* Integrating ESSO with SSPR
At last week’s Converge07 conference for Courion customers and friends I had the pleasure of sitting on a panel (well, I WAS the panel) for Courion VP of Services Nelson Ronkin’s presentation about integrating enterprise single/simplified sign-on (ESSO) with self-service password reset (SSPR). While both are identity management technologies that many organizations will want to implement, it may not be readily apparent why they would be candidates for integration.
First, let’s look at the benefits of each technology as a standalone service. ESSO can help you:
* Strengthen application security.
* Simplify user access.
* Improve regulatory compliance through stringent access control.
* Reduce help desk costs through easier access and fewer passwords for users to remember.
SSPR offers these benefits:
* Increased data security – compliance with corporate password policies.
* Facilitates more secure policies.
* Eliminates security loopholes in manual password reset procedures.
* Provides audit trails for all password reset transactions.
* Eliminates the need to grant “superuser” privileges to more staff to service password reset requests.
* Reduce cost – eliminates the leading source of all help desk calls.
* Protect user privacy- minimizes the need to share sensitive authentication information with support staff over the phone.
* Improves user productivity and service levels, cutting Mean Time To Repair (MTTR) for password resets and minimizing the number of passwords to remember.
Those are certainly all good reasons to implement these two technologies, but does combining them create additional benefits?
Here’s one scenario. You’ve got ESSO established but you know that good security practice requires that passwords be changed periodically. You could have your users forced to change all of their application-level passwords according to some schedule and then have the ESSO system learn the new passwords at the next access. But how much easier (and less frustrating for your users) would it be to have the SSPR facility do the periodic password change for each authentication point and load the changes to the ESSO service? You’ve increased your security while at the same time make it more user friendly – a combination I’d never have thought could happen.
By using an SSPR service, such as Courion’s PasswordCourier, you can also more easily enforce strict rules about the use of strong passwords (minimum length, mixed case, alphanumeric+symbols, no dictionary words, etc.) without having to spend processor time analyzing the passwords that human users might choose. That’s increased security combined with lower cost – in terms of CPU usage, another pairing I wouldn’t expect to see.
The old saying is that the whole can be greater than the sum of its parts and that seems to be true here. Combining ESSO with SSPR gives you all the benefits of each plus benefits that only the combination can provide. Think about it for your organization.
Upcoming Events: I’ll be speaking in Seoul, Korea this July at the Identity Access & Security Management 2007 conference to be held at the Ritz-Carlton, Seoul, July 9-10. See here for the details.
Downloads: Sentillion has archived a recent Webinar, “User Provisioning in Healthcare: The 360° Perspective” featuring Michael Gutsche, executive Director, Information Security and Client Systems for the Sisters of Mercy Health System; Gartner Group’s Barry Runyon and Sentillion’s own Terry Zysk (she’s the “vice president, provisioning” and don’t you wish you had one of those on staff!). Head over to the Web site where you will have to register, but it should be worth it to you.
