Page 133 - CISSO_Prep_ Guide

certain operations and administrative functions that could only
be executed if the operator was physically sitting at that console.
Many other systems and network devices have a similar
connection through an administrative port that would restrict
any changes to the configuration of the device unless the
administrator was connected directly to the administrator port.
This would prohibit any changes from the network and make it
much more difficult for an attacker to manipulate the device
configurations.

Another method of node authentication is through an IP address.
Some systems will restrict a person from logging in unless they
are on a recognized IP address. Some applications are also set to
restrict operations to a certain CPU (central processing unit)
serial number. This prevents a purchaser of an expensive
software solution from running the software on unauthorized
systems. However, this can be a problem with disaster recovery
plans since the software will not operate at an alternate location
unless the supplier/vendor or the software permits it.

User Authentication
The most commonly recognized form of identification is to
identify individual users or processes that are requesting access
to a system or other entity. User identification should be the
creation of a unique value for each user - shared identities
remove the ability to track the activity on the system to anyone
user. This is especially a concern when administrators share
identities and use those shared identities to perform high-level
administrative functions.