Two Factor Authentication - A Simple Way to Compare Costs and Risks

Transcription

1 The Hidden Costs and Risks of DIY Two Factor Authentication

2 Foreword Dave Abraham examines the real costs involved in implementing and managing two factor authentication (2FA) in-house. Dave Abraham is CEO and co-founder of Cambridge-based Signify, the secure authentication service. Signify helps organisations to secure their staff s remote access by providing two-factor authentication as a hosted cloud service. Prior to co-founding Signify with his business partner John Stewart, Dave ran consulting firm IS Online helping organisations add web interfaces to their existing corporate databases in the late nineties. Before starting his own businesses, Dave helped start the web division of London-based marketing consultancy The Words Group in the early days of the web in 1995, where he was also IT Manager. Dave has a degree in Applied Computing from the University of East Anglia in Norwich. 1

3 The Hidden Costs and Risks of In House Two Factor Authentication for Remote Access An ever-growing mobile and flexible workforce that makes up today s modern businesses is driving the demand for anywhere, anytime access to information, applications and resources. Alongside this, security threats to critical data are becoming more and more sophisticated and few days go by without a headline about lost or stolen data. Today Passwords are Frequently and Easily Compromised and 2FA is Now a Must Have Companies are now faced with balancing the importance of providing employees with simple-touse remote access to help them do their jobs more effectively and also ensuring the security of the network all without breaking the budget. Traditionally, simple passwords have been used to grant access to sensitive systems and data. It is now widely accepted that passwords can easily be compromised and instead, two-factor authentication (2FA) is fast becoming the de-facto standard for securing remote access. Passwords can easily be hacked, cracked, discovered or phished. 2FA requires remote users to present two different factors (or proof) of identity usually something you know and something you have. The use of one-time passcodes (OTP) delivered through hardware tokens - commonly kept on a key ring - is still the most popular approach to 2FA. Another popular option is software-based, which essentially turns a smartphone into a token to deliver the OTP. In House 2FA or Outsourced? While it is clear that 2FA provides the additional security needed, companies are struggling with the difficult decision of whether to have an in house system or to deploy in the cloud as a managed service. 2

4 While it is clear that 2FA provides the additional security needed, companies are struggling with the difficult decision of whether to have an in house system or to deploy in the cloud as a managed service. Like many decisions about outsourcing, for many organisations the decision simply comes down to one of cost. The Often Overlooked Hidden Costs and Security Risks Often when comparing the cost of each route organisations ignore the less obvious costs of implementation, and on-going management, control and administration, while also placing little or no importance on the intangible business and technology benefits of either option. This is short-sighted. Looking, for example, at a token-based 2FA solution, it is common to consider the cost of the tokens themselves, the authentication server and software required; and then compare these directly to the costs of a managed service of the same scale. This is unrealistic and often results in the in-house solution looking considerably more attractive on the face of it, despite the initial capital outlay. What they are failing to consider are the more hidden costs which include the internal manhours of rolling out the solution, administering and managing users, token provisioning, the costs of keeping hardware and software patched and up-to-date, ensuring 24/7 user support and high availability. All these things can be included as part of a managed service package. An in the cloud hosted service removes many of the costs associated with an in-house solution. While some of these functions and services are really difficult to put an actual price on, it has to be done to make a true comparison. For example, when it comes to user support, every single call to the company IT department or helpdesk costs money and crucially takes them away from doing other things. Industry analysts have put the cost of a call to a helpdesk for a password reset at anything between 20 and 40. It all adds up. 3

5 A Simple Way to Compare True Costs and Risks It is essential to list out everything that is needed to keep a 2FA solution up and running smoothly, with no disruption of service and at a level of support that helps keep employees productive. And because it s hard to come up with concrete figures for many of these things, weighting them in order of importance to the organisation can also prove useful. A managed service will cover many of these things as what you are essentially buying is an SLA a service level agreement. This specifies the level of service the managed service provider is contractually obliged to provide you with. However you don t want to rely upon an SLA you only want to revert to it if something goes wrong. Increased strain and pressure on IT and support teams is a cost that is often overlooked. Service providers can include anything in the agreement, it doesn t mean they have any track record of actually delivering it. You want confidence in the service, and for that you should look at the organisation s track record for delivering what they promise for example Signify s service availability is % over the last three years. Just think about what is going on behind the scenes to ensure this? There will certainly be significant investment in a resilient network infrastructure, security and monitoring/diagnostic tools and skilled people. An in-house 2FA solution can only be as effective as the IT delivery model that supports it. And you have to look at like for like when comparing costs of course a solution that isn t working properly half the time is going to be cheaper; but at what cost to your business? One of the much talked about benefits of a managed service is that it eliminates the need to develop specialist knowledge and skills in house. On the surface, costs may look reasonable, but what are the hidden costs? This as a cost benefit can not be underestimated. There is no need for costly training or to employ the additional staff that may well be needed to deliver a high level of quick responsive service that is available 24/7. 4

