These products use a device identifier to address a connection and then apply product-specific authentication and authorization controls. Depending on the deployment, those controls may include a temporary or unattended password, account assignment, user approval, allowlists, multifactor authentication, and managed-device identity. The ID is targeting information rather than proof of access. Review the complete policy, including whether unattended access is enabled and whether any reusable authentication material is weak or exposed. A successful connection operates within the permissions granted by the product and the current operating-system session.
Subtopics#
- ID-based access: separating device addressing from authentication.
- Unattended access: reviewing always-on access controls and reusable authentication material.
- Weak passwords: guessing session and unattended passwords.