PortWise 4.7. PortWise Sales FAQ. Sales FAQ & Licensing Guide

Transcription

1 PortWise 4.7 & Licensing Guide Who is PortWise?... 2 What is the PortWise Product Offering?... 2 PortWise Access Manager... 2 PortWise TruID... 2 What is PortWise 4.7?... 3 What Core Technologies Make the PortWise 4.7 Platform?... 3 New Features in PortWise PortWise 4.7 Unique Selling Points... 4 Qualifying Questions... 5 Objection Handling... 6 Competitive Advantages... 7 Pricing and licensing... 8 PortWise Access Manager... 8 PortWise TruID... 9 Frequently Asked Questions Upgrading from Previous PortWise Versions PortWise Access Manager PortWise TruID

2 Who is PortWise? PortWise provides a comprehensive, integrated and secure software platform for policy based application access and strong two-factor user authentication. PortWise enables secure and convenient access to applications and information for the mobile workforce and distributed partner networks from any device in any location. PortWise protects over 800 organizations and 6 Million users worldwide. PortWise is an international company with offices in Sweden, United Kingdom, United States, India and Singapore, and has partners across 21 countries. What is the PortWise Product Offering? PortWise offers products in the areas of secure remote access and user authentication. PortWise Access Manager PortWise Access Manager is a comprehensive, integrated software platform for identity and access management. PortWise Access Manager enables your enterprise to create secure connections for your employees, business partners and end-customers for remote application access, online business relationships and secure transactions. The product includes a comprehensive security feature set, including: Clientless SSL VPN 2-factor user authentication (available through PortWise TruID bundle) Application Single Sign-on End-point security Authentication with User Certificates / PKI Role-based access policy management Audit and reporting for regulatory compliance PortWise TruID PortWise TruID is a software based solution providing strong multi-factor authentication to applications and services. PortWise TruID is unique as it does not require the organization to purchase, distribute and maintain expensive hardware tokens for each user. With PortWise TruID you can utilize hardware that the user already has, such as a mobile phone, PC, pager, or PDA, to deliver strong one-time passwords. PortWise TruID includes the following authentication mechanisms: TruID Web Password - a Java-based online password keypad that runs in the user's web browser (requires PortWise Access Manager bundle). TruID SMS - Combines a static password with a one-time password delivered to a mobile phone, PDA, pager or laptop. TruID Soft Token - a JAVA based security client for generating one-time-passwords. TruID OATH - integrated authentication with OATH compliant hardware or software security tokens. PortWise TruID can be purchased separately as a stand-alone authentication server or as an integrated module to the PortWise Access Manager. 2

3 What is PortWise 4.7? PortWise 4.7 is the latest release version of PortWise Access Manager and PortWise TruID. What Core Technologies Make the PortWise 4.7 Platform? Clientless SSL VPN - Secure, encrypted communication from the end-user device to the applications without the need for a managed VPN client ensures low-cost deployment and optimized ease of use. PortWise SSL VPN enables users to securely access applications from any device and any location. Strong User Authentication Software based strong one- or two-factor authentication protects against identity theft and security breaches. PortWise provides a unique software based solution enabling trusted, multi-factor user authentication without the complexity of managing and distributing hardware security tokens. Policy based access control Integrating all aspects of Identity and Access Management into a single, cohesive and integrated policy delivers significant security, scale and auditing benefits to an organization. By using the core technologies in the PortWise Access Manager, a rich access control policy can be created which adaptively provides granular access control to application and data resources based on the security of the user s workspace and the sensitivity of the information. With PortWise role-based access control, the organization is in control of who is having access to what, when and how. Single Sign-on Increase the organization s IT security and the end-user experience by creating an application single sign-on environment to corporate back-end systems. The Single Sign-On feature in PortWise allows users transparent logon to their applications once authenticated. Refer to PortWise documentation for a list of supported applications. End-Point Security (EPS) - Ensure devices meet the corporate security policies in terms of anti-virus, personal firewall, and OS patch level before it is allowed access to internal resources. PortWise EPS guarantees that no malicious application uses the PortWise VPN connection to get access to the corporate intranet, and a personal firewall protects the end-point from external threats during the session. When the user terminates the session, EPS removes all traces of the session from the end-point. Identity Federation - Create trusted digital identities that can be leveraged across multiple domains and enterprises, using SAML or Microsoft ADFS. By enabling PortWise Identity Federation, an organization may offer its business partners and customers fully secured, role-based access to sensitive information, without having to worry about managing external user identities. PortWise Identity Federation enables organizations to utilize strong user authentication to cloud applications and other hosted services. Audit and reporting Centralized, consolidated audit repository with real-time and historical reports covering all areas of the PortWise platform. Proactive Alerts can be triggered by user or system activity and can be sent out via SMS or . Enterprise Administration A central management console provides a comprehensive admin interface for all PortWise services. Support for delegated administration enables an organisation to shift administrative rights throughout the organization. PortWise provides automated end-user enrolment and software token distribution to an unlimited number of users, to allow for cost efficient deployments. 3

