Usher 2.1 Beta Frequently Asked Questions (FAQ)

Transcription

1 Usher 2.1 Beta Frequently Asked Questions (FAQ) For more information, visit Usher.com

2 Questions and Answers Q: What is Usher? A: Usher is a mobile identity platform that is 10x more secure than tokens and 100x more secure than passwords. Usher replaces traditional forms of Enterprise identity such as IDs, passwords, and tokens, with mobile identity badges on a smartphone. With Usher, you can securely access applications and workstations, ensure identity integrity, fortify entryways, and monitor and manage every identity activity. Usher makes authentication very convenient for users, more manageable for administrators, and highly secure for the Enterprise. Usher will accelerate the cyber security strategy of Enterprise users by providing password-less login, peer-to-peer ID verification, mobile digital keys, and webbased network management and reporting capabilities. Q: Why does MicroStrategy have Usher? A: Usher is founded on two disruptive technologies mobile software and cloud deployment. MicroStrategy was a visionary in bringing these technologies to the BI market through its industry leading Analytics Platform, and following the company s success, CEO Michael Saylor identified opportunities to extend these capabilities to new markets. Cybersecurity represents possibly the most important mission critical concern facing every enterprise, institution, or organization on the planet, and Usher provides a cyber identity solution. The Usher solution is not only designed to deliver both security and seamless operation, but also it leverages the Analytics Platform to deliver unique and powerful intelligence insights regarding all identity activities, rendering Usher a category killer.. Q: What features does Usher 2.1 Beta offer? A: Usher 2.1 Beta features a cloud-based, self-service deployment model using a convenient web portal, enabling an administrator to create an identity network in a few simple steps: 1. Design mobile identity badges 2. Set up a user population by synchronizing with IDM systems or cloud apps 3. Distribute badges Once distributed and configured, Usher badges can be used for password-less authentication to SAML-based cloud and web apps, Windows and Mac workstations, and physical access systems. Usher badges also permit peer-to-peer identity verification, and the Usher 2.1 Beta delivers powerful identity analytics and ongoing network management support for a comprehensive offering. Q: What specific versions/configurations of target applications and systems are supported with Usher 2.1 Beta? A: Usher 2.1 Beta includes the following: Directory Gateways: Synchronize Usher with user ID stores via secure VPN Tunnel. Active Directory v3 (accessible through LDAP protocol version 2 or 3) OpenLDAP v3

3 Logical Gateways: Configure Usher with cloud, web, and mobile applications; workstations, and Single Sign- On (SSO) systems to eliminate passwords. SAML Configuration/Web SSO Salesforce.com Google Apps Microsoft Sharepoint - Requires an Active Directory Federation Services server, with an SSL certificate signed by a third party Exchange/OWA - Requires an Active Directory Federation Services server, with an SSL certificate signed by a third party WordPress Mobile Web SSO Mobile App SSO Mac Unlock using Bluetooth - OS X Bluetooth Low Energy Requires previously established Active Directory Gateway Login for Windows 7, 8, Requires previously established Active Directory Gateway Physical Gateways: Configure Physical Access Control Systems (PACS) to eliminate physical keys and cards. Lenel OnGuard v Paxton Server v4.28 or later - These require an Adapter that is a Windows-based web service that communicates with the PACS server using DataConduit - Lenel and Paxton Adapter requirements: Windows Server 2008 R2 operating system (64-bit) or later Microsoft Internet Information Services version 7.0 or later Microsoft.NET Framework version 4.0 (64-bit) or later MySQL 5.5 database, with 64-bit DSN system pointing to it, to log adapter activity and errors S2 Netbox v4.4

4 - Adapter requirements: Red Hat Linux (64-bit) operating system Apache Tomcat web server version or later Netbox server installed and enabled for remote connection MySQL 5.5 database, with 64-bit DSN system pointing to it, to log adapter activity and errors Honeywell EBI vr430.1 Q: What are the terms of Beta? A: Participants in the Usher 2.1 Beta program enjoy a trial period of 45 days, during which the Usher 2.1 Beta is available free of charge. Q: What is the pricing for Usher? A: Usher generally follows a monthly per-user subscription license fee model. A standard, baseline charge applies, and additional charges depend on the breadth of features included in your deployment. For a detailed discussion of pricing specific to your environment, please contact sales@usher.com. Q: What devices and mobile platforms does Usher support? A: Currently, Usher is supported for devices running ios 7 and above, and Android 4 and above. Bluetooth peer discovery, as well as access to buildings and Mac workstations is enabled for iphone versions 4s, 5, and 5s, and ipod 5. Android supports Bluetooth peer discovery only. Q: How is Usher 2.1 Beta deployed? A: Usher 2.1 Beta is hosted from the MicroStrategy Cloud environment. Self-Service deployments in the Beta program utilize this SOC 2 Type II compliant cloud environment to host the entire Usher architecture. For autonomous customers with a private cloud mandate, the entire Usher Platform can be installed behind their firewalls for a full on-premise deployment. Contact sales@usher. com for additional details. Q: I am concerned about opening my enterprise ID stores to the cloud. Why should I do this? A: A cloud-based deployment is the fastest, most efficient, and cost-effective method to deploy Usher. Self-service deployment within Usher s cloud infrastructure avoids upfront costs, such as the time and resources necessary for a custom installation of the Usher server, not to mention the ongoing maintenance and management of those resources. The cloud environment itself has the following data center certifications: SAE 16 Type II (replace SAS70), SOC 2, Type I & II, SIEM, and Safe Harbour certification.

