Title: Notes on Security
Course: Introduction to SSL/PKI > Section: Information For Teachers

Notes On Security

Security technologies like PKI and SSL do not create security. They can only provide the technology to implement it. Policies and procedures provide secureity. For example, usernames and passwords provide a way to implement security, but if you give everyone your password, there is no security.

What does it mean when you use a username and password? You are declaring you are the indentity username and the proof that "you are who you say you are" is that you know the password.

Note: Usernames and passwords can also be given to processes, systems, etc.

A username is an electronic identity. It is usually tied to person by some kind of vetting process to verify who they are before being issued the identity.

When you perform some kind of self registration it is generally not important who you are in that context. For example, an amazon.com account is tied to a credit card number. They don't really care who you are. For example, you can create multiple amazon.com accounts and use the same credit card number.

A namespace provides a unique identifier for objects within a give context such as a system, directory, etc. For example, phone numbers form a namespace for the phone company.

Usernames form a namespace within a system.

See the "Basic IT Secuity Requirements" for a security infrastructure.