Customer Reviews

User Authentication Principles, Theory and Practice (Architecture First)

5 star:		(1)
4 star:		(1)
3 star:		(0)
2 star:		(0)
1 star:		(0)

 

 

A great book on authentication! The book will educate you on more aspects of authentication than you ever thought were possible. As a security professional, I found the author's writing style to be thorough and even entertaining, a clear sign of writing by a true expert on the subject. Passwords, tokens, biometrics and various authentication protocols are all described and analyzed in great detail, in plain English and with multiple diagrams.

A chapter on passwords contains several creative ideas to make this ubiquitous form of authentication more effective, more secure and more usable. It also answers some interesting password questions such as When does it make no sense to enforce a complex non-dictionary password? How random is a random password from a dictionary? Why is a bank PIN of four digits secure enough for the job? When it is better to write a password down? Read the book and you will discover the answers!

Apelbaum's clear explanations of authentication methods and their underlying technologies as well as how they evolved are clear and easy to understand. The author goes beyond explaining the mathematics behind the protocols by also showing how assumptions can lead to exposures. Apelbaum provides many excellent examples for security misconceptions. His treatment of the people side of authentication techniques adds to his real-world approach. Each chapter is filled with facts that you may not have considered and is backed up with mathematical or technical underpinnings. The book completely covers authentication and will get anyone quickly up-to-speed on the basics and many of the finer points of the subject. This book is especially important as a resource to anyone who is involved in financial systems because the material is directly applicable to requirements set forth in PCI and FFIEC. Essential reading for anyone who develops or manages security in a web- or e-commerce environment because of the dependencies upon the technologies and methods that are discussed. IT security specialists will also find this book to be an invaluable resource, especially the parts that cover password management, social engineering and practical applications of authentication.