Challenge Response Password Components - Identity Management Question

Jim Dillon Jim.Dillon at
Thu Mar 18 22:35:44 GMT 2004


I'm interested in any of your war stories, "best practice" discoveries or guidelines related to implementing a "Challenge - Response" password management system such as PSynch or Courion's Password Courier if you've recently implemented or plan on implementing such a system soon.  In particular, if you have suffered any bleeding, or reaped any unintended benefits from the deployment of such systems. 

1. How many C/R queries did you choose to require for pswd resets?
2. What unintended consequences or overhead/total cost issues did you encounter?
3. What technical shortcomings did you encounter, with which tool?
4. What key technologies did not integrate well, either middleware or key systems?
5. Would you recommend or caution using this approach towards managing enterprise directory passwords?
6. Any truly insightful whitepapers or other practice guidelines you've encountered?

Thank you in advance for your feedback.  Contact info below.

Best regards,

Jim Dillon, CISA
IT Audit Manager
University of Colorado
jim.dillon at
Phone: 303-492-9734
Dept. Phone: 303-492-9730
Fax: 303-492-9737

More information about the unisog mailing list