As more companies begin to rely on Web-based applications, questions arise about the security of such applications. One weak link in the security chain is user authentication. User IDs and passwords are insufficient to protect your business from unauthorized access. This article describes a Web-based service that provides multi-factor authentication for applications in the cloud.
In October 2009, Gartner analysts identified cloud computing as one of the top 10 strategic technologies for 2010. That probably wasn’t a difficult prediction to make, as more and more companies are deploying software-as-a-service (SaaS) applications to run their business. Salesforce.com and Google Apps might be among the most prominent SaaS applications, but there are hundreds, if not thousands, of applications that can be run from the cloud, and your business is likely to adopt at least a few of them.
Security in the cloud
As more companies use the SaaS model for their core applications, questions arise about application security and the risks to business data in Web-based applications. Reputable SaaS vendors are going to protect your data in their applications — unless, of course, they don’t want to stay in business for long.
However, there is one security concern that is often a weak link for Web-based applications, and that’s user authentication. If a user — legitimate or otherwise — presents the right credentials to the application, he can usually get right in. The application doesn’t know that the login ID and password were surreptitiously stolen with a keystroke logger, or phished via a social engineering scam, or used by an ex-employee who was fired last week. There are just too many scenarios that make a user ID and password insufficient protection for access to Web apps.
To address this weak link, a company with years of experience in multi-factor authentication, TriCipher, offers a Web single sign-on (SSO) service that provides strong authentication to Web-based applications. The service, called myOneLogin Secure Single Sign-On, is an on-demand service that can be implemented quickly without installing any hardware or software, affecting your infrastructure, or requiring changes to the applications themselves. The service works with hundreds of Web-based applications from numerous vendors, or even your own in-house developed Web apps.
When you subscribe to the service, your company is assigned a specific myOneLogin Strong Authentication URL, which you can brand with your company logo or integrate into your own login page. The first user account you create has administrative privileges so that you can add additional users. You can add them manually; send TriCipher a batch file with user names; or integrate myOneLogin with your own internal directory.
After the users are added, you can set up their applications on the myOneLogin Strong Authentication Web portal, or let them add their own preferred applications. To access their applications, users must go through this authentication portal, which requires multi-part credentials. So, even if the user ID and password are stolen or used inappropriately, a person cannot log in to an application without the additional credential.
MyOneLogin offers multiple security levels, including browser cookies, certificates and/or mutual SSL. You can deploy the level(s) that make the most sense for your applications. These second authentication factors use split-key technology, whereby one part of the credential resides on the user’s computer, and another part is within a secure vault that’s part of the myOneLogin service. Both factors are necessary to authenticate with myOneLogin.
MyOneLogin supports other authentication methods as well, including one-time passwords generated on mobile phones for mobile workers, and other VeriSign VIP tokens.
Whether you use TriCipher’s authentication solution or another, here are some best practices that should help you protect access to Web applications. These tips are summarized, but the full details can be found here.
* Replace multiple logins with one login. When users have to create and remember multiple logins, they tend to choose over-simplified logins that they can remember; write down their logins because they can’t remember; or forget their logins and request reset support far too often. By providing a single sign-on for all applications, the user only has one login ID and password to remember.
* Stop handing out passwords to applications. Once you have a SSO solution in place, have everyone authenticate to that site instead of directly to your business applications. This gives you better control over who has access.
* Protect access with strong authentication. Use multiple factors to authenticate users to your applications. The old routine of “something you know plus something you have” greatly reduces the likelihood of access abuse.
* Ask your application vendors for federation support. In this case, federation is the process of creating a trusted relationship between the application and the SSO site using certificates. When a user authenticates securely to the SSO site and then wants to access a Web application, the SSO site would use federation calls rather than accounts and passwords to authenticate the user.
* Track and monitor who has access to your applications. By having your users connect to applications through an SSO site, you have more visibility into when and where access to specific applications takes place. This increased visibility is helpful for compliance reporting and to reduce spending by reclaiming unneeded accounts.
