We often bemoan the seeming immortality of username/password authentication schemes. Why can’t everyone implement strong authentication, multi-factor authentication, Secure Sockets Layer Virtual Private Networks (SSL VPN) for remote access?
We often bemoan the seeming immortality of username/password authentication schemes. Why can’t everyone implement strong authentication, multifactor authentication, Secure Sockets Layer Virtual Private Networks (SSL VPN) for remote access?
The answer is really quite simple: Doing those things is too expensive — the actual cost of the software and/or hardware, the ongoing maintenance, and support and the “human capital” cost in terms of educating and training users who only want quick and easy access to their data.
Well, RSA believes they have the answer. That’s “RSA, The Security Division of EMC,” of course (and why is EMC so afraid we’ll forget that?). We’ll just call them “RSA” — you’ll know who I mean.
The company has released RSA Authentication Manager Express (RSA AME), specifically targeted at small to midsize companies looking for stronger authentication without having to mount an extensive campaign to proselytize their users. It just might work.
RSA AME is used specifically to protect SSL VPNs and Web portals against unauthorized access. The system employs an intelligent risk engine designed to provide invisible, behind-the-scenes protection of Web-based resources against unauthorized access. Users continue to employ their standard username and password. Security is stepped up when the risk engine detects abnormal behavior, requiring users to correctly answer personal challenge questions and/or enter SMS — or e-mail-delivered one-time pass codes before access is granted. This technology delivers, according to RSA, authentication tailored to the security, cost and convenience requirements of smaller organizations.
And it is only for smaller organizations as it has an upper limit of 2,500 user accounts. RSA claims that this is an easy way for organizations — including those that have never deployed multifactor authentication in their environments — to implement a stronger and more secure alternative to password-only protection within a solution that is easily installed and requires near-zero ongoing management. Among the other benefits touted for Authentication Manager Express:
• Proven technology that can be tailored to an organization’s resource constraints, risk tolerance, and the profile of its users.
• Layered approach for added strength of security; is invisible to end-users unless authentication is outside of established policy.
• Nothing for end-users to manage making it ideal for employee, partner and client/customer use cases. Seamless integration with leading SSL VPNs and Web servers requiring minimal IT resources.
• Audit capabilities help organizations track what users are accessing to meet changing compliance regulations; canned reports help simplify proving compliance.
If this sounds like it could be the answer to your remote access problems, check with your friendly neighborhood RSA Security vendor.
