An Oracle White Paper December Integrating Oracle Enterprise Single Sign-On Suite Plus with Strong Authentication

Transcription

1 An Oracle White Paper December 2010 Integrating Oracle Enterprise Single Sign-On Suite Plus with Strong Authentication

2 Introduction Protecting data in the digital age is critical. A security breach, if serious enough, can cost millions of dollars and cripple an organization financially. Eliminating unauthorized access to data is a business necessity. To guard against unauthorized access, most organizations have opted for one of two distinct paths: Requiring different strong passwords changed frequently to access applications and systems, thereby forcing users to remember multiple complex passwords Requiring users to authenticate to the network using a form of strong authentication, such as tokens, smartcards, or biometrics Either approach can benefit from an enterprise single sign-on (ESSO) solution. ESSO eliminates the need for end users to remember and manage application passwords without compromising the security of passwords or password selection. ESSO enables organizations to extend the value of their strong user authentication to the application level without requiring any significant development efforts. When deployed properly, ESSO produces a rapid return on investment by reducing passwordmanagement costs while boosting data security and user productivity. This white paper outlines the value of implementing Oracle Enterprise Single Sign-On Suite Plus in conjunction with, to extend the value of, or to lay the foundation for a strong authentication deployment. 1

3 Enterprise Single Sign-On Defined ESSO means users need only one password for access to all applications and systems. With it, users can access the corporate network at the start of their workday and immediately have access to all necessary password-protected applications. Eliminating the need to remember multiple passwords enhances security because users do not have to write down their passwords or use easy-to-guess passwords, both of which expose applications to unauthorized users. The Cost of Password Management Remembering and managing multiple usernames and passwords can be frustrating, and that s problematic enough, but this frustration also has significant financial implications. Increased Help Desk Costs As the number of applications and systems that users need to access increases, so does the number of passwords they must remember and manage. This causes frustration among users who forget their passwords and drives up help desk costs with requests for resets. According to the Gartner Group, up to 40 percent of all help desk calls are password reset requests, at an average cost of US$25 per call. Each year, companies spend as much as US$300 per user trying to manage passwords. For organizations with thousands of employees, this can cost millions of dollars. Lost Productivity Forgotten passwords hurt employee productivity. Time spent resetting passwords or waiting for help desk return calls leads to idle users locked out of applications or intranet sites that they need to access to do their jobs. A user might find upon arriving to work that she cannot log on to a critical application to complete a report for a meeting, and a sales representative on a call with a customer might suddenly find he cannot access information for the customer. As a result, help desks spend at least half their time handling password resets while other problems are relegated to lower importance. Weakened Security Multiple passwords are a constant end user irritant, but they can also have serious security consequences. Unable to remember distinct passwords for all systems, corporate end users resort to unsafe practices, such as writing passwords on sticky notes or in their smartphones. Ultimately, end user password management is a growing enterprise security risk because end users Select poor or obvious passwords Use the same password for all systems Never change their passwords Frequently share their passwords with colleagues 2

4 Compliance-Related Costs As organizations seek to deploy projects that enable them to comply with government legislation or security practices, unfortunately all of these costs can escalate. For example, a hospital that seeks to meet the requirements of the Health Insurance Portability and Accountability Act by mandating that each nurse have a unique login for each application will see frustrated nurses and a spike in help desk costs due to forgotten passwords. Similar situations occur with organizations seeking to deploy enterprise identity management initiatives as part of the Sarbanes-Oxley Act compliance process. To help eliminate these costs without compromising security, organizations have attempted to implement strong authentication and ESSO solutions. Single Sign-On History Single sign-on (SSO) can provide a quick return on investment because it requires virtually no integration with a network s existing applications or infrastructure. But this has not always been the case. Earlier versions of SSO were server-based offerings requiring end users to authenticate to a central server after logging on to their workstations. These products required connectors or agents to be deployed to all internally hosted applications, which was costly and essentially rendered deployments unachievable. As a result, SSO projects were abandoned during evaluation or pilots. Some made it as far as deployment, but were abandoned shortly thereafter. More-recent solutions using extensive scripting offered hope, but they produced similar results as their host-based predecessors. That legacy of failure changed with Oracle Enterprise Single Sign-On Suite Plus, which leverages an innovative event-driven approach to extend the benefits of ESSO to virtually any application, be it Microsoft Windows, UNIX, mainframe, telnet, Java, or Web-enabled without modifying the application. Oracle Enterprise Single Sign-On Suite Plus has emerged as the ESSO standard, bridging the first password, that which is used for network logon, to other applications and authentication methods. Rapid Time to Value Oracle Enterprise Single Sign-On Suite Plus delivers rapid time to value by not requiring Modification to target systems or applications Dedicated infrastructure Modification to the current end user experience In addition, Oracle Enterprise Single Sign-On Suite Plus can help organizations use ESSO to pave the way for stronger authentication or extend the benefit of strong user authentication to virtually any application. 3

