Whitepaper MODERN THREATS DRIVE DEMAND FOR NEW GENERATION MULTI-FACTOR AUTHENTICATION A SURVEY SHOWS THAT 90% OF ALL COMPANIES HAD BEEN BREACHED IN THE LAST 12 MONTHS. THIS PAIRED WITH THE FACT THAT THREATS LIKE ZEUS AND HACKING HAVE COMPROMISED THE MORE THAN 20 YEAR OLD TWO-FACTOR AUTHENTICATION TOKEN, CREATES THE CASE FOR A NEW GENERATION OF MORE SECURE REAL-TIME MULTI-FACTOR AUTHENTICATION SOLUTIONS.
MODERN THREATS DRIVE DEMAND FOR NEW GENERATION MULTI-FACTOR AUTHENTICATION INTRODUCTION The use of online services has exploded in the last decade as remote access has become a default way to access enterprise systems and to conduct business. Initially designed for employee access, today remote access is an integral component of the way we live and work for employees and consumers alike. With the development of this pervasive use of online access to conduct business, the threat of identity theft has increased with a speed and complexity not seen before. According to some researchers, online identity theft schemes will surpass all other forms of financial crime within just a few years. Clearly attacks against companies like Adobe, New York Times, Citibank, Lockheed Martin, and Sony gives a clear illustration of how criminals are targeting both employee and consumer identity theft. A survey of more than 500 corporations by Ponemon Research revealed that 90% had been successfully hacked in the last 12 months. This research demonstrates the need for all corporations to adopt two-factor authentication as a means to protect against breaches. Consequently, modern mobile phone based multi-factor authen tication is in high demand. SMS PASSCODE is the leading technology in this fast growing space, delivering protection of online identities in a highly secure and convenient way. Ponemon Research, 2011. Source: http://www.ponemon.org
NEED FOR MODERN MULTI- FACTOR AUTHENTICATION THE BASICS OF HACKING Just as the remote access industry has evolved, so have the threats and their complexity. Back in the early days when only user name and password were used, hackers simply used brute force user name and password guessing or dictionary attacks to assume a user s identity. This is essentially a computer or a hacker that simply continues various combinations of the password until success is achieved. As systems became immune to this method by blocking the account after a few faulty attempts, new techniques such as key loggers were invented. A key logger is a piece of software running as a background service that captures a user s key strokes during login and sends it back to the source of the attack. Today the most widely used attacks are pharming and phishing or a combination of the two. This is a technology and method by which a user is led to a fake website that is identical to the original. This tricks the user into entering their user name and password. Once the credentials have been captured, the user is often presented with a down for maintenance message or something similar to buy the hacker some time. Some of the more advanced attacks send the information via a small instant message program in real time to the hacker essentially compromising the widely adopted two- factor authentication tokens. One such example, Zeus malware, captures a user s credentials including the most advanced time based token codes and sends the information to the hacker. Therefore, in today s IT landscape even the most secure traditional two- factor authentication token devices can no longer ensure the identity of a user. The fact that so many organizations are unaware that traditional tokens can be compromised poses a significant security risk. Recently, newer more sophisticated methods of intercepting a user s interaction with a given system have emerged such as man- in- the- browser, man- in- the- middle and session hijacking. Common to these threats is that as the threat- technology matures and becomes mainstream, the adoption of that technology grows exponentially. These sophisticated schemes are still less common and far overshadowed by phishing and pharming attacks. Figure 1) It has become a never ending cat- and- mouse game, where the industry continues to try and outpace the criminals. For corporations offering business services, the trade- off between the threat risk level and the costs and investments required to protect against them is a continuous process.
