RSA AUTHENTICATION. 20 Settembre, Jesi - SICUREZZA ICT SOIEL. Copyright 2011 EMC Corporation. All rights reserved.

Transcription

1 RSA AUTHENTICATION MANAGER EXPRESS Multi-factor Authentication for the Small to Mid-Sized Organization 20 Settembre, Jesi - SICUREZZA ICT SOIEL Massimo Carlotti COMPUTERLINKS Systems Engineer 1 Agenda Security Challenges in Mid-Sized Organizations Introducing RSA Authentication Manager Express Maximizing Security, Minimizing Costs The RSA Authentication Portfolio Q&A 2

2 Agenda Security Challenges in Mid-Sized Organizations Introducing RSA Authentication Manager Express Maximizing Security, Minimizing Costs The RSA Authentication Portfolio Q&A 3 Context: Threats and Demands are Increasing External attacks Careless users writing down passwords Costly audit requirements/ Increasing regulations Ever-changing business requirements Requirements for more collaborative tools 4

3 Market Sector: Fraudsters see an Opportunity Assumption of less sophisticated IT Security IT Budget Traditionally, SMB has less adoption of strong authentication Small and Mid- Sized Organizations are at risk Organization Size 5 IT Staff Feels the Pressure The ENVIRONMENT END USER Productivity Constantly changing threat landscape Supporting multiple groups of users and initiatives Budget and headcount are always a consideration MANAGEMENT has Demands The push for mobility and collaborative tools means potentially exposing identities and Intellectual Property (IP) outside of the organization Security is considered a burden Users cannot experience downtime 6 6

4 Issues and Needs Utilizing only username and password Strengthen authentication policy on critical infrastructure Supporting business-critical collaboration tools Security, but with minimal changes to IT policies and procedures Keeping users productive Non-disruptive security implementation to end users Staying in compliance Have a verifiable trail to pass an audit. 7 Agenda Security Challenges in Mid-Sized Organizations Introducing RSA Authentication Manager Express Maximizing Security, Minimizing Costs The RSA Authentication Portfolio Q&A 8

5 RSA Authentication: Scelta Dipendenti Part-Time Utenti sporadici Utenti a contratto Road Warriors Partner Utilizzatori abituali Amministratori Impiegati interni Ampia scelta di soluzioni per venire incontro alle esigenze di una popolazione di utenti in continua crescita Smart Card ibrida Fob / Card Token Soluzioni integrate Dispositivi portatili PC / Web Browser On-Demand Risk-Based Hardware Tokens Software Tokens Tokenless 9 AMX: Multi-factor authentication with zero footprint Risk-Based Authentication On-Demand Authentication And Easy to Manage Appliance Platform 11

6 Risk-based Authentication: How It Works RSA Risk Engine Advantages of AMX RSA AMX offers strong authentication with little impact to end users. RSA AMX is: Tokenless (hardware or software) cost savings Relatively transparent to the username/password authentication customer User is only challenged if the AMX risk engine detects risky or atypical account activity. Users can be authenticated using: On-Demand Authentication (ODA) Risk-Based Authentication (RBA) A combination of the two methods 13

7 AMX Authentication Methods AMX authentication can be deployed as: RBA with ODA for the identity challenge RBA with Security Questions for the identity challenge ODA only 14 Risk-Based Authentication Method Risk-Based Authentication assesses risk by evaluating: Information about the client device User behavior If the risk is high, the user is challenged using: On-Demand Authentication Security questions 15

8 Silent Collection Silent Collection: Simplifies migrating users from password only to Multi Factor Authentication with RBA Collects profile and behavioral data without administrator intervention The risk engine: Passively monitors user behavior For a defined period Without challenging users based on risk Automatically registers user devices Observes behavioral patterns 16 Silent Collection, continued When Silent Collection period is over, user is: Informed of the new security feature Prompted for any missing information Silent collection: Is enabled for all users in a security domain Helps the risk engine build a baseline profile for each user Affects your deployment as follows: During silent collection period authentication is password-based only All devices are registered to the user s RBA profile 17

9 Multi-factor Risk-Based Authentication (RBA) Factor #1: Something You KNOW Factor #2: Something You HAVE Factor #3: Something You DO Step Up: Something You KNOW or HAVE 18 The RSA Risk Engine Proven, sophisticated risk engine RSA Risk Engine Protecting more than 250 million online identities today Dozen of characteristics used to calculate the riskiness of each authentication Optimized for the enterprise organization Self learning so it adapts to your user population over time 19