4 New Features in PortWise 4.7 PortWise OATH PortWise 4.7 features support for OATH HOTP (RFC 4226) on the server side which expands the token support in PortWise to include support for any OATH HOTP compliant security token. Application Single Sign-On PortWise has extended its support for application Single Sign-On to include Telnet and SSH connections. Application SSO enables strong authentication in minutes and requires no changes to the server infrastructure nor the client. In addition to Telnet and SSH, PortWise 4.7 provides SSO for a wide range of applications, such as Windows Fileshare, Microsoft Terminal Server, Citrix Web Interface, Microsoft Sharepoint Portal, Outlook Web Access, and many others. Ticket SSO - PortWise 4.7 provides a framework for ticket based logon (Ticket SSO) using web services (SOAP) for identity federation and single sign-on to web applications. This feature complements PortWise other inter-domain Single Sign-On and Identity Federation options, such as SAML and ADFS. Ticket SSO can be used for both internal web applications as well as for SSO to SaaS (Software-As-A-Service) applications, such as SalesForce. End-Point Security plugin for Windows Security Center PortWise 4.7 has extended its End-Point Security (EPS) assessment framework to include support for Microsoft Windows Security Center. With PortWise EPS it is now possible to query the Windows Security Center to determine the security status of the end-user device, with regards to installed anti-virus software, client firewall settings and Windows Update, before allowing the device access to internal resources. With the Windows Security Center EPS plug-in, it is easier than ever to keep your end-point security assessment policy up-to-date. PortWise Traffic Recording - PortWise Traffic Recording enables you to record any transaction made between a user and the target system to allow for fine grained traceability. Any command, operation or transaction between a user and a Telnet or SSH backend server can be logged for regulatory compliance and corporate governance. PortWise Traffic Recording helps corporate IT to monitor data transactions made to the application server to maintain data integrity. Contextual Session Control - The growing adoption of intranet security domains calls for a new view on session timeouts that takes into consideration users connecting in different contexts, such as from where the user connects i.e. the user s assigned desktop or a guest client. Microsoft Outlook Anywhere With PortWise 4.7, users can now securely synchronize their Microsoft Outlook , calendar and contacts to their PCs and handheld devices, without installing or downloading any proprietary VPN client software. The unique device-lock mechanism in PortWise provides an additional layer of security in combination with user authentication. Microsoft Windows Vista 64 bit - The PortWise Access Client is now compatible with the 64-bit version of Windows Vista. PortWise 4.7 Unique Selling Points Comprehensive Identity and Access Management (IAM) Platform Unified identity and access management with integrated access control and user authentication allows an organization to consolidate IT security into 4

5 one single solution, enabling centralized administration, cost efficient operations and comprehensive logging and audit capabilities. Low-cost and Scalable Two-Factor Authentication Using existing hardware devices for delivering strong one-time passwords drastically lowers TCO for strong user authentication. No special purpose security devices need to be purchased and distributed. User enrolment and soft token distribution in PortWise may be automated, allowing cost efficient large-scale deployments. Concurrent user license for two-factor authentication Concurrent 2 factor authentication gives organizations with a large number of infrequent users the possibility to enforce strong user authentication at a reasonable cost. PortWise offers a unique licensing model where the customer can deploy software based strong 2-factor authentication to an unlimited number of users and only pay for concurrent authentications. Note: This license model is available only when using PortWise both for remote access and strong user authentication. All Application Support Client/server, web-based, VoIP, Terminal Server, Mainframe, online collaboration tools, and file servers. Central Auditing and Reporting In-depth insight into operational activities with real-time and historical reports enabling organisations to comply with the new stringent laws around user information and access. Integrated Single Sign-On to backend applications Increase the end-user experience by enabling single sign-on functionality in the PortWise Access Manager. SSO increases the organizations overall security as the users do not have to remember multiple logon credentials (resulting in users storing them locally at their workstation, or choosing passwords with low complexity). SSO does also decrease the load for helpdesk administrators, caused by password resets and locked user accounts. Scalable Enterprise Architecture The PortWise architecture allows customers to scale from 50 to millions of users. The Solution is based on software and utilizes built-in clustering features for seamless scaling and failover, at no additional cost. Entry-to-Exit Security Protect users from entry-to-exit with client assessment, strong user authentication, access authorization, data encryption through SSL VPN, and abolishment. Qualifying Questions How do you ensure your partners and customers are secure when doing business with your organization? Can your employees work from any location using any device securely? Can you control which devices are getting access to your applications and data? Are you thinking about using mass two-factor authentication, but worried about costs and usability? Do you already have an IPSEC or SSL VPN strategy in place, but looking to add strong authentication that integrates easily with your current infrastructure? 5