6 With a managed service you get access to all the specialist knowledge you need on tap to deal with user problems quickly and without disruption to service. Not only that, a good service provider will have invested in the proactive monitoring tools to deliver fast problem resolution, often before users are even aware of the issue themselves. The cost of these tools are likely to be prohibitive to all but the largest organisations; but they are crucial in ensuring as reliable a service as possible. Of course, everyone realises that doing it in house is likely to need purchase of an authentication server, licences, 2FA application and tokens; whereas the managed service route means on-going service fees with no up front purchase. As discussed, this is typically the only costs they use to compare. However, with an in-house implementation there are the on-going server and software administration costs to be considered. Simply keeping the server fully patched and up to date takes time; and time is money. Token provisioning is an important cost to consider. This means the deployment of new tokens to individuals in the organisation who could be anywhere in the country, or indeed the world; dealing with issuing and deploying replacements for lost tokens; and deployment of new tokens during the expiry process. Provisioning tokens to users can take considerable time and effort. All of this can take considerable time. These costs have to be considered but there are also productivity benefits from the fact that it s likely that a dedicated managed service will be able to it more efficiently to get tokens to the people that need them faster and get them up and running and working more quickly. Figuring Out the Hard to Cost Elements Perhaps the toughest of all to put a monetary figure on is the value of the flexibility 2FA as a managed service can bring. A managed service is by its nature, inherently flexible enough to scale quickly and easily up or down to meet changing business demands. Some 2FA managed service providers will also offer the flexibility to pick and choose the authentication method to suit individual users and their working patterns. 5

7 For example, regular users can be given a physical token that produces a new one-time passcode (OTP) every 60 seconds. Occasional users or users who require temporary access including during emergency situations - can opt to receive an OTP via SMS direct to their mobile phone or PDA. With an in house service a one size fits all approach to authentication method is the only option for all but the biggest players. And What About Risk? Or course; there are still those that worry about the risk of managed services, no matter what the cost benefit may be. Some organisations just can t bring themselves to put their trust in the hands of a third-party provider. However, these barriers and fears are being overcome by the Some hosted 2FA service providers also offer a choice of authentication methods this flexibility for users is more cost effective than a one size fits all approach. growing reputation of specialist MSSPs Managed Security Service Providers that deliver specialist knowledge, infrastructure and support. And when considering risk, you also have to factor in the impact on security of any slippage in in-house management of 2FA for example, not applying server patches the moment they come through, system down-time when the door is effectively wide open, what is happening after office hours when your IT staff are sleeping and the fact resources means that in-house solutions are at best reactive (one step behind) rather than pro-active as MSSP s are. They have experience of providing the highest levels of security, reliability and control and can prove it to deliver the essential trust and confidence. When looking for a service provider look at their track record for all of these things. What Does it all Mean in Practice? Taking all of the potential physical, support, management and administration costs into account is the only way an organisation can make any sort of cost-based comparison to help the decision on whether to deploy 2FA in house or as a managed service. When the analysis is done properly, most organisations will find the cost of doing it in house looks far lass attractive than it first did. 6

8 But none of this can really factor in what are perhaps the biggest and most intangible benefits of deploying 2FA as a managed service; having someone else do it and do it for you better than you could do it yourself. About Signify Signify helps organisations to secure their computer networks. We provide a secure alternative to passwords that safely enables remote access to systems and information by delivering twofactor authentication as a hosted/cloud service. Since 2000, Signify have built an outstanding reputation for delivering secure, reliable and flexible two-factor authentication which is quick and easy to deploy. 7