NEED FOR MODERN MULTI- FACTOR AUTHENTICATION NEED FOR MODERN MULTI- FACTOR AUTHENTICATION MODERN THREATS DRIVE DEMAND FOR NEW GENERATION MULTI-FACTOR AUTHENTICATION THE RIGHT LEVEL OF PROTECTION THE As RIGHT the complexity LEVEL OF of PROTECTION the access protection increases, As so the does complexity the complexity of the access of the protection threats. This increases, is a never- so ending does the battle complexity where of organizations the threats. constantly This is a never- need to ending evaluate battle what where is the organizations right level of constantly investment need and to evaluate protection what is for the the right business. level of Often, investment the best and possible protection for is out the of business. reach for Often, many the organizations best possible and protection thus a trade- off is out of has reach to be for made. many organizations and thus a trade- off has to be made. To protect against these employee and customer To identity protect against theft schemes these employee within budgetary and customer constraints, identity organizations theft schemes have embarked within budgetary on different constraints, technologies organizations such as certificates, have embarked biometric on scanning, different technologies identity cards such and as hard- certificates, and software biometric tokens, scanning, with the identity latter cards being and the hard- most and dominant software technology. tokens, with the latter being the most dominant technology. Certificates are often viewed as the ideal solution Certificates connecting are two often devices viewed with as a the secure ideal identifiable solution connecting connection. two The devices main with issue a is secure the deployment identifiable and connection. administration The main of these issue certificates is the deployment and the and risks that administration these are copied of these without certificates the user and knowing the risks it. Biometric that these scanning are copied is also without viewed the as a user very knowing secure alternative. it. Biometric scanning However, is also the viewed assumption a very that secure you always alternative. have a However, functioning the assumption finger or iris that scanner you always handy has have proven a functioning impractical finger plus or the iris fact scanner that the handy scan has represents proven a impractical digital file plus that the can fact be that compromised. the scan represents a digital file that can be compromised. Identity cards have also been viewed as a good solution Identity but like cards the have biometric also been scanners, viewed it has a proven good solution to be but impractical, like the biometric especially scanners, in a world it has that proven calls for to be Bring impractical, Your Own especially Device, consequently in a world that where calls users for Bring demand Your access Own from Device, an ever consequently changing where variety users of devices.. demand access from an ever changing variety of devices.. This leaves the field to two- factor authentication This tokens. leaves Two- factor the field to authentication two- factor authentication means that a login tokens. uses two Two- factor factors, authentication something you means know: that the user a login name uses and two password, factors, something and something you know: you have: the user a "hardware name and token" password, (a small and device something with a you display have: where a "hardware a code is token" shown) (a small or a soft device token with a app display (a program where a installed code is on a shown) mobile or phone a soft showing token app a code (a program on the phone s installed display). on a mobile This code phone is showing entered a along code with on the user phone s name and display). This password code is entered to gain access. along with user name and password to gain access. This is a more complicated protection mechanism with This an is administrative a more complicated burden protection and for the mechanism software token with an with administrative limited phone burden brand and support. for the software The assumption token is with that limited the token phone protects brand support. users against The assumption phishing and is the that likes the easier token than protects any of users the against alternatives phishing above. and the likes easier than any of the alternatives above. In reality however, the token approach, which may In reality have been however, seen as the providing token approach, the best which protection may with have the been highest seen ROI as in providing the past, the have best been protection cumbersome with to the administer highest ROI and in the have past, now have been been surpassed cumbersome by malware to administer such as the and Zeus. have Zeus now and been the surpassed likes can by do malware this as they such take as advantage the Zeus. Zeus of the and weakness the likes that can do a user this enters as they the take code advantage together of with the weakness user name that and a password. user enters the code Furthermore, together with a simple user name web search and password. will provide "cook- Furthermore, books" on methods a simple web for compromising search will provide token- based "cook- books" security on methods systems. for This compromising family of solutions token- based is called Pre- security issued systems. passcode This based family solutions of solutions and have is called the Pre- same issued weakness. passcode Moreover, based solutions this is regardless and have of all whether same the weakness. passcode Moreover, is delivered this via is a regardless hardware- of or whether software the token passcode or even is if delivered it is shipped via a using hardware- an SMS. or A software new more token or even secure if approach it is shipped is needed. using an SMS. A new more secure approach is needed. Figure 2) as illustrated above, the number of attacks Figure decline 2) as dramatically illustrated above, as the the access number system of complexity attacks and decline protection dramatically mechanism as the grows. access However, system complexity protection and protection against the mechanism modern threats grows. However, results in exponentially protection against growing the costs. modern With threats a real- time results multi- factor in exponentially growing authentication costs. With solution a real- time based multi- factor on SMS, this trend is authentication broken as the solution costs are based driven on down SMS, this while trend at the is same broken time as the the security costs are increases. driven down This is while driven at by the the same global time adoption the security of the increases. mobile phone This is that driven eliminates by the global the need to adoption manage of physical the mobile user phone devices. that The eliminates new generation the need of to real- manage time multi- factor physical user authentication devices. The new solutions generation based of on real- SMS time provides multi- factor a higher authentication level of protection solutions at a based lower on cost SMS than provides the comparable a higher level alternatives. of protection at a lower cost than the comparable alternatives.
