Adaptive Authentication Integration Options. John Murray Manager, RSA Systems Engineering

Size: px

Start display at page:

Download "Adaptive Authentication Integration Options. John Murray Manager, RSA Systems Engineering"

Gyles Stewart
8 years ago
Views:

1 Adaptive Authentication Integration Options John Murray Manager, RSA Systems Engineering

2 What is RSA Adaptive Authentication? Comprehensive authentication and fraud detection platform Powered by Risk-Based Authentication technology Measures risk associated with a user s login and post-login activities Determines level of authentication required based on risk, policies, and customer segmentation 2

Risk-Based Authentication technology Measures risk associated with a user s

3 The Risk Engine Gathers Facts Build Profiles, Generates Predictors, & Learns Assesses Risk Internet Protocol (IP) Information Proprietary Device Fingerprints RSA Risk Engine Scoring Results User Behavior RSA efraudnetwork Profiling 3

Information Proprietary Device Fingerprints RSA Risk

4 Hosted or On Prem 4

5 On Premise J2EE Java Based Application installed and maintained within a customer s own datacenter. Flexible Platform Support Including: OS: Windows Server, Red Hat Enterprise Linux, Solaris and AIX Application Servers: WebSphere, Web Logic, JBoss, Tomcat DB Servers: Oracle, MS SQL Server 5

Flexible Platform Support Including: OS: Windows Server, Red Hat

6 Hosted AA fully hosted in the cloud by RSA. Integration handled via SOAP calls over HTTPS. Access to back office tools granted via online web portals. New re-architected 12.0 platform to be released Q4 2014, running on an elastic cloud provider. 6

Access to back office tools granted via online web portals.

7 Integration Method Direct API or Adapter 7

8 Direct Integration Standard code (SOAP) based integration following Request- Response model between Application and AA Server Customer integrate into their own applications by developing against the AA WSDL Standard methods include: Analyze, Notify, Query, Challenge, UpdateUser, CreateUser, Authenticate 8

their own applications by developing against the AA WSDL Standard methods

9 SOAP Request Example <soapenv:envelope xmlns:soapenv=" <soapenv:body> <ws:analyze> <ws:genericactiontypes>sessionsignin</ws:genericactiontypes> <ns1:httpacceptchars>iso ,utf-8;q=0.7,*;q=0.3</ns1:httpacceptchars> <ns1:httpacceptlanguage>en-us,en;q=0.8</ns1:httpacceptlanguage> <ns1:httpreferrer> <ns1:ipaddress> </ns1:ipaddress> <ns1:useragent>mozilla/5.0 (Windows NT 5.2; WOW64) AppleWebKit/ (KHTML, like Gecko) Chrome/ Safari/537.17</ns1:userAgent> <ws:username>jmurray</ws:username> <ws:userstatus>verified</ws:userstatus> <ws:usertype>persistent</ws:usertype> <ws:apitype>direct_soap_api</ws:apitype> <ws:requesttype>analyze</ws:requesttype> <ws:version>7.0</ws:version> <ws:callercredential>password</ws:callercredential> <ws:callerid>caller</ws:callerid> </ws:analyze> </soapenv:body> </soapenv:envelope> 9

3</ns1:httpacceptchars> <ns1:httpacceptlanguage>en-us,en;q=0.8</ns1:httpacceptlanguage> <ns1:httpreferrer>http://rsademos.com:8080/demobank/index</ns1:httpreferrer> <ns1:ipaddress>158.24.172.

10 AA SaaS Direct Integration Architecture INTERNET Firewall DMZ Firewall TRUSTED ZONE Customer browser Web servers App servers App database Credential store SOAP RSA Adaptive Authentication (SaaS) 10

browser Web servers App servers App database

11 AA On Direct Prem Integration Direct Integration Architecture INTERNET DMZ TRUSTED ZONE Customer browser Web servers App servers App database Credential store SOAP RSA Adaptive Authentication RSA AA database Firewall Firewall 11

Web servers App servers App database Credential store

12 Adapter Pre-built integrations with popular enterprise portals No software development required Full customizable pages handle entire workflow and interaction with AA Server including: Enrollment Forensics Collection Challenging Blocking Current RSA Adapters RSA Access Manager* Tivoli Access Manager CA SiteMinder Juniper SSL VPN Cisco SSL VPN Citrix NetScaler Microsoft UAG 12

including: Enrollment Forensics Collection Challenging Blocking Current RSA Adapters RSA