6 Have you thought about the damage, monetary and brand-wise, a security breach would have on your business? What are you doing to make your customers trust doing business with you, as 45% stated they are willing to switch to another company if they offer more security. Are you looking to consolidate your security products to ease administration and lower costs? How do you audit your users activities? Have you recently acquired another company and need to give access to shared systems? Are you required to exchange sensitive information with your business partners and suppliers? Are your users complaining about having to manage multiple sets of user credentials? Objection Handling Statement: The PortWise solution seems expensive Answer: PortWise offers one of the most cost-effective solutions in the market, and offers a very comprehensive set of security features. With PortWise you get a solution that protects your organization and your users from entry-to-exit. You have to weigh the cost of the solution against not having any security in place, and what that would mean to your organization s brand, revenue, and reputation if a security breach occurred. Most SSL VPN competitors offer only a fraction of the functionality provided in the PortWise platform. Vital security features, such as strong user authentication, application single sign-on, and end-point security, are usually provided by multiple products from different vendors. With the PortWise platform, a customer gets all that functionality, plus more, in one comprehensive, integrated and scalable solution. Statement: We don t need two-factor authentication, as we already have a firewall and VPN Answer: A firewall and VPN are two essential components for managing access, but you still don t know if people really are who they say they are. Two-factor authentication, where the user has to carry a unique item, can guarantee that you correctly identify who is accessing your information. Statement: Two-factor authentication is expensive! Answer: This is not true if you use PortWise as we use something the user already has, such as a mobile phone, PDA, or BlackBerry to generate or receive one-time passwords. With other vendors, such as RSA and SecureComputing, every user has to carry a piece of hardware that is expensive to make, deploy and manage. With PortWise concurrent authentication, you only pay for the amount of users actually using the system. Statement: Is SMS/text message a reliable method to distribute passwords? Answer: According to Mediaburst, 99.3% of all text messages are delivered within 60 seconds, with 99% being delivered within 20 seconds. Less than 1 in 1,000 get delivered due to wrong number, phone not in use, or lack of coverage. Statement: My company already has a policy for passwords, why would I need to use two-factor authentication? Answer: Research has shown that any one-factor password can be cracked in less than 13 seconds. Twofactor authentication is hacker-proof as the user needs to know a password and carry an OTP generating device with them, such as a mobile phone. Even if companies have good password policies for one system there are no users willing to have large complicated passwords for several systems. PortWise allows 6

7 companies to streamline their access with single-sign on capabilities thus giving their users more functionality with much better usability and security. Competitive Advantages PortWise Focus and Core Knowledge PortWise has always been a security company, and still is. PortWise has a mature product and proven track record since 1997 with more than 800 customers and 6 million users worldwide. Significant Cost Savings The PortWise solution offers a low TCO as an organization may consolidate all its user identification and remote access to one solution. Secure remote access requirements for corporate employees, business partners and end customers can be handled from a single platform with one administrative interface. Furthermore, the concurrent user license model for PortWise 2-factor authentication enables customers to deploy strong user authentication across the whole enterprise, including business partners and endcustomers, and only pay for concurrent authentications (Applies to customers using a concurrent license for PortWise access). Strong End User Focus The PortWise solution is built with the end user in mind and is optimized for ease of use and convenience. With clientless, on-demand application access, a user may securely connect to any application from any device. The unique mobile two-factor authentication technology also means quick roll-out and high adoption. Enterprise Management The PortWise platform is designed to manage any size environment and can scale easily to accommodate millions of users. Delegated management allows larger organizations to have multiple administrators and roles administrating different parts of the platform. Architecture & Deployment By having an end-to-end solution PortWise enables organizations to get to market quicker with their applications, while delivering great scalability and security. The PortWise solution is not limited to certain hardware and can be replicated an unlimited number of times at no additional cost. Built for Maximum Security The PortWise platform covers all aspects of identity and access management, providing comprehensive technologies for controlling who has access to what. Rich and Integrated Security Feature-Set With one solution providing many security features, such as SSL VPN access, user authentication, end-point security and single sign-on, an organization may lower its overhead for system administration, streamline its deployment process, and benefit from the comprehensive and consolidated audit and tracing capabilities. The solution gets more cost effective, easier to deploy and manage, and more secure. 7

