2009.03.03
BarCampBuffalo Open Discussion
'Interaction Assurance':
Options for Strong
Authentication in World 2.0?
S. Navpreet Jatana
www.jatana.com

Introduction
2
How did you find out about

BarCampBuffalo?
About Me

 IT Executive, most recently Erie County
CIO where I led, empowered, mentored a
staff of 62+
 Passionate about making things better,
solving real problems with technology
 More about me: www.jatana.com
Sentence Completion Exercise

www.jatana.com 2009.03.03

Strong Authentication:
Why should we care?
3
We want to
interact End-User
Confidence
knowing our
communications
are secure,
unaltered, and
trustworthy.
‘Interaction’
Assurance
Transaction
Authentication
Integrity
www.jatana.com 2009.03.03

Strong Authentication:
How am I affected?
4
Threats to Our Identity

We want to make things easy

Reused Passcodes Across Sites

 Simple, Easy-to-Remember(Guess) Passwords
 Microsoft ‘Notepad’ Password Manager
 Saving our Passcodes within our Browser
We like to run cool programs from our friends

Trojans and Viruses

 Keystroke loggers
We are tricked by shady characters

Phishing (social engineering)

www.jatana.com 2009.03.03

Strong Authentication:
Some Existing Solutions
5
Digital Certificates (PKI)

Some Two-factor Authentication Vendors

 Aladdin eToken®
 Authenex®
 Entrust® USB Tokens
 RSA SecurID®
 SafeNet iKey™
www.jatana.com 2009.03.03

Strong Authentication:
The Pain for the Average User
6
Functionality vs. Security?

 We expect both!
Too Many Passcodes to Remember

 Varying complexity requirements
Proprietary, Closed-source Solutions

Single-factor Authentication

 What we know (passcode)
Complex Software Install/Configuration

 Too many competing/unwanted options
www.jatana.com 2009.03.03

Strong Authentication:
The Ideal Medicine
7
Easy to Use

Secure

Affordable

Platform-agnostic Solution

Two-factor Authentication

Open-source, Extensible, Audited

www.jatana.com 2009.03.03

Strong Authentication:
The Options?
8
In your experience, what is the ideal

medicine?
www.jatana.com 2009.03.03

Strong Authentication:
One Possible Option...
9
Yubico’s YubiKey™

 http://yubico.com
Your thoughts?
www.jatana.com 2009.03.03