Selecting an Access Control Shell

Access control shells may be implemented in software or as hybrid packages with both hardware and software components. If encryption modules are required, they can be designed as software or hardware. The following questions should be considered when selecting an access control shell:

• What type of access control mechanism does the shell provide and does it fit your security policy?
• If encryption is employed, what is the strength of the algorithms used? In general, publicly scrutinized algorithms are to be preferable to secret, proprietary algorithms where you are depending on the secrecy of the algorithm, rather than secrecy of the key.
• How strong are the identification and authentication mechanisms? [] provides basic criteria for analyzing the strength of these mechanisms.
• Are the passwords themselves adequately protected? Passwords should never be stored in cleartext.