User's Manual

Privaris plusID Manager Operators Manual V1.0
Page 4 of 54 07.20.07
6. Securing plusID Devices
a. The Administrator PIN & Device Registration
plusID devices are secured to a specific organization through the assignment of
an Administrator PIN. It is what prevents the manipulation of issued plusID
devices by outside organizations and malicious or otherwise non-authorized
parties.
The Administrator PIN is assigned to the device during registration (when the
device is connected to the plusID Manager application for the first time) and is
securely stored on the device.
Each issuing organization must select an Administrator PIN (Personal
Identification Number) that will be used by Enrollment Administrators to enroll
and update all plusID devices. This PIN should be treated as a corporate secret
and guarded in the same manner as other keys/passwords that grant access to
valuable resources. It is recommended that the Administrator PIN only be
accessible by officers of the company and designated Enrollment
Administrators/Security Personnel.
! There is no way to reset the Administrator PIN that is installed on devices during
device registration. If the Administrator PIN is lost or forgotten you will not be
able to access or modify any previously issued devices
.
! It is highly recommended that each organization select a single Administrator
PIN for all plusID devices. Creation of more than one PIN will result in a
population of devices having different PINs and there is no way to determine
what PIN is on a device other than by trial and error (with a limited number of
attempts).
! If the Administrator PIN were ever to be compromised, issued devices would be
susceptible to manipulation by outside organizations, and the security of
corporate physical and logical assets would be placed at risk.
b. Single Administrative Authority
Each device can have only one administrative authority. For security purposes,
once issued, the device can only be modified or updated using the same
computer on which it was originally registered. A registered device cannot be
updated on any another computer running the plusID Manager software (even
within the same organization).
!
The plusID Manager software is not intended to be installed on more than one
computer/workstation per organization.
If trying to connect a previously issued device registered by another computer, a
Security Advisory will appear (Figure 1). The only menu options available will be
“Device Status” and “Settings,” in order to prohibit fingerprint templates from
being added or removed.