NEED FOR MODERN MULTI- FACTOR AUTHENTICATION NEED FOR MODERN MULTI- FACTOR AUTHENTICATION DIFFERENT APPROACHES - DIFFERENT OUTCOMES To DIFFERENT address the APPROACHES demand for - DIFFERENT more security OUTCOMES and to be able To address to address the demand the modern for more threats, security while and meeting to be the able users to need address for easier the modern and more threats, flexible while solutions, meeting a the new generation users need for of multi- factor easier and more authentication flexible solutions, based on a the new generation mobile networks of multi- factor has emerged. authentication based on the mobile networks has emerged. The main driver for this new generation of solutions is The that main many driver organizations, for this new including generation organizations of solutions who is traditionally that many organizations, did not focus including on a high organizations level of security, who now traditionally due to the did present not focus threat on a landscape high level of need security, increased now due to security the present and that threat is without landscape having need to take on the increased cost and security administrative and that is burden without of having maintaining to take on hard- the cost or and software administrative based tokens. burden Additionally of maintaining the hard- present or threat software landscape based tokens. now includes Additionally many the tools that present compromises threat the landscape traditional now solutions. includes Consequently, many tools that the compromises ability to have the traditional a device that solutions. is connected Consequently, in real time the ability and at to the have same a device time is that unique is connected to that particular in real time individual and at all the over same the time world. is unique To truly to take that advantage particular of this, individual the solution all over needs the world. to operate To truly in take real- time advantage of generating this, the solution the code needs for to a particular operate in login real- time session and not generating on a valid the until code for time a particular or Valid until login used session basis. and As a not matter on a valid of fact, until most time of the or current Valid until sms used based basis. As solutions a matter of have fact, been most implemented of the current so sms they based fundamentally solutions have been work implemented like a token where so they the code is valid fundamentally for a period of time work or like until a token used where and not the specific code is to valid the login for a period session. of The time only or until real difference used and not being specific that the to the login code is session. passed The to the only user real via difference a mobile being phone that display the via code SMS. is passed Thus it to is the still user a code via valid a mobile for a phone period display of time via and SMS. therefore Thus it is can still be a compromised code valid for just a period like a of regular time token. and therefore The notion it can that be you compromised have a token just code like a that regular is pre- calculated token. The notion or known that you in have advance a token and not code created that is in real- time pre- calculated was the or known reason in behind advance the and attacks not created against the in real- time leading token was technology the reason behind the world. the attacks against the leading token technology in the world. Thus a regular token via SMS is not necessarily safeguarding Thus a regular against token via the SMS modern is not threats. necessarily To do so, a new safeguarding generation against modernized the modern approach threats. needs To do to be so, a designed new generation to operate modernized efficiently approach in a message needs based to be environment designed to operate like the efficiently mobile networks in a message and it based must be built environment a set like of key the parameters: mobile networks and it must be built on a set of key parameters: Increased Security: The solution must leverage the network Increased connected Security: benefits The solution providing must the leverage ability to the tie the network login connected identity to benefits a personalized providing unique the ability device to the tie phone the login and identity to send to a personalized code to that unique device that device is tied the to phone the specific and to user send login a code attempt to that (also device known that as is login tied session). to the specific Hence user preventing login attempt the code (also from known being as easily login session). Hence preventing the code from being easily compromised by even simple phishing like it is the case with compromised tokens or by any even pre- issued simple phishing passcode like based it is the case with solutions. tokens or any pre- issued passcode based solutions. Easy infrastructure: To ease the burden on the ever increasing Easy infrastructure: To complexity, ease the burden the solution on the ever must automatically increasing infrastructure plug into the complexity, different login the solution scenarios must such automatically as Citrix, plug VMware, into the Cisco, different Microsoft, login SSL scenarios VPNs, IPsec such as VPNs Citrix, and VMware, web logins Cisco, and Microsoft, provide these SSL VPNs, logins in an IPsec integrated, VPNs and session web logins based and architecture. provide these logins in an integrated, session based architecture. Fault tolerance: As the system moves to a real- time delivery Fault tolerance: of the code, As the architecture system moves needs to a to real- time be robust delivery and of the redundant code, the on architecture the server side needs as well to be as supporting robust and multiple redundant delivery on the mechanism server side regardless as well as of geographic supporting multiple location. delivery Furthermore, mechanism this needs regardless to be of supported geographic for location. both small/midsize Furthermore, companies this needs as to well be as large supported enterprises. for both small/midsize companies as well as large enterprises. Management: It must be installed and managed easily Management: within the existing It must be user installed management and managed infrastructure. easily within the existing user management infrastructure. 2011 was the year of catastrophic hacks. 2011 was the year of catastrophic hacks.
