2 ms·

So after the user securely logs on the virus can transact with the site using properly authenticated credentials? Unfortunately, this is a very prevalent featur

• Spearchucker 15y ago
  Authentication is just an assertion of identity. End point security is an obvious consideration. There's also authorisation and perimeter protection. Defence in depth. Layer security like the layers in an onion. That said, economics dictates that you wouldn't spend $20 protecting a $10 asset.
  • marshray 15y ago
    Authentication in general is the process of proving that something is 'true' or 'genuine', in this case an assertion of identity. You say endpoint security is obvious, and I usually agree with you. But I can't count the number of times I've had to retrace this methodically with when talking about systems with very smart people. The distinction between authentication and authorization too. Like you're saying, classical risk management says the $10 asset isn't worth $20 of security. Sony learned the fallacy of that reasoning the hard way. If you have a database of 100K usernames, passwords, and email addresses of folks who entered a contest to win free movie tickets, you might not value that asset particularly highly. But if you don't secure, it properly could cost you $M to clean up later. Personal information doesn't always behave like an typical 'asset'. Sometimes it's more like having a surplus of toxic waste. Shoot, I could talk about this stuff all day. :-)