VPN Solutions FAQ North America International Germany Benelux France Spain Israel Asia Pacific Japan

Transcription

1 A l a d d i n. c o m / e T o k e n VPN Solutions FAQ

2 VPN authentication is a critical link in the chain of trust for remote access to your organization. Compromising that trust can expose your private assets, disrupt activities and damage your business. Password-based authentication is simply not enough: it is not secure and is costly to manage. etoken eliminates this risk by strongly authenticating users and simplifying the user experience. Aladdin is happy to provide you with all the information you need in order to implement strong user authentication within your VPN system. Table of Contents Why are passwords and soft certificates not enough? 3 Why use etoken with your VPN solution? 3 What VPN authentication options are generally available? 4 How can I use etoken with my VPN? 4 How can I manage and deploy my etokens? 5 Why is TMS any different? 5 Do I need software installed on the user desktop? 6 How do I install software on the user desktop? 6 What do I do if a user forgets the Token PIN? 6 Which etoken devices can I use? 7 What other security solutions does etoken support? 7 2 etoken VPN - FAQ

3 1 Why are passwords and soft certificates not enough? Passwords are simply not secure! A typical person either uses common words as passwords or keeps a written record of them. 84% of users consider memorability to be most important attribute of a password. 67% of users rarely change their passwords, and 22% said they would only ever change if forced to do so. Source NTA Monitor Password Survey. Passwords can be guessed easily. Cracking tools are widely available on the Internet. Key loggers can record your password. Soft certificates and keys can be copied from your hard drive and be re-used by a hacker without your knowledge. 2 Why use etoken with your VPN solution? Allows access only to legitimate users! The Aladdin USB etoken an authentication device the size of a small key or credit card. It adds an additional security layer to the authentication process by requiring the physical presence of the etoken before allowing access. Enables network access only if a user has both an etoken and a valid PIN. With out both factors no access will be granted (2-FACTOR AUTHENTICATION). Secure, onboard PKI key generation and authentication. Private keys never leave the protected Token. Private keys and certificates are fully secure and mobile. Securely stores all your passwords. No need to remember complex passwords or write them down. All users need to do is simply insert the etoken into the USB port and enter their individual Token PIN. etoken VPN - FAQ 3

4 3 What VPN authentication options are generally available? Static Passwords, Digital Certificates, OTP Changing Passwords Static Passwords. Authentication based upon a memorized user + password manually entered by the user into the logon screen. Soft PKI keys. Authentication based upon soft PKI keys stored on your hard drive. A user will still need a PIN but it will just unlock a local file. USB Token / Smartcard. Authentication is done with PKI keys generated and stored on the Smartcard. Authentication can also be done by storing static passwords inside the token/ Smartcard. A user will still need a PIN to unlock the key inside the token. One Time Password Tokens. Authentication is done by manually typing in a One Time Password that is displayed on the screen of the token. A user will still need a PIN in addition to the OTP. 4 How can I use etoken with my VPN? With Static Passwords, Digital Certificates, OTP Changing Passwords PKI -based Authentication. etoken enables secure logon with any VPN system that supports standard certificate-based authentication (PKI). Secure Password Storage. etoken enables secure logon with most VPN systems by simply storing the user passwords inside the Token and feeding them directly into the logon screen. No need to memorize passwords or write them down. One Time Password Tokens. etoken enables secure logon with any VPN system that can authenticate using a RADIUS backend. 4 etoken VPN - FAQ

5 5 How can I manage and deploy my etokens? TMS Token Management System TMS manages all aspects of token assignment, deployment and provisioning within the organization. Built on an open standards and Active Directory, TMS enables management through simple plug-ins, centrally pushes software updates, and injects and revokes etoken credentials. Token management. Assign tokens to users, identify tokens and owners, handle lost tokens, revoke tokens. Helpdesk. Token PIN unlock. Token enrollment, and credential update and maintenance (local and remote over the web). Software deployment. Multiple application platform (plug-ins). 6 Why is TMS different? It was created for use of tokens and Smartcards in an Enterprise! Utilizes the existing organizational Active Directory (AD) framework to manage tokens. Users and tokens are managed from the same management system. NO ADDITIONAL USER REPOSITORY IS REQUIRED! Built in software deployment via Microsoft AD framework. Both the security clients and the Token drivers can be transparently installed on user PCs ready for use. Open architecture for integration with different security systems. etoken VPN - FAQ 5

6 7 Do I need software installed on the user desktop? Depends on the device! Yes - when using etoken USB connected. There is a need to install drivers and software on the PC when using the etoken via the USB port. No - when using etoken NG-OTP. There is no need to install software on the PC when using the etoken NG-OTP since the password is displayed on the device screen and manually entered into the VPN login screen. 8 How do I install software on the user desktop? You can use several techniques to install software and drivers on the user desktops Microsoft GPO. Using the Microsoft Active Directory GPO you can automatically install and update any software on user desktops. It can be the VPN client or the etoken drivers. Other software distribution solutions. Using other software distribution solutions such as SMS you can automatically install and update any software on user desktops. It can be the VPN client or the etoken drivers. Sending an link. Administrator can send an link to a network installation and ask the users to run the installation from there. Manual. Administrator can manually install software on user desktops. 9 What do I do if a user forgets the Token PIN? You can use several techniques to unlock a forgotten or lost Token PIN Administrator password. Using the token administrator password, a user PIN can be reset. This can be done using the token generic properties application. Tokens can be preconfigured with an administrator PIN. TMS web helpdesk. Using the TMS web helpdesk a user can request to unlock a token. Several authentication techniques are available to enable this. 6 etoken VPN - FAQ

7 10 Which etoken devices can I use? USB, Smartcard, Hybrid etoken PRO (USB). Is a Smartcard packaged into a USB token form factor. It offers a high level of security for strong user authentication and for storing VPN passwords. etoken PRO (Smartcard). Is a Smartcard packaged form factor. It offers a high level of security for strong user authentication and for storing VPN passwords. etoken NG-OTP. Is a hybrid USB token form factor capable of performing both Smartcard functionality and also generating a One Time Password on its display. It offers high level of security for strong user authentication, storing VPN passwords and for generating one time passwords What other security solutions does etoken support? The full spectrum of Enterprise security applications Network Logon Web Access File and Boot protection /document Encryption and Signing Digital Signing of Business Transactions Password Management For more information regarding Aladdin solutions, please refer to: etoken VPN - FAQ 7

8 For more contact information, visit: North America T: , F: International T: F: UK T: F: Germany T: F: Benelux T: F: France T: F: Spain T: F: Israel T: F: Asia Pacific T: F: Japan T: F: /2005 Aladdin Knowledge Systems, Ltd. is a registered trademark and etoken is a trademark of Aladdin Knowledge Systems Ltd. All other product names are trademarks or registered trademarks of their respective owners. Printed in Israel