Profiting from SafeNet Authentication Service Offerings

Transcription

1 whitepaper Profiting from SafeNet Authentication Service Offerings A Guide for the Channel With SafeNet, service providers and VARs can deliver profitable and successful cloud services Executive Summary Will the proliferation of cloud computing models help or hurt your service business? Will the cloud reduce your professional services revenues or open up new revenue streams? Now, you can capitalize on the opportunities presented by the cloud, and profit from rather than be the victim of this emerging computing paradigm. This paper shows how service providers can leverage the SafeNet Authentication Service solution, so they can deliver new cloud offerings, strengthen customer relationships, and boost revenues and profits. Introduction: The Opportunity Presented by Cloud-based Authentication Identity and access management (IAM) has never been more important, especially as tablet deployments, bring your own device trends, and virtual desktop solutions make the modern workforce more mobile and more connected than ever. Now, it s vital that enterprise security teams support remote access to company data and applications while at the same time ensuring the security of sensitive assets. In addition to this, enterprises are becoming increasingly collaborative, opening their applications to such third parties as supply chain partners, resellers, and outsourced developers. This introduces the potential for increased risk as organisations and service providers have to extend user authentication beyond their immediate employees. Further, as more services are accessed over the Web, businesses need to manage an increasing number of log in credentials. This credential proliferation increases the risks of compromised passwords, which can lead to identity theft and unauthorised access to corporate networks and data. Quite simply, password protection is no longer secure enough. It is for these reasons that Forrester Research estimates the IAM market will grow to more than 12.3 billion in 2014 up from nearly 2.6 billion in 2006 with provisioning accounting for almost two thirds of all IAM spending. These trends present a huge opportunity for service providers and systems integrators. By adding two-factor authentication to their portfolios, these organizations can gain a competitive advantage, improve customer loyalty, and increase average revenue per user. SafeNet Authentication Service is the first authentication solution to be offered via the cloud. As a result, the solution provides a significant advantage to service providers, who can use its simple portal delivery model to provision large-scale deployments within a matter of hours. 1

2 Making the transition from upfront product sales to annuitybased income should not inhibit the move to professional services it just means you realise revenue differently. Cloud-based authentication services fundamentally change the authentication delivery model eliminating the need to make significant infrastructure changes, add additional hardware or software elements, or make big up-front payments. While this model inherently eliminates some potential revenues for service providers, it also provides significant opportunities. By providing a cloud-based solution, service providers can start generating additional streams of professional services revenue. This document details the key ways service providers can generate revenues when selling the SafeNet Authentication Service. Making Money in the Cloud The opportunity for resellers and systems integrators to generate professional services revenue with traditional products and services is well understood. Since the earliest days of third-party sales of computers and applications, resellers have been able to provide a range of services, including staging, installation, training, tuning, maintenance, support, project management, and capacity planning. The move to cloud computing does not mean the end to these traditional revenue streams for service providers. Rather, the cloud presents an opportunity to deliver new services, both those provided as a one-off service and those delivered on an on-going basis. When service providers offer professional services for cloud solutions, they not only increase their revenue from a sale but also enhance the depth of their relationship with their customers. This positions them to take advantage of new opportunities in the future. Selling on-going managed services does not prohibit the potential to charge up-front consulting fees for such services as helping clients understand areas of risk and potential mitigation strategies. General Integration Consulting As has always been the case, the security of any system is only as good as its weakest point and, for many, that weak link is user authentication. The problem is likely to be exacerbated as more companies are attracted to the cost savings and flexibility of outsourcing and managed service solutions. Many businesses simply don t realise the number of access points that they now have, and this reality opens doors to significant consulting revenues for the service providers that can help them understand the risks and implement an effective solution. When cloud-based services are being used, customer s internal IT departments don t have visibility and control over the security of their applications. In these scenarios, it is increasingly important that service providers can help ensure these applications remain safe and are only accessed by authorised users. SafeNet Authentication Service allows a wide variety of services to be protected at any one time, so that service providers can expand their reach well beyond the traditional confines of remote access and expand into new, increasingly profitable areas, such as on-line service and cloud security services. When it comes to mitigating the risks of password-based access controls, service providers can deliver solutions in four key areas: remote access networks, on-line collaboration portals, virtual desktop environments, and cloud architectures. Following is more information on each area: Remote access. As the workforce becomes more mobile and working practices grow more flexible, remote access becomes more of a threat, which serves to support the argument for stronger user authentication. Thus, service providers are tasked with delivering robust user security, either direct to companies or as a fully integrated application within their cloud-based hosted managed services. Collaboration portals. As they increasingly open their applications to partners, vendors, and customers via Web portals, organisations must extend user authentication beyond just corporate employees. However, existing policies may not be strong enough to protect network borders and security, which is an increasingly essential element of all outsourced managed services. Virtual desktops. Thin-client services have taken big steps forward in recent years and an increasing number of organisations now leverage these technologies to reduce complexity, lower costs, and improve flexibility for users. By storing more data within the infrastructure as opposed to on the device, users have access to their information no matter where they are or what device they are using. However, this also increases the need to mitigate the risk of malicious access or attacks. 2

