<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Login</title>
<script type="text/javascript" src="https://vipuserservices.verisign.com/vipuserservices/static/v_1_0/scripts/iadfp.js"></script>
</head>
A good client side developer might make the SOAP call into VIP User Services might make the web service call here. I used a server-side intermediary to make the web service call, so I posted the fingerprint data as part of the form:
<input type="submit" onclick="document.getElementById('deviceFingerprint').value=IaDfp.readFingerprint();return true;" value="Sign-In" />
I'll cover what I did with the return values, feeding them into Symantec O3 in Part III. Let's go over the management side here in the meantime. VIP Intelligent Auth is managed from the same VIP console used for the one-time-pin (OTP) and credential management.
Although Symantec doesn't feature the most knobs and dials of risk vendors, one could argue that the simplicity of the black-box system is sufficient for most risk administrators. A simple slider to determine the threshold of risk before the request is deemed "risky".
You can also manage whitelist and blacklist IP addresses:
As well as countries on your bad-boy list:
And that's about it. Symantec keeps most of its risk algorithms black boxed. Some testing will help you to understand the typical values for risk score (0-100) and how you can factor that into your authorization policies.
No comments:
Post a Comment