5 Integration Oracle Enterprise Single Sign-On Suite Plus and Strong Authentication As previously discussed, ESSO solves the password management problem. That in itself is a considerable accomplishment because it helps eliminate help desk costs and productivity loss. And this could lead organizations to conclude that once they dispose of this problem, then they have achieved optimal data protection. That could be so in some cases, but organizations increasingly find they need strong authentication for at least some of their most sensitive applications or even all access. Strong Authentication Strong authentication provides identity verification by requiring an enhanced form of user authentication to unlock network accounts, virtual private network accounts, and even applications. It is important to understand what constitutes strong authentication. Many organizations immediately jump to tokens, smartcards, or biometrics when adopting strong authentication, but often these forms of two-factor authentication are more than necessary. With ESSO, users have one password, typically their Windows logon. They need authentication only once to gain access to enterprise applications. With users having to remember only one password, it is perfectly reasonable for organizations to enforce strict password policies on that single password. To that point, it is imperative that organizations understand that a strong password policy as their primary method of user authentication can be strong authentication a very economical form of strong authentication. Oracle Enterprise Single Sign-On Suite Plus includes a user self-service Windows password reset solution called Oracle Password Reset. This solution enables users who forget their Windows password to reset it from the Windows login without help desk involvement. Oracle Password Reset can help enforce a strong password policy without increasing help desk costs. Strong Two-Factor Authentication Two-factor authentication, such as biometrics, tokens, and smartcards, combine two forms of identity verification, for example, a personal identification number or password used with a smartcard or token. These types of authentication are requirements for organizations in various industries, from some government agencies to healthcare providers to financial institutions. Today, most organizations considering two-factor authentication projects focus on user authentication for applications that involve high-risk, high-value transactions. This is primarily because integrating two-factor authentication is a costly, and often complex, process. To address this issue, Oracle Enterprise Single Sign-On Suite Plus includes the Oracle Universal Authentication Manager solution, which can help securely bridge any form of user authentication and any application, without requiring any integration at the application level. Oracle Universal Authentication Manager also supports multiple authenticators, such as the Windows logon, when the advanced authenticator is not available or working. The solution grades the authentication and restricts 4

6 or allows access based on the authentication level. This is a significant benefit that can help organizations either to use ESSO to pave the way for a strong authentication deployment or extend the benefit of strong user authentication to virtually any application. Leveraging Enterprise Single Sign-On to Pave the Way for Two-Factor Authentication ESSO paves the way for two-factor authentication. Typically, two-factor authentication focuses on user authentication, but true return on investment and security benefits happen at the application level. Oracle Enterprise Single Sign-On Suite Plus delivers secure access to applications, enabling strict authorization policies to be enforced that require complex passwords and frequent changes to those passwords. This means Oracle Enterprise Single Sign-On Suite Plus delivers strong user authentication to the network itself and to all enterprise applications. Extending the Value of Two-Factor Authentication with Enterprise Single Sign-On With ESSO in place, organizations can further justify their investments in two-factor authentication. Without it, the costs of integrating all applications to accept two-factor integration would be exorbitant, and the commitment in time would be enormous. Strong user authentication with weak application authentication is a poor solution. But adding ESSO changes this Oracle Enterprise Single Sign-On Suite Plus delivers a quick return on investment. Conclusion Oracle Enterprise Single Sign-On Suite Plus has simplified the deployment of ESSO for organizations. Furthermore, integrating Oracle Enterprise Single Sign-On Suite Plus with strong authentication enables organizations to either extend the value of two-factor user authentication to applications or pave the way for a strong two-factor user authentication process. The benefits are significant. Organizations that deploy this solution can more-effectively protect enterprise data with enhanced security while reducing help desk costs, improving user satisfaction, and enhancing compliance capabilities. 5

7 Integrating Oracle Enterprise Single Sign-On Suite Plus with Strong Authentication December 2010 Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA U.S.A. Worldwide Inquiries: Phone: Fax: oracle.com Copyright 2005, 2010, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. 0410