3 Cloud architectures. Today, all organizations must cut the cost of doing business, but at the same time increase their ability to react quickly to global competitors. This is a key reason why the cloud is becoming an increasingly popular platform for service providers, systems integrators, and customers alike. Separating data from infrastructure and sharing existing server resources across a range of customers are just a couple factors fuelling the rising adoption of cloud computing. The move from having dedicated servers or rack space for each individual customer to the multi-tenant cloud model where several customers applications may be handled by one server means that securing user access is a much more significant issue. With SafeNet Authentication Service, service providers can help their customers strengthen security in these areas, which can create new market opportunities and boost the stickiness of existing customer relationships. Fully Managed or Partially Managed Services At a recent event, industry analysts are reporting that the most common queries from Gartner clients relate to the basic issues of user provisioning and authentication. In fact, provisioning issues accounted for almost a quarter of queries from organisations seeking IAM support. This underscores the opportunity for a service provider to move away from pure product sales and to start embracing the opportunity of wrapping a range of value-added services into each and every sale. These services can be included as part of a sale in one of two ways: The delivery of a fully outsourced service. In order to seize on the opportunities afforded by the cloud, a rapidly increasing number of service providers are adding new services to their core offerings. In this way, a number of optional services are bundled with the primary service being purchased, and the monthly subscription is simply uplifted. This allows the customer to reduce both up-front costs and the number of internal resources required for initial roll out and on-going management. The delivery of a standard service with accompanying professional services. The setup of a cloud authentication service takes just a few minutes, which holds great appeal for many business leaders keen to boost agility and reduce infrastructure costs. In addition, new cloud deployments also offer an opportunity for the service provider to deliver professional services, providing the skills or expertise needed to help customers maximise the effectiveness of the solution. Contract Terms Much is made of the potential to leverage cloud-based services for the delivery of on-demand applications where payments are varied depending on what was consumed during the month or what is in use at the end of the month. However, the reality tends to be very different: very few enterprise executives opt to budget or process invoices for differing monthly amounts, but instead prefer annual, up-front payments. The area to focus on is whether to get customers to commit to 1, 3, 5, or 7 year contracts, with annual payments. Long-standing contracts are ideal for resale models and cloud-based services can be used to lock in customers and underpin business models. Generally, this works far better than traditional, and very lumpy, product sales and maintenance models. 3

