 Re: Merits and Demerits of Checkpoint Authentication Methods
While I agree that using certificates is a more secure method of authentication, they are also more difficult to manage in a large environment. I migrated a previous company from certificates to Active Directory because of this. Internal users would leave, often in offices that had little centralized process for terminations. Clients or business partners needed VPN access to specific applications in scenarios that did not fit in to a site-site VPN. Because AD was already a part of the termination process, we felt there was better control of access to internal and DMZ resources. We were also able to hand over user management from the firewall/networking team to regional resources without giving them access to the firewall management system. Lastly, password management was better. Our Password policy in AD was already 90 days. With certificates we had no way to force users to change their passwords on a regular basis, another security risk.
If I had my choice I would have preferred to use RSA SecurID, but the cost was prohibitively expensive. I feel that in this case, putting controls around a less secure authentication method was more secure than using certificates.
lodown  |