CA ArcotID OTP Client Installation Guide › Using Advanced Features › Managing External Programs › Security Considerations

Security Considerations

This section lists the security points that you must consider when External Programs are invoked by users through ArcotID OTP Desktop Client installed on their systems:

• Only the pre-defined External Programs on the user’s system can be invoked. The user should not be able to invoke an arbitrary command or program through the ArcotID OTP Desktop Client.
• By default, ArcotID OTP Desktop Client does not permit any External Programs. They must be added to the configuration file before they can be used.
• The ArcotID OTP Desktop Client must invoke the scripts stored in a specific location. It cannot invoke any script file located anywhere on the user’s system.
• The script files must be associated with the list of domains from where the script can be executed. For example, if VPN.BAT script file is associated with the www.acme.com domain, then only the web pages loaded from the www.acme.com domain can invoke the VPN.BAT script.
• Optionally, prompt the user to confirm if they want to run the External Programs.
• (For Microsoft Windows Vista and Later Versions Only) If Internet Explorer is used to run the External Programs, then External Programs will run in Low Integrity mode. Therefore, a broker mechanism is used to enable External Programs to run in normal medium integrity mode.

  See http://msdn.microsoft.com/en-us/library/bb250462%28v=vs.85%29.aspx for more information.