Inside Activate
Anywhere
Security Features
7 min
the following section outlines the security features and implementation considerations when deploying this component general site security the activate anywhere web site connects to a web service on the activate web server this is the same web service that the activate windows security plugin uses the web service is installed but disabled by default when an activate server is installed configuration level security the web service runs in anonymous access mode within iis and must be manually enabled before use transport level security all communication between the activate anywhere server and the web service is encrypted using a 256 bit aes protocol a default 256 bit key is built into the activate anywhere site and web service; however, a custom encryption key can be configured if required logical protocol security a unique session key is generated for each transaction and must be used for all subsequent calls to the web service for that transaction this prevents spoofing of in progress transactions user password answers are never transferred to the client external links links to the activate anywhere web site for password reset are often placed on other publicly available portals such as outlook web access (owa) , citrix , or vpn access sites captcha authentication the activate anywhere web site uses an industry standard captcha mechanism on the first page to prevent automated attacks and confirm that the user is human this protects against automated hacking and abuse the captcha can be configured to use either an alphanumeric challenge , or a numeric calculation (e g , “what is 5 + 7?”) single use pins the system can also be configured to require a single use pin when a user resets their password this provides three level authentication for password reset or account unlock the pin can be delivered to an external email address, or the user’s mobile phone via sms password reset attempts and locking when users attempt to reset their passwords, three levels of locking are applied 1\ ip address locking the system tracks reset attempts from each source ip address and blocks that ip after a defined number of failed attempts default limit 10 attempts default block duration 60 minutes ensure that the external ip address is passed correctly to iis, or the proxy server is configured to include the original ip in the x forwarded for header 2\ account locking after a defined number of failed attempts to answer the password security questions, the account is locked from external reset within activate users may still reset their account through other means or contact the service desk default limit 3 attempts default block duration 60 minutes 3\ account authentication when setting up the password reset web site for the first time, repeated failed authentication attempts will result in a temporary lock default limit 5 attempts default block duration 60 minutes