5 Q: What happens if the phone is lost or stolen? A: In the mobile identity context, losing the phone is often associated with losing your wallet or keys. The traditional measures no longer apply, such as canceling cards, changing locks, losing productivity during visits to credentialing authorities, etc. In the case of Usher, these credentials and keys are software based, and a single administrative action can revoke all Usher privileges for a specific user/phone instantly. This logs the user out of the phone and will not permit further login for the user on that device without explicit permission. Meanwhile, on a replacement smart phone, the user simply installs Usher from the app store and authenticates to instantly restore all of their badges and credentials. Q: How does Usher work without Internet access? A: Usher currently offers a number of offline capabilities. For physical access, you can have a Bluetooth reader (either the UBeacon or ipad reader) at the door, which is connected to the network (hard-wired or wifi), and a disconnected Usher mobile client can unlock the door. For logical access, a disconnected Usher mobile client can unlock a Mac workstation. Peer-to-peer validation also works when the validatee is offline, but the validator must be online. Q: How is Usher secure? A: Usher uses the most robust industry standards to incorporate the best practices in system security. The Usher Server architecture is built on Public Key Infrastructure (PKI) to ensure that only authorized Usher users communicate with the Usher Server, and only from authorized Usher Client devices. The Usher server identifies a valid user by their client s unique X.509 certificate, which the Usher Server generates and assigns when the user initially launches the Usher app. This public-private key cryptography workflow ensures that requests to the Usher Server only come from legitimate Usher-enabled devices. Furthermore, the Usher Server provides an out-of-band (OOB) communication channel that uses 256-bit SSL protocol to prevent interception of sensitive data over public networks. User authentication occurs through this OOB channel, involving multiple factors (explained below) and employing TLS encryption for all traffic over the channel that does not allow phishing or interception of user credentials. 256-bit AES encryption protects basic user data such as username and . Q: What security data/pii does Usher manage? Where does this data reside? A: Usher manages names, addresses, company names and job titles. These fields are stored in the server and the mobile devices, and protected by 256-bit AES encryption. Q: What factors of authentication does Usher offer? A: Usher is a true multi-factor authentication solution, leveraging the following security factors: 1. Knowledge factor, or something you know passcode-protected app and/or device 2. Inherence factor, or something you are face and/or voice biometrics 3. Possession factor, or something you have the phone itself, with its unique cryptographic certificate used to communicate with the Usher Server

6 Q: Does Usher slow down my phone? A: No. Usher is a light app which will not slow down your phone. Q: Does Usher drain my phone battery? A: Usher uses Bluetooth Low Energy (BLE) to communicate with other devices in order to achieve logical access, physical access, as well as peer-to-peer user discovery. BLE is designed to transmit small amounts of data over a low energy link, thus requiring low power. The amount of additional power required to support the Usher BLE communications is negligible. Q: Does Usher take a lot of space/memory on my phone? A: Usher occupies very little space itself. Space occupation may increase if you enable precaching functionalities. Usher won t take a lot of memory either; memory usage of Usher is at the same level of popular apps such as Facebook, WhatsApp, LinkedIn, etc. Q: How does the registration/enrollment process work? A: Registration and enrollment work as follows: 1. The network administrator adds a user to Usher using the user s address 2. Usher sends an to the user with a unique badge link 3. The user clicks the link on their mobile device, which opens the Usher app 4. If this is the first time the Usher app is launched, the server assigns it an access token, the app generates a key pair and a certificate signing request (CSR) and sends the CSR to the server. The server returns an X.509 client certificate based on the CSR to the app, and associates this access token and certificate with the current user. From that point on, the app uses the X.509 certificate and access token in every request to the server 5. Usher server returns the badge information to the Usher app, which displays it to the user Q: What reports and analytics can Usher provide? A: Usher Intelligence is built on the MicroStrategy backend, PRIME, and frontend Analytics Platform, empowering Usher Administrators with a view into the health of their Usher Identity network population and trending over time, allowing for in-depth resource and member analysis, and transaction record auditing. Q: How do I get support for Usher? A: To reach Usher s 24/7 support hotline, please contact one of the numbers below: (US only) microstrategy.com/usher 1850 Towers Crescent Plaza Tysons Corner, VA Copyright All Rights Reserved. COLL