

313

claims to be. Authentication is often established by using 

passwords

known

only to authorized users. An end user uses a password to log on to a computer

system and may also use passwords for accessing specific systems and files.

However, users often forget passwords, share them, or choose poor passwords

that are easy to guess, which compromises security. Password systems that are

too rigorous hinder employee productivity. When employees must change

complex passwords frequently, they often take shortcuts, such as choosing

passwords that are easy to guess or writing down their passwords at their work-

stations in plain view. Passwords can also be “sniffed” if transmitted over a net-

work or stolen through social engineering.

New authentication technologies, such as tokens, smart cards, and biomet-

ric authentication, overcome some of these problems. A 

token

is a physical

device, similar to an identification card, that is designed to prove the identity

of a single user. Tokens are small gadgets that typically fit on key rings and

display passcodes that change frequently. A 

smart card

is a device about the

size of a credit card that contains a chip formatted with access permission and

other data. (Smart cards are also used in electronic payment systems.) 

A reader device interprets the data on the smart card and allows or denies

access.