4 What Services can be Bundled with SafeNet Authentication Service Within this section, we provide a summary of all the services that can form part of a fully managed service or that can be sold as incremental, value-added services on a professional services charge out. The services featured are generally sold as part of one of the following offerings: A core managed authentication service in which little value is added to the standard SafeNet Authentication Service offering. A managed service in which services are added to create differentiation and value. Generic value-added services that are sold as part of either of the above options. Core services Account setup Setup of the customer account and administrator and allocation of initial tokens to the account Administrator training Webex-based training for selfmanaged customers Token returns (RMAs) Return and replacement process for in-service tokens Second line support Telephone support of the customer administrator Additional managed elements First line support Telephone support of users Initial token provisioning Provision of tokens to all users (excluding logistics of hardware tokens) Additions, moves, and changes On-going management of any change requests Install AuthNodes Telephone support for configuring AuthNodes to allow connection to service Adding AuthNodes Configuring additional AuthNodes to the service LDAP setup Setup of the LDAP Agent with a single domain These are the services that are generally delivered as a standard part of the core systems delivery This is the first step in getting a subscriber account up and running, and involves following the built-in on-boarding process that SafeNet Authentication Service takes a service provider through. Generally, service providers can use standard on-boarding forms to capture the required account information. All administrators and operators of the service should be trained as this will reduce support calls to the service provider service desk and improve customer satisfaction. Training materials are readily available from the SafeNet pre-sales team. In the rare event that a token fails, supporting customers with fault diagnosis and replacements is an essential part of good customer service. SafeNet Authentication Service contains many features that keep this process as simple as possible. As part of each installation, service providers will need to offer support to the customer s administrator. This is backed up by SafeNet s standard support process and service level agreements. SafeNet can provide fault diagnosis workflows, which, when combined with training, can help minimise the overhead normally associated with this process. These services will typically be added to a core managed service or provided as additional purchasable services In addition to second line support, it may be beneficial to offer direct support to service users, either as an optional offering or as part of the standard service. The self-service portal capabilities of SafeNet Authentication Service, along with the fault diagnosis workflows and training SafeNet provides, can help minimise the time and effort normally associated with this process. Once an account is set up, a number of steps will be taken to get a token to the user. In many cases, a manual process will be used either entering users one by one or using the service s bulk import capability. However, service providers can also employ a user directory such as Active Directory or LDAP. This process is described later in this document. Using the administration portal, authorised operators can make on-going changes to the user base, token inventory, and other areas of the service. Many managers are increasingly eager to outsource this continuing effort. The AuthNode is the access device that SafeNet Authentication Service is securing. This AuthNode will need to be pointed to the SafeNet Authentication Service for all RADIUS or SAML authentication requests. Implementation guides and quick help guides are available to assist operators in this effort. SafeNet Authentication Service offers features that enable a service provider to limit the number of AuthNodes that the subscriber gets as part of the service. When customers need to add more devices, the service provider can charge additional fees. This step connects an existing user repository such as an Active Directory, LDAP, or SQL database to enable automated updates of the user store in the SafeNet Authentication Service. This is achieved through the implementation and configuration of an LDAP synchronisation agent on the subscriber site. 4

5 Additional managed elements Policy: token PIN and OTP Assistance in determining optimum security policy and setting up token templates to match these requirements Policy: roles and scope Setting up operator roles and scope to match company security and administrative policy Branding and message customisation Simple changes to customised SMS and/or messages to improve user acceptance. Changing inherit capability. Auto-provisioning rules Determination and setup of auto-provisioning rules and configuration of the LDAP agent and LDAP groups to reflect this Group and container setup Determining optimum setup of any groups or containers in order to match subscriber s management requirements Reporting and alerts: setup and automation Setup of key reports and alerts and automation of their delivery RRA and realms setup Setup and implementation of RADIUS Return Attributes and Realms in order to match subscriber network architecture Migration agent setup Setup of the migration agent within a RADIUS-based authentication server environment SMS gateway setup Setup of customised service SMTP gateway setup Setup of service to permit delivery of messages from the customer s SMTP gateway LDAP setup multiple domains Setup of the LDAP agent within a multi-domain network These services will typically be added to a core managed service or provided as additional purchasable services A major advantage of SafeNet Authentication Service and its tokens is that it enables subscribers to determine, set, and initialise the PIN and OTP lengths and complexities in accordance with security policies. These policies are implemented automatically for SMS and software-based tokens and require an additional step for hardware tokens (see below). With SafeNet Authentication Service, administrators can set various roles for portal operators. The service also allows the scope of those roles to be defined, which can be an important part of a corporate governance policy. Once determined, the operator s roles and scope need to be implemented. A service provider may want to allow a subscriber to customise certain parts of the service interface so that it is more familiar to remote users. This can be achieved in a number of ways, including by simply adding the customer logo to the self-enrolment and self-service portals. In addition, organizations can customize outgoing message strings for s or SMS messages. SafeNet Authentication Service can be set up so that any time a user is added to an LDAP group, that user can go through the self-enrolment feature and have their token automatically provisioned. Tokens can also be automatically revoked when removed or suspended within an LDAP directory. This can naturally save a subscriber many hours of management effort. Assisting with this setup can be a great way to get close to the customer and better understand their business in addition to generating continued professional services revenues. Managing tokens and users can be greatly simplified using some of the group and container capabilities of the SafeNet Authentication Service. Setting this feature up for the customer can be a great value add and can also reduce on-going support and management overhead for both the subscriber and service provider. There are over 35 standard reports within the subscriber s view of SafeNet Authentication Service and a number of proactive alerts many of which can be customised and scheduled for regular delivery. Providing a service for customizing and scheduling reports and alerts can save a subscriber from having to invest resources in learning and configuring the service. SafeNet Authentication Service contains extensive network configuration and integration capabilities that deliver additional layers of security, rapid network alignment, and ease of use. Many of these features are probably best configured and managed by the service provider to optimise their use within the subscriber environment. Not only is this a great value add, but it can generate significant professional services revenues. SafeNet Authentication Service provides a migration agent that makes it simple to migrate from another authentication vendor. The agent can connect to an existing server, AuthNode, and SafeNet Authentication Service and authenticate users, irrespective of the token type. For users of SMS tokens, SafeNet Authentication Service can reduce on-going costs by allowing a subscriber to use their own gateway and to configure their own messages. This can be time consuming and so provides significant value to subscribers. With SafeNet Authentication Service, the provisioning of s to users can be fully customised to the needs of the subscriber environment. This can greatly reduce support calls for both subscriber and service provider alike. Some subscribers may require the setup of multiple domains, which will require multiple steps to be taken. 5