8 Pricing and licensing PortWise Access Manager PortWise Access Manager is licensed either per concurrent user or per named user, with an option to buy a site license for local government customers. A customer pays only for the number of users, all required server software is included in the end-user license. PortWise Access Manager is available with a standard features set (PortWise Access Manager Standard Edition) that can be extended with additional licensed functionality, as described below. PortWise Access Manager Standard Edition SSL VPN Remote Access Clientless SSL VPN access to applications and networks for an unlimited number of applications, including SSL reverse proxy for web based applications and VPN tunnelling for client/server based applications. Role-based Access Control Provides a granular access control to applications and information that dynamically adapts to the user s role, the security of the user s workspace and the sensitivity of the information. Web based Application portal For user friendly access to remote applications and services. Authentication PKI Support for user certificate authentication. Authentication External Support for 15 external authentication providers. Audit and Graphical reporting To help organizations meet compliance regulations, such as ISO1771, Sarbanes-Oxley, Basel II and Gramm-Leach-Bliley HIPPA. Scalability Load Balancing Built-in load balancing features for large scale and cross-regional deployments. Any number of servers may be deployed in your PortWise network. High Availability Clustering Advanced clustering allows for redundancy and hot failover options. Administration Delegated Administration Allows an organization to create administrative roles with limited privileges to shift administrative rights from one organizational department to another. Administration Alerts handling Event based alerts can be triggered in real-time to provide proactive awareness and support. PortWise Access Manager License Options Advanced VPN Access IP address allocation to client device Allows for bi-directional communication and server-side initiated communications to support applications like VoIP and other online collaboration tools, software package distribution systems, and remote assistant. (for Windows XP and Windows Vista clients only) 8

9 End-Point Security Client Device Assessment Real-time client scan to confirm the user s device confirms to corporate security policies before allowed access to internal applications. (for Windows XP and Windows Vista clients only) Windows Security Center Integration EPS plugin that integrates with the Windows Security Center framework for device examination. Session Cleanup Removal of session information from user s device on completion of the session, including deletion of cookies, URL history, web cache and downloaded files and components. Client Firewall On-demand client firewall protection to secure the end-point during the session. Identity Federation SAML 2.0 and ADFS Provides an infrastructure that enables identities and their relevant entitlements to be propagated across administrative domains, for inter-domain single sign-on and user authentication. PortWise e-id Support for national electronic-id Allows strong user authentication to national e-services for citizens using their electronic-id. All issuers of e-id are supported. Application Single Sign-On Transparent authentication to backend applications for Single Sign-On Support for web applications and client/server based applications. Refer to PortWise documentation for a list of supported applications. Automated propagation of user credentials Using automatic learning mechanisms or the PortWise SOA architecture. Ticket based SSO Ticket based authentication using web services (SOAP) for single sign-on to web applications. PortWise Mobile Office RPC over SSL Support for Microsoft RPC/HTTPS enables users to securely synchronize their Microsoft Outlook clients and ActiveSync enabled mobile devices directly without the need for a VPN client at the endpoint. Mobile Device Lock Prevents lost or stolen mobile devices to connect to the exchange infrastructure. PortWise TruID PortWise TruID is licensed in two parts: A base license and a separate license for the PortWise authentication method(s). PortWise TruID is licensed per named user or per concurrent user with an option to buy a site license for local government customers. Note: The concurrent user license model is available for customers using a concurrent user license for PortWise Access. PortWise TruID Base System PortWise TruID Server Software Available for Linux and Windows Server operating systems. 9

10 Authentication RADIUS RADIUS interface to provide strong user authentication using any of the PortWise TruID authentication methods. Authentication methods are licensed separately, see below. Authentication OATH Support for OATH enables an organization to deploy strong user authentication based on any hardware- or software based OATH compliant security token. Scalability Load Balancing Built-in load balancing features for large scale and cross-regional deployments. Any number of servers may be deployed in your PortWise solution. Administration Delegated Administration Allows an organization to create administrative roles with limited privileges to shift administrative rights from one organizational department to another. Administration Alerts handling Event based alerts can be triggered in real-time to provide proactive awareness and support. PortWise SOA For automated user account management, using a SOAP (web services) interface. LDAP Integration Connect to any LDAP based user storage (Active Directory, Novell edirectory, IBM, SUN directory, etc) for user password and policy integration. TruID Password Authentication based on static passwords. TruID Authentication Methods (licensed separately) TruID Web A Java-based online password keypad that runs in the user's web browser, to protect user passwords from keyloggers and man-in-the-middle attacks. TruID SMS A 2-factor authentication mechanism that combines a static password with a one-time-password delivered to the user s mobile phone TruID Soft Token A JAVA based security client for generating strong one-time-passwords. The client is installed on a device that the user already has, such as a mobile phone, PC or PDA. Additional PortWise TruID License Options TruID Self Service Automatic user account management PortWise user accounts are automatically created the first time a user logs on, after proper verification of user credentials (requires LDAP user storage integration). User Self Service For external users that are not managed in the organizations user storage. User self service allows users to perform account activation and password reset, to offload the organization s helpdesk resources. TruID Soft Token Distribution Automated process for distribution and configuration of TruID Software Tokens to the end-users. 10