MODERN NEED THREATS FOR DRIVE MODERN DEMAND FOR MULTI- FACTOR NEW GENERATION MULTI-FACTOR AUTHENTICATION RECOGNIZED TECHNOLOGY LEADER The SMS PASSCODE solution delivers a new generation of login security based on multi- factor authentication via the mobile phone SMS network. To successfully protect an employee or consumer account from being accessed using these new advanced identity theft schemes, SMS PASSCODE can use multiple factors; ex. something you know (a user name and password), and something you have (a mobile phone), and even the specific session the users is logging on from. SMS PASSCODE can also use the network the user is logging in from and even the country as a factor. Therefore SMS PASSCODE can create a security policy that only allows logins from certain users, accessing from certain countries, which radically limits the hacker s possibilities to compromise the login systems. Essentially, a user first enters the user name and password. Once this is validated, the solution generates and sends in real- time a one- time passcode to the user s mobile phone via SMS, voice call or via a secure e- mail. The passcode has to match up against the initial login attempt, as it is only valid for that particular login session. This is also referred to as a "session specific code". This subtle, yet dramatically different approach makes SMS PASSCODE a more secure new generation solution designed for today s threat landscape. Plug- and- Play integration: SMS PASSCODE installs in a very simple and fast process and protect all the major login scenarios like Citrix, VMware, Cisco, SSL VPNs, IPsec, VPNs, Outlook Web Access, and other Cloud based systems. The Installation process even handles Active Directory integration with a single click, as it requires no changes to the Active Directory. Maximum scalability and reliability: SMS PASSCODE uses the same solution to implement a 5 user instal- lation and a 50,000 user installation. The architecture is built from the ground up to be fault tolerant and scalable as all components are coupled in a message based framework. High flexibility: SMS PASSCODE s unique policy driven engine can handle many diverse needs from individuals to groups, making the solution very user friendly even if the organization has many different kinds of needs. Lower costs: SMS PASSCODE delivers this higher level of security at a lower cost than any alternative solution, and with higher user convenience. It is the combination of a new generation more secure solution that is easy to implement at much lower costs even in complex environments that has paved the way for the significant user adoption of SMS PASSCODE. SMS PASSCODE offers a number of major advantages compared with other SMS based solutions, software and hardware tokens alike as it provides a more secure and intuitive login process, plug- and- play integration, and highly scalable and fault tolerant implementation. More secure login process: SMS PASSCODE represents a new level of security with session based and location aware login security, where the one- time passcode is tied to and generated based upon a successful user challenge validation (name and password match) and where the SMS code can contain location information notifying a user of a potential advanced hacker attack. Figure 3) SMS PASSCODE offers a number of major advantages compared with other SMS based solutions, software and hardware tokens alike as it provides a more secure and intuitive login process, plug- and- play integration, and highly flexible, scalable and fault tolerant implementation.
