How Can Strong Authentication Help Meet Compliance Requirements?
Protecting access to information and making sure that workers are following the company’s policies is one of the biggest tasks facing those responsible for security at any bank or financial institution. The traditional way to keep access secure is by implementing a security policy including increasing the strength of passwords. With a huge rise in the number of log-ins that users have to remember, however, other techniques have to be considered to keep the organisation secure while maintaining ease of use, and high productivity for employees.
Other drivers are also playing their part in encouraging companies to ensure greater security measures. Within the last few years, governments around the world have mandated a series of new IT security measures and processes as part of acts such as Gramm-Leach-Bliley, and Sarbanes-Oxley in the US, and the Data Protection Act in the UK. Regulations such as Basel II and the Payment Card Industry Data Security Standard (PCI DSS) as well as industry standards, such as BS7799 in the UK and BS7799-2 and ISO 17799 worldwide, are also mandating stronger authentication. Organisations and corporate officers must comply with these regulations or be subject to fines, legal action, and/or negative customer reaction. Strong authentication is a critical part of these standards, and along with tracking and reporting, is a necessary solution for organisations doing business today
Strong authentication involves using ‘something you know’ with ‘something you have’ – in most cases, this will be a combination of a password or PIN with a second factor that a user carries around with them. By requiring users to have two different credentials in order to gain access, overall security is higher. Even if a user shares their password with another staff member, or it is stolen without their knowledge, the second party will be unable to enter the network or the application concerned. For areas of the business where additional security is required, combinations of different strong authentication factors can also be used.
However, making the right decision about how to implement strong authentication to support the business is another issue. Making the choice of which strong authentication technologies are appropriate for which employees can provide additional benefits to the business, whether the priority is strength of security or user convenience. Balancing the needs of different groups of users, and the cost of implementing strong authentication across the organisation requires an understanding of how these technologies can make a difference to employee workflows as well as enhancing security.
Most banks are already familiar with one-time-password tokens – these are used widely with customers to support online banking. Instead of using a password, the customer enters a string of numbers that is generated by the token and valid for a short period of time. Using tokens rather than passwords can prevent customers being affected by phishing attacks, where fraudsters attempt to steal password details from customers: even if a customer hands over their details, it is unlikely that the fraudster will be able to gain access to funds.
Token technology can also be used internally – if an employee wants to gain access to the network, then they can use a token alongside their user name. This adds the appropriate technology to eliminate the risk of an internal user accessing inappropriate information or placing faulty transactions that could cost companies billions. This approach is particularly useful where employees work remotely, or are mobile, as the token can authenticate users while they are outside the confines of the office.
When convenience for the user is a high priority for secure access, another approach to strong authentication is biometrics: using a fingerprint or other unique physical identifier to authenticate users into the system. This is becoming increasingly popular, as the cost of fingerprint readers has dropped considerably and employees get more familiar with using them. Some laptop providers are now including fingerprint readers as standard with their new machines, increasing the availability of this technology still further.
Using a fingerprint reader is very simple, as an employee can just swipe their finger to gain access. This can either be a replacement for a password, or used alongside a PIN, depending on the policy in place. Finger biometrics do not have the problem that other methods of strong authentication have, as employees cannot forget their fingers; however, the company may have to undertake some training with their staff to make sure that they understand the technology involved and deal with any privacy concerns.
A third option for strong authentication is an active proximity card: this uses a small radio transmitter and receiver together to authenticate users. As an employee approaches their workstation, the radio signal can unlock the PC and log the user into the network. If they move away from the terminal it can automatically log the user out as well prevent the sharing of workstations.
Another option for strong authentication is to use the badge or smart card that many employees currently use to enter the building. This covers a wide variety of different types of cards, from simple swipe cards through to passive proximity and chip cards. Whatever type of card it is, the user can use a reader attached to their PC which can then authenticate them to the IT network, alongside a PIN.
Using a card for authentication can also be linked into other company projects: extra information can be hosted on the card for other applications. Support for external smart cards is also another potential opportunity to reduce costs: in Europe, many nations already had ID cards that contain a chip which can have an additional certificate added to it. The users would already be carrying these cards around with them, so there is a good opportunity to re-use existing materials and reduce costs. Countries where organisations have rolled out internal strong authentication schemes based on country-level smart cards include the Netherlands, Italy and Estonia.
One new development in strong authentication is to integrate the IT network with a physical access system. Many organisations already have a door access policy in place where users have to badge into the building as they enter and leave. However, this is often the responsibility of the facilities management team, rather than the IT department: consequently, in the past, businesses have not been able to correlate the physical system with network access.
This situation is now changing, and being able to link physical and network authentication together offers a greater opportunity to enforce security policy. Having these two separate systems communicate with each other means that location can be used as a factor for authentication. For example, when a user enters the building, they have to swipe their door access card. When they reach their desk, the network access system can query the physical access database to check that they have entered the premises. If they have not authenticated themselves into the building, then access to IT resources can be denied.
This approach means that companies can be more granular in their access policies, and access to assets restricted to those that have both the physical and network rights. A key site, such as a trading floor or the company server room can be locked down to only those that have been given permission to enter the room and use the workstations within that location. If someone does enter that room and attempt to log-in, the event can be logged and flagged to the security team, and the user access will be denied.
Using strong authentication can improve security, but it can also be used to create a more detailed log of user events for compliance and audit information. However, while strong authentication on its own can give a level of detail about access to workstations, there is also another way to get more information on user activities. Instead of having multiple passwords for all the applications that a user might be able to use, single sign-on (SSO) involves creating one strong credential which then automatically gives a user access to the applications that they are allowed to use.
Using SSO and strong authentication together means that the organisation can create a more detailed level of audit data. When a user logs into the network or opens up an application, this can be saved for future reference. While SSO links all application access back to one user credential, strong authentication ensures that this credential is as secure as possible.
Linking SSO and strong authentication also makes reporting for compliance requirements easier, as access can be analysed at various levels, including the individual user, workstation or application. If the organisation is taking the integrated physical/logical security approach, then access to physical assets can also be tracked as part of the same identity management scheme. Being able to trace activity at a user or application level can help an organisation to prove that rules are being followed.
Certain compliance requirements demand that companies can audit employee activities and trace all work back to the user that carried it out. In some cases, applications with sensitive events can have their own authentication ‘triggers’, whereby a user will have to authenticate every time that event is carried out at the transaction level. This will ensure that the individual responsible for that activity is linked to it within the workflow, and prevent any repudiation of the list of events.
By linking strong authentication and SSO together, the organisation can create a single access policy for its employees across network, application and workstation assets. Linking this with the physical access system as well means that the location of the user can also be employed as a factor. By having this single policy across all a company’s assets, it makes management of the whole identity management strategy far easier, and ensures that there is no potential gap within the enterprise security framework.
User identity remains one of the most important facets of a security system: using strong authentication and single sign-on together means that all activity can be traced back to the user. In the event of an issue, this approach means that it is simple to trace the location and user associated with that event.