10 SMS/ integration is included Delivers a One-Time Password (OTP) via SMS or Based on the RSA SecurID algorithm Compatible with any mobile phone from any carrier No software to deploy or tokens to manage Provides multi-factor authentication: Factor #1 PIN Factor #2 Mobile device or account 21 This sounds good, but what is the USER experience When I logon from a Registered ed Device??? (Low-Risk logon activity) 35

11 Logging In From a Registered Device 36 Logging In From a Registered Device 37

12 This sounds good, but what is the USER experience When the situation stuato is high-risk??? 38 Risky Transaction 39

13 Risky Transaction 41 Risky Transaction 43

14 Risky Transaction 44 Agenda Security Challenges in Mid-Sized Organizations Introducing RSA Authentication Manager Express Maximizing Security, Minimizing Costs The RSA Authentication Portfolio Q&A 54

15 RSA Authentication Manager Express Strengthens Critical Infrastructure Goes beyond password-only to deliver true multi-factor authentication Seamlessly deploy to SSL VPN, web portals and Citrix thin clients Accelerates Time to Value Minimal changes to IT environment No changes to password policy! Reduces deployment time and costs Integrates with leading vendors Keeps Users Productive Nothing to deploy to users Users keep existing username/password Choice of different authentication methods Silent enrollment Invisible security Ensures Compliance Gives high level of assurance to every user authentication Verify and report that each user and application is protected to pass an audit 55 Use Cases SSL VPN Web Portal Citrix Remote employees connecting to the network over an SSL VPN (no IPSEC VPNs) Partners accessing a Microsoft IIS web portal that provides access a deal registration site Vendors utilizing an order management system presented over Citrix XenApp Employee Partner Vendor 56 56

16 Why RSA Authentication Manager Express? RSA Authentication Manager Express Delivers the Fastest Path to Multi-Factor Authentication Proven multi-factor authentication technology Seamless transition from passwords to strong authentication Convenience for end-users Standard password authentication in typical situations Simplicity for IT organizations Nothing to deploy to end users Out-of-the-box integrations Convenient appliance platform 57 Licensing, Configuration and Pricing Licensing: Single SKU perpetual licensing Licensed per registered user Includes all authentication options Credentials are re-assignable Does not expire Pricing: Volume based pricing tiers (similar to RSA Authentication Manager) Appliance bundles are available No tokens to purchase or renew Maintenance: Annual software maintenance is 21% of license fee 3-year AHR is included with the h/w appliance Years 4 and 5 optional and additional RSA Authentication Appliance 130 1U hardened Linux OS Same hardware as the latest SecurID Appliance 130 Scalable up to 2,500 users Supports up to 1 Replica Optional web tier for secure DMZ deployment of Self-ServiceService Console and RBA logon service Multiple deployment options: RBA with On-Demand challenge RBA with Security Questions On-Demand only 58

17 Agenda Security Challenges in Mid-Sized Organizations Introducing RSA Authentication Manager Express Maximizing Security, Minimizing Costs The RSA Authentication Portfolio Q&A 59 RSA Authentication: Three Platforms Target Market Small and mid-size organizations Fewer than 2,500 users Enterprise with More than 1,000 users Enterprise- Consumer Applications More than 10,000 users Use Case Protection of SSL VPNs and web applications Users: Employees, partners, clients Protection of any application, portal or network infrastructure Users: Employees, partners, customers Protection of web applications Users: typically customers or clients Value Proposition Convenient for endusers and IT staff Lower TCO Enterprise class features and scalability, authenticator form factor options Scalable, convenient, cost-effective; Available on-prem or hosted RSA Authentication Manager Express RSA Authentication Manager RSA Adaptive Authentication Maximum Flexibility and Optimization 60

18 RSA Authentication: Scelta Dipendenti Part-Time Utenti sporadici Utenti a contratto Road Warriors Partner Utilizzatori abituali Amministratori Impiegati interni Ampia scelta di soluzioni per venire incontro alle esigenze di una popolazione di utenti in continua crescita Smart Card ibrida Fob / Card Token Soluzioni integrate Dispositivi portatili PC / Web Browser On-Demand Risk-Based Hardware Tokens Software Tokens Tokenless 61 Q&A 62

19 THANK YOU Massimo Carlotti - COMPUTERLINKS maca@computerliks.it 63