NEED FOR MODERN MULTI- FACTOR AUTHENTICATION NEED FOR MODERN MULTI- FACTOR AUTHENTICATION SUMMARY SUMMARY The threats on the internet have rapidly surpassed the The current threats defenses. on the The internet result have is that rapidly identity surpassed theft by the current some is defenses. said to be The the most result profitable is that identity financial theft crime by some today. is To said protect to be against the most this, profitable many companies financial crime have today. relied on To the protect more against than 20 this, year many old token companies two- factor have authentication relied more technology. than 20 year However, old token malware two- factor like Zeus authentication or even simple technology. phishing has However, successfully malware developed like Zeus threats or even that simple can phishing capture has token successfully codes and developed compromise threats the user that account. can capture token codes and compromise the user account. Protection against this new generation of threats calls Protection for a new generation against this multi- factor new generation authentication of threats calls for solution. a new In generation essence a multi- factor solution that authentication can deliver a session solution. and location In essence specific a code solution to the that users can mobile deliver phone a session in and real- time, location ensuring specific that code the to code the users is generated mobile phone in real- time, subsequent ensuring to a user that name the and code password is generated challenge, after subsequent which the to a code user is name entered and to password complete challenge, a closed after loop login which process. the code is entered to complete a closed loop login process. The benefits of using a real- time network connected solution The benefits are many of using including a real- time increased network security, connected ease of solution user adoption, are many and including lower costs. increased SMS PASSCODE security, ease has of user been adoption, recognized and by lower major costs. industry SMS illuminators PASSCODE like has Red been Herring, recognized Secure Computing by major industry Magazine illuminators and Info Security like Red Herring, Magazine Secure as the Computing technology Magazine leader and this new Info Security Magazine generation as of the network technology connected leader solutions. in this new generation of network connected solutions. To learn more, and to take a "test drive", please visit: www.smspasscode.com. To learn more, and to take a "test drive", please visit: www.smspasscode.com. About SMS PASSCODE About SMS PASSCODE SMS PASSCODE is the leading technology in multi- SMS factor PASSCODE authentication is using leading your technology mobile phone. in multi- To factor protect authentication against rise using internet your mobile based phone. identity To theft protect hitting both against consumers the rise in and internet corporate based employees, identity theft SMS hitting PASSCODE both offers consumers a stronger and corporate authentication employees, via the SMS PASSCODE mobile phone offers SMS a stronger service compared authentication to traditional via the mobile alternatives. phone SMS service compared to traditional alternatives. SMS PASSCODE installs in minutes and is much easier SMS to implement PASSCODE and installs administer minutes with and the added is much benefit easier to that implement users find and it an administer intuitively with smart the way added to gain benefit better that protection. users find The it solution an intuitively offers smart out- of- the- box way to gain better protection. of The the solution standard offers login out- of- the- box systems such as Citrix, protection Cisco, Microsoft, of the Juniper, standard VMWare login systems and other such IPsec as Citrix, and Cisco, SSL VPN Microsoft, systems Juniper, as well as VMWare websites. and Installed other IPsec at and SSL thousands VPN systems of sites, as this well is as a proven websites. patent Installed pending at thousands technology. of sites, this is a proven patent pending technology. SMS PASSCODE has been awarded twice with the SMS prestigious PASSCODE Red Herring has been 100 awarded most interesting twice with tech the prestigious companies list, Red Gartner Herring Group 100 most Magic interesting Quadrant tech in User companies Authentication, list, Gartner a Secure Group Computing Magic Magazine Quadrant Top in User 5 Authentication, Security Innovator, a Secure InfoSecurity Computing Guide Magazine Best two- factor Top 5 Security authentication, Innovator, a Citrix InfoSecurity Solution Guide of the Best Year two- factor Finalist, authentication, White Bull top 30 a Citrix EMEA Solution companies, of the a Year Gazelle Finalist, 2010 White and 2011, Bull 2012 top 30 Fast EMEA Growth companies, firm and a Gazelle ComOn 2010 most and promising 2011, 2012 IT company Fast Growth Award. firm and a ComOn most promising IT company Award. www.smspasscode.com www.smspasscode.com
www.smspasscode.com