DITCHING THE VPN FOB. What You Need to Know About the New, Smarter Ways to Connect. Whitepaper

Transcription

1 DITCHING THE VPN FOB What You Need to Know About the New, Smarter Ways to Connect Whitepaper

2 2 Ditching the VPN Fob: What You Need to Know About the New, Smarter Ways to Connect They ve become part of the enterprise worker s standard-issue toolkit. Alongside the mobile phone, the ID badge, and the laptop, we've all become accustomed to the VPN token the trusty old fob that allows us to access the corporate network from just about anywhere. It s hard to believe they ve been around for 25 years. And in that time, not much has changed. In some ways, they re the tiny equivalent of the field phone those humongous bricks the pioneers of mobility lugged around with them in the early 80s. And yet, while we d never carry a 25-year-old phone today, we hardly ever stop to wonder about the VPN token. Why? Well, they ve served their purpose. They ve proved to be a reliable solution, with good security, scalability (some options claim to handle up to 200 user authentications per second, for up to 5 million users) and availability. All important factors to any IT department. So what s the downside?

3 3 What's Wrong with OTP Tokens? One-Time Passwords (OTPs) are valid only for a single transaction or login session. The password itself is created through randomness-dependent algorithms and then distributed through a variety of means often the hardware fob. The challenge is that these proprietary tokens are frequently misplaced, stolen, damaged or defective. In some cases, once the battery dies, there s no way to replace or recharge it, which means buying another token (and they re not inexpensive). Users also have to frequently call on their organization's IT teams or helpdesks to assist with token sync issues and PIN resets. Across an enterprise, these costs add up. But new options are available that go further, reducing costs while improving security and simplifying the end-user experience. How will your organization arrive at the right choice for today and well into the future?

4 4 Swapping the Fob for Biometrics If Not Biometrics, then What? Speaking of the future: Biometrics is a hot topic today, popularized in mainstream media in countless spy/action-hero movies and TV shows, though the concept is actually far from new. Many vendors, including Apple, are bringing fingerprint scanning to the forefront of authentication, particular in the consumer world. Tokenless two-factor authentication is both easier and more cost-effective to deploy than legacy, token-based systems, and skirts the high maintenance and privacy concerns associated with biometrics. While it s promising as a concept, and end users see the appeal, the cost to implement such an authentication method for enterprises is high: it means installing a scanner in every endpoint. And then maintaining those scanners regularly, especially with respect to the hygiene of the scanning surface. Human error can also cause headaches. For example, the original, identifying fingerprint scan may be less than optimal, or the person s finger/hand placement may be slightly off. And with ongoing, repeated authentication errors, administrators and users alike may become frustrated. User acceptance is another issue, particularly in the workplace, where employees aren t convinced they want their retina or fingerprints used in this way. Having one device to manage both secure communication and VPN access not only decreases the cost of hardware, but also increases ease of use for a mobile workforce. It s essentially an add-on service for an already inuse, secured device. And users are less likely to forget or misplace their smartphones than an OTP token. While OTP hardware still holds the largest chunk of the authentication-method market share, with an approximately 70% preference, Gartner predicts an increasing shift towards the phone as a token. Research shows a preference increase in this method from 45% in 2013 to 50% in In fact, when looking at both new and refreshed deployments, the mobile method is much preferred over legacy OTP hardware tokens.1 What accounts for the adoption increase? From the employee s standpoint, it may come down to a simple ease-ofuse benefit. It s less hardware to carry, and fewer items to juggle, remember passwords for, and lose. But ease of use isn t simply a benefit for users: The better the user experience, the better the adherence to policy an important point to remember for organizations that take security seriously. Research shows a preference increase in this method from 45% in 2013 to 50% in In fact, when looking at both new and refreshed deployments, the mobile method is much preferred over legacy OTP hardware tokens.

5 5 Public Key Infrastructure: If it s Public, is it Really Secure? Rather than employing OTP or biometrics in mobile-based authentication, a PKI (public key infrastructure) can enable secure communication through a seemingly unsecure public network. Public key infrastructures (PKIs) are required to help confirm the identity of people, devices, and services. PKIs go far beyond user IDs and passwords, employing cryptographic technologies like digital signatures and digital certificates to create unique credentials that can be validated beyond a reasonable doubt and on a grand scale. PKI technology is already used more widely than you might guess. PKI underpins the security of the consumer world, supporting the authentication of smartphones and tablets, gaming consoles, passports, transit ticketing, and mobile banking. It s critical to how data is encrypted as it moves over the internet using Transport Layer Security (TLS) and Secure Sockets Layer (SSL). Without PKI, e-commerce simply wouldn t be viable.

6 6 The User Experience: How VPN Authentication by BlackBerry Works For employees, logging in is quick and painless: They head to the VPN client on their laptop (the same VPN client they use today). They enter their Windows login credentials (this is the first identity authentication factor). They receive a prompt on their smartphone asking them to confirm their identity (this is the second authentication factor). A secure VPN tunnel is created between the laptop (or other device) and the corporate infrastructure. It s just that simple. VPN Authentication from BlackBerry Turn managed ios, Android and BlackBerry devices into security tokens and ditch the key fob. VPN Authentication by BlackBerry streamlines secure access to corporate data and applications when and where your employees need it. VPN Authentication by BlackBerry offers PKI-based, two-factor authentication, eliminating the cumbersome one-time password solutions. And unlike cloudbased solutions, BlackBerry gives you on-premise security and control. VPN Authentication by BlackBerry gives you the option of eliminating employee passwords or PINs. And reducing hardware and support requirements will reduce overall costs. Let me in Employee You re in VPN Server connected to VPN Authentication by BlackBerry server and BES Is it really you? Yes Any BES-Managed Device (ios, Android, BlackBerry)

7 7 How Your Organization Benefits Leveraging the mobile devices your employees already carry, you can save on the setup and maintenance costs that come with hardware tokens or scanners without compromising on security. Administrators are spared the constant headache of resetting user profiles and PINs and replacing unnecessary equipment. Control over account information and data is in your company s hands rather than the virtual hands of untrusted cloud-based service providers, so it s directly managed and more efficient. Plus, it puts more control in the hands of your mobile workforce, eliminating the hassle of having to carry an extra piece of hardware that serves only one purpose: to authenticate. Why VPN Authentication by BlackBerry VPN Authentication by BlackBerry offers many advantages over outdated OTP hardware solutions, including these: Use your BlackBerry, ios, or Android devices for easier secondfactor authentication compared to traditional VPN tokens Helps reduce overall IT hardware and support costs Quickly deploy and securely control VPN access and configuration of user profiles Tailor the level of authentication for different user groups Combine with BES12 for secure enterprise mobility management VPN Authentication by BlackBerry can also be customized to provide multiple levels of authentication for each group of users you employ. Combine the power of VPN Authentication by BlackBerry with the cross-platform EMM solution by BlackBerry, BES12, and your company will have a secure, industry-leading mobile infrastructure.

8 8 To find out more or to make a purchase, go to BlackBerry. All rights reserved. BlackBerry, BBM and related trademarks, names and logos are the property of BlackBerry Limited ( BlackBerry ) and are registered and/or used in the U.S. and countries around the world. All other trademarks are property of their respective owners.