13 Sample Adapter Architecture - Citrix 13

14 Web vs. Mobile 14

15 Mobile Browser - Data Collection Data collected via JavaScript: Browser characteristics: Browser type, version, language, etc. Device forensics: Time zone, Screen resolution. Geolocation: Latitude, Longitude, Accuracy, Additional Information: User Agent String IP Address Cookie FSO WAP sites: WAP header sent as the HTTP header In the Other ID field in the API send the WAP client id 15

Geolocation: Latitude, Longitude, Accuracy, Additional Information: User Agent String IP Address

16 Mobile Apps Data Collection Data elements collected and sent to AA using either Mobile SDK or a native API Location information collection Mobile device identification data Device model Device multitasking supported Device Name Device System Name Device System Version Language Wi-Fi Mac Address Wi-Fi Networks data: Station Name Wi-Fi Networks data: BBSID Wi-Fi Networks data: Signal Strength Wi-Fi Networks data: Channel Wi-Fi Networks data: SSID Cell Tower ID Location area code Screen size Number of address book entries RSA Application key MCC MNC OS ID Location error code 16

Address Wi-Fi Networks data: Station Name Wi-Fi Networks data: BBSID Wi-Fi Networks data: Signal Strength Wi-Fi Networks data: Channel Wi-Fi

17 What To Protect Login or Post Login Transactions 17

18 Transaction Monitoring Allows AA Risk Analysis and Actions to be applied to Post Login Events Has the ability to monitor both: Profile Changes Changes to the user s password, address, e- mail, security question, phone numbers, etc. Funds or Financial Transfers Add Payee, Add Beneficiaries, Request Credit Increase, Request Checks, etc. Events will utilize additional information as part of risk model. E.g. Payment: Amount, Payee Acct #, Currency, Type, Time, etc. 18

etc. Funds or Financial Transfers Add Payee, Add Beneficiaries, Request Credit Increase, Request Checks, etc.

19 AA Full Event Type List ACTIVATE CARD ADD PAYEE CHANGE ADDRESS CHANGE ALERT SETTINGS CHANGE AUTH DATA CHANGE CHANGE LIFE QUESTIONS CHANGE LOGIN ID CHANGE PASSWORD CHANGE PHONE CHANGE STATEMENT SETTINGS CHANGE STU CLIENT DEFINED CREATE USER DEPOSIT EDIT PAYEE ENROLL FAILED CHANGE PASSWORD ATTEMPT FAILED LOGIN AUTHENTICATION FAILED OLB ENROLLED ATTEMPT OLB ENROLL OPEN NEW ACCOUNT OPTIONS TRADE PAYMENT READ SECURE MESSAGE REQUEST CHECK_COPY REQUEST CHECKS REQUEST CREDIT REQUEST NEW CARD REQUEST NEW PIN REQUEST STATEMENT COPY SEND SECURE MESSAGE SESSION SIGNIN STOCK TRADE UPDATE USER USER DETAILS VIEW CHECK VIEW STATEMENT 19

LOGIN AUTHENTICATION FAILED OLB ENROLLED ATTEMPT OLB ENROLL OPEN NEW ACCOUNT OPTIONS TRADE PAYMENT READ SECURE MESSAGE REQUEST CHECK_COPY REQUEST CHECKS

20 Transaction Monitoring More Fraud Stopped and Fewer Customers Challenged Increase in fraud detected when adding transaction level protection Increase in fraud detected from Device ID to Device ID & efraudnetwork 20 20

adding transaction level protection Increase in fraud

21 Challenge Methods What are my options? 21

22 Step-up Authentication An additional factor or procedure that validates a user s identity, out-of-the-box options include: Challenge Questions Secret questions that have been selected & answered by end user during enrollment Out-of-Band Authentication One time passcode sent to the end user via phone call, SMS text message or . Transaction details, such as transfer amount, can be included Dynamic Knowledge- Based Authentication (KBA) Dynamic questions that are unique to the end user, and generated from publically & commercially available data in real-time Provided by LexisNexis Identity Verification service (available in US & UK) Multi-credential Framework Allows organizations to use in-house or third party method through a RSA Professional Services engagement 22

23 RSA Out-of-Band Authentication One Time Password RSA Generated OTP RSA Delivery Customer Delivery Delivery Method Phone SMS Phone SMS Channel Delivery Mobile Landline Mobile Landline 23

24 THANK YOU

ProtectID. for Financial Services

ProtectID. for Financial Services ProtectID for Financial Services StrikeForce Technologies, Inc. 1090 King Georges Post Road #108 Edison, NJ 08837, USA http://www.strikeforcetech.com Tel: 732 661-9641 Fax: 732 661-9647 Introduction 2