Re: Navigator for i

[Tim Bronski <tim.bronski@xxxxxxxxx>]

Well, TFA for initial network access is a common requirement but not all 
access to applications and data across the network is of the same 
sensitivity and not all access is made with the same credentials. 
Re-verifying identity for access to more sensitive functions and with 
tighter timeouts helps overcome some of the disadvantages of SSO and 
cached credentials (pc on but no one at the desk for one). Another case 
is the use of shared profiles where, for example, 2 people have the 
password for QSECOFR (I'm not advocating for this but it's not uncommon) 
but you want to audit who actually was using this profile, TFA can 
identify and log the user behind the approving device.

On 7/20/2020 5:55 PM, Michael Quigley - Sec wrote:
> This brings up an interesting point. Console access for PCI (and other) compliance reasons generally dictate two-factor authentication. But I've always viewed that as required to get onto the network from where the access is made. If someone is local to the system, I figure they have their password and then they have themselves (being physically present. Am I taking too simplistic of a take on TFA for Navigator?
>
> Michael Quigley
> Computer Services
> The Way international
> www.TheWay.org
>
> > -----Original Message-----
> > From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf
> > Of Tim Bronski
> > Sent: Monday, July 20, 2020 8:37 AM
> > To: Midrange Systems Technical Discussion <midrange-
> > l@xxxxxxxxxxxxxxxxxx>
> > Subject: Navigator for i
> >
> > I'm trying to figure out if it's possible to extend/customize the "Navigator
> > for i" logon dialog. I'm trying to add a TFA component. Maybe this is a
> > question for someone like Tim Rowe? Any suggested starting points? I've
> > been all over google.
> >
> > Tim