11 Frequently Asked Questions How is PortWise priced? Contact your PortWise reseller or sales team for more information. How is PortWise licensed and under which licensing programs? PortWise is licensed by named or concurrent user with an option for local government to buy a public site license. Is there a minimum purchase requirement? Yes, PortWise licenses have a minimum order quantity of 25 concurrent users or 50 named users per order. Additional licenses are available in any quantity. Are maintenance and updates available for PortWise? Yes, all PortWise user licenses are covered by the annual support charge of 18% of the user license fee. The support fee is charged annually in advance and includes standard support and free upgrades. Can I choose to purchase only SSL VPN access or only user authentication? Yes, you can choose to purchase access (PortWise Access Manager) or authentication (PortWise TruID) individually. What is concurrent 2-factor authentication? Concurrent 2-factor authentication is a pricing model applicable for customers who use a concurrent license for PortWise access. The concurrent 2-factor authentication license model enables the customer to distribute PortWise strong authentication to an unlimited amount of potential users, and only pay for concurrent users. How do customers obtain evaluation licenses? Evaluation licenses are designed for use by customers who are piloting a PortWise solution. The evaluation license contains the same feature set as the retail product but is limited in time. The availability of evaluation licenses for PortWise varies by geography. Contact your PortWise reseller or local PortWise office for details. How are license codes delivered? For all orders, license codes are delivered via . Where are the license files deployed? The user licenses are uploaded to the PortWise Administration Service. The Administration Service takes care of distributing the license files to relevant PortWise server components. What about disaster recovery? The End User License Agreement for PortWise allows user licenses to be installed on an unlimited number of servers. Organizations are free to distribute load across multiple PortWise servers. How can I learn more about PortWise licensing? To learn more about PortWise products and licensing, please visit the PortWise website at 11

12 Upgrading from Previous PortWise Versions Customers with a valid support & maintenance contract may upgrade their PortWise system to 4.7 at no additional cost. A software upgrade includes patches, bug fixes and new features that are included in the standard/base license. New features that require additional licensing can be purchased separately. PortWise Access Manager Customers with an existing license for PortWise 4.x access and a valid support contract may upgrade to PortWise Access Manager 4.7 Standard Edition free of charge. Contact your local reseller or a PortWise representative for more information. PortWise additional features may be upgraded according to below: Advanced VPN Access Available at no cost for customers with a PortWise 4.x Access license and a valid support contract. End-Point Security - Available at no cost for customers with a PortWise 4.x EPS license and a valid support contract. Customers without an EPS license can purchase this option separately. Identity Federation - Available at no cost for customers with a PortWise 4.x Identity Federation license and a valid support contract. Customers without an Identity Federation license can purchase this option separately. PortWise e-id - Available at no cost for customers with a PortWise e-id license and a valid support contract. Customers without an e-id license can purchase this option separately. Application Single Sign-On - Available at no cost for customers with a PortWise Application SSO license and a valid support contract. SSO to web applications only is included for customers with a PortWise 4.x Access license. PortWise Mobile Office - Available at no cost for customers with a PortWise 4.x Mobile Office license and a valid support contract. Customers without a PortWise Mobile Office license can purchase this option separately. PortWise TruID Customers with an existing license for PortWise 4.x authentication and a valid support contract may upgrade to PortWise TruID 4.7 Base System free of charge. Customers that has previously purchased PortWise strong (2-factor) authentication may request licenses for all PortWise TruID authentication methods free of charge. Customers that has previously purchased PortWise 1-factor authentication may request a license for TruID Web password free of charge. Additional PortWise TruID authentication methods can be purchased separately. More information info@portwise.com Phone Sweden UK +44 (0) USA +1 (650) Asia Copyright 2009 PortWise. All rights reserved. The PortWise logo and all PortWise product names and slogans are trademarks or registered trademarks of PortWise. Other product names and/or slogans mentioned herein may be trademarks or registered trademarks of their respective companies. 12