Pocket protectors for your network
Employees at many companies, especially financial institutions and other environments, use multifactor authentication, which requires at least two items—something users have, such as a USB token or smart card, and something they know, perhaps a PIN—to gain access to company resources. The requirement for a combination of two authentication factors means stronger protection for company resources. If the two-factor authentication solution also stores user credential information on the token or smart card or in a software program on the client machine, users gain easier access to resources (e.g., email, company data and devices, Web sites that require logon) and the Help desk benefits by fielding fewer calls about forgotten passwords.
Think of the professional, who on a typical day has to access many Web sites, log onto company applications, and access company data stored in different forms. Or retail businesses that have many employees accessing the company's confidential data (e.g., transaction information and customer data) all day. For these users, plugging in a USB device or inserting a smart card into a reader is easy and convenient, and gets rid of the can't-remember-all-my-passwords blues.
The table that begins on page 34 lists USB memory stick, smart card, and fingerprint two-factor authentication solutions from six vendors. Although the physical form factors for two-factor authentication devices vary, the one thing the items in the table all have in common is that they're small and portable. Let's take a look at the available form factors, what's required to deploy different solutions, and what it takes to manage the devices and the user-credential information.
USB Tokens, Smart Cards, Biometric Readers, and PIN Generators
USB sticks and smart cards can store information such as passwords and digital certificates, and biometric readers store information such as fingerprint-ridge characteristics. Alternatively, a PIN generator simply generates a one-time passcode. Gaining access to company resources by using two-factor authentication usually involves connecting a USB stick to a USB port, inserting a smart card into a reader, touching a fingerprint reader, or possibly entering a PIN or password at a system prompt.
Determining which form factor best suits your users' needs means looking at their situation. If your users are on the road and need to remotely connect to corporate resources from their laptops, the USB stick or PIN generator might be the best solution because these devices don't require a reader. Although PIN generators don't offer the benefit of storing credential information and automatically supplying it when required, they're machine and OS independent and let users log on from a public site such as a coffeehouse. If users will always use a company workstation (either locally or remotely) to connect to resources, then consider smart card or fingerprint authentication; the corresponding reader will be readily available or might even be built in.
Deployment Considerations
To make tokens function properly, you need to focus on several areas: deploying the client software, installing one or more servers to manage user credentials and the authentication process, and initializing and deploying the tokens.
Client software. Most two-factor authentication solutions require that client software (or drivers) be installed on each workstation. The software maintains user information, initializes tokens, and authenticates users who log on remotely. The server-or client-based management software might also be able to read user information from the domain controller (DC) during the setup process so that you don't need to manually enter it. You might want to inquire whether the management software is built on open standards (e.g., X.509, LDAP, ODBC, Remote Authentication Dial-In User Service—RADIUS) or on vendor-proprietary standards that might raise an interoperability issue for your environment.
Authentication servers. Depending on the number of users and how they need to access company resources (locally or remotely), you might need to purchase a server for authentication and token management. Authentication and token management software authenticates users for network logons, Web access, and VPN connections; provisions tokens; and manages user credentials. You might want a second server for redundancy and failover.
Initializing devices. Most tokens need to be initialized on site or by the vendor. Depending on your organization's security policy, you might need to choose a solution that lets you keep initialization information inhouse.
Managing It All
Now that you understand some of the available form factors, possible hardware and software requirements, and some of the steps involved in deploying a solution, you need to consider whether the two-factor authentication solution integrates with company resources and fits into your organization's security architecture or policy. The solution should also be scalable to support additional users or customers. Make sure the solution provides an easy way to maintain user credentials; distribute, initialize, replace, and revoke tokens; and leverage existing user credentials and tokens (if you're upgrading to newer technology or selecting a solution that's different from one that you currently have).
A two-factor authentication system introduces a number of new components into your environment. Additional items to manage are vendor warranties for tokens and their batteries, software licenses and subscriptions, fingerprint and smart card readers, and token battery replacement.
Training users and Help-desk personnel is also a consideration. Read the vendor's documentation to see whether it's comprehensive and will be understandable to users. Ask the vendor what it offers in terms of training to help IT, users, and Help-desk personnel deploy and use the solution and to answer users' questions about forgotten PINs, lost or out-of-sync tokens, and locked accounts.
Token Factors
This Buyer's Guide focuses on two-factor authentication solutions that use USB memory sticks, smart cards, and fingerprints, but you can visit the company Web sites listed in the table for information about additional authentication form factors that the companies supply that might be more suitable for your organization's needs. For example, Entrust offers security grid or "scratch" cards that contain a code that the user enters to authenticate and a knowledge based authentication option in which a user provides a "shared secret" to gain access.