6 Value-added services Proof of concept setup and management Assistance and advice in setting up and running a proof of concept, including recommended success criteria Migration planning Assistance and advice in planning a migration from an existing token estate to the new service Adding VPN link Assistance in setup of a VPN link between AuthNodes and the service Roll out planning and management Assistance and project management support in planning and implementing the service Token initialisation Configuration of hardware token policy and initialisation of tokens to match. Includes shipping to a single point. Hardware token distribution, per user Packaging and dispatching using postal service or courier These services are typically added as professional services items in addition to the above managed services elements Not only is running a trial or proof of concept an essential step for many subscribers, but it is also a great tool to use in the sales process. SafeNet s experience shows that the win rate of a project increases significantly if the prospect tests the service directly. Most service providers offer this for free, but charge for any on-site work that needs to be done (for example, if the subscriber can t re-configure their own access devices). Planning the migration from one supplier to another involves more than just setting up the migration agent. Many different aspects will contribute to a successful project and rapid user acceptance including addressing logistics requirements for hardware tokens, user s or messages, training, and expiring token replacement. Some subscribers require additional levels of security for the link between the SafeNet Authentication Service and the AuthNodes. This can be achieved through the implementation of a VPN link. Since this requires additional resources to be allocated, there is an additional charge on the SafeNet Authentication Service price list for this. Many large projects require planning, from setup through to training and documentation. Subscribers are increasingly outsourcing these tasks to service providers as a way of reducing the need to retain specialist resources. With SafeNet Authentication Service, subscribers can define hardware configurations, and then re-initialise tokens to reflect those new parameters. This requires the purchase of a hardware token initialiser, which is listed on the SafeNet Authentication Service price list. For many subscribers, the logistics associated with managing an estate of hardware tokens can be a major headache. Some service providers are happy to take on this effort, both for initial and on-going requirements. Conclusion This document has described areas in which service providers and VARs can use cloud services to change business models and improve cash flow. However, this requires a cultural change because consultancy fees and professional services charges may need to be altered to accommodate the customer s needs. By wrapping services into a core product offering, service providers can employ a kind of Trojan horse approach to increasing average revenues per user. Further, long-term contractual commitments can underpin, if not fuel, the growth of a serviceoriented business. About SafeNet, Inc. Founded in 1983, SafeNet, Inc. is one of the largest information security companies in the world, and is trusted to protect the most sensitive data for market-leading organizations around the globe. SafeNet s data-centric approach focuses on the protection of high value information throughout its lifecycle, from the data center to the cloud. More than 25,000 customers across commercial enterprises and government agencies trust SafeNet to protect and control access to sensitive data, manage risk, ensure compliance, and secure virtual and cloud environments. Contact Us: For all office locations and contact information, please visit Follow Us: SafeNet, Inc. All rights reserved. SafeNet and SafeNet logo are registered trademarks of SafeNet. All other product names are trademarks of their respective owners. WP (EN) A