Comparison of Hardware Tokens and SMS One-Time-Passwords

g“ ee ch tin om o ic t n -d hl ec fe nt ier „t h yCustomer InformationComparison of Hardware tokens andSMS One-Time-Passwords

Customer InformationComparison of Hardware tokensand SMS One-Time-PasswordsWhen tokens may apply better than SMS? Whenever the majority of your users log in tens of times a day, so potentially creating excessive SMS volume and cost. If your users are not geographically dispersed. If your users are unlikely to loose or return the tokens during the life expectancy of the tokens. If your user volumes are relatively low, up to only i.e. few hundred users.Who could be better off using tokens? System administrators, logging in several times a day — potentially from locations with no GSM coverage. Permanent employees that rarely travel, but frequently log in i.e. from home.When SMS OTPs apply better than tokens? When user groups are geographically dispersed. When your workforce is mobile, logging in from anywhere in the world. When you provide extranet services. When you have ad-hoc login requirements. When you do not want to invest in managing client hardware. When you do not want to wait days or weeks for a new token to be delivered.What are the benefits in using SMS? Improved security: There are no seeds to be lost or stolen. There are no security devices to be lost or stolen. 24/7 deactivation service is provided by operators, not only by your company helpdesk. OTPs are 100% random, they cannot be predicted like with tokens. Fraudulent activity can be detected, for example man-in-the-middle attacks. Financial benefits: No need to purchase client authentication hardware. No need to needs support or maintenance client authentication hardware. 1

No need to distribute client authentication hardware to users. No need to renew client authentication hardware every 3-5 years. Smaller amount of user licenses as you do not need to pay for idle users. No need to invest in the authentication solution up-front (pay-as-you-go are licenses available).Managing tokens can be costly. RSA itself estimates that 5-year total cost of ownership (TCO) for a group of 250 usersis over $140.000. The figure below [source: RSA whitepaper, 2010] describes how the cost of an authentication devicerepresents only 20% of the total cost involved.The TCO is also bound to grow the more dispersed your users are. A sample total cost calculation is shown below:TCO -- 5 YEARS RSA¹ TECTIAHardware² $1.500 $200Authentication server $10.500 $10.000Support & Maintenance $13.363 $10.000Authentication devices $16.280 $0Deployment / SMS costs $5.000 $5.250Professional services $0 $0Administrator – five years $75.000 $2.000Lost device replacement costs $5.375 $0Lost device re-deployment $1.250 $05 year TCO $128.268 $27.450¹ RSA White Paper: How to Determine the True Total Cost of Ownership for Two-factor Authentication at http://www.rsa.com/products/securid/whitepapers/10642_2FTCO_WP_0110.pdf² Hardware vs virtual 2

Business benefits: Improved login experience Improved user satisfaction Less helpdesk calls Less administration Logins will not be compromised by a lost token, or by a token waiting to be delivered.The tables below demonstrate the different amount of user management tasks required to distribute and reclaim tokens,and to add and remove new SMS OTP users: Adding a new token user Adding a new SMS OPT user 1. Admin creates a user account and delivers the account 1. Admin creates a user account, adds the phone number details to the user e.g. by e-mail. information and delivers the account details to the user e.g. by e-mail. 2. Admin adds the token serial number to the new account and synchronizes the token. 3. Admin packages the token, user instructions and letter on the token terms of use, and mails it to the user. 4. Admin informs the new user that the token is in the mail (will be delivered within a few days). 5. The user eventually receives the token and studies the instructions and terms of use. 6. The user successfully logs in using the token — 2. User logs in using on-demand SMS One-Time- assuming that the token has not become out-of-synch, Password. was not broken during delivery, and that user knows how to use token. Removing a token user Removing an SMS OPT user 1. Admin removes the account. 1. Admin removes or disables the account. That’s it. 2. Admin notifies the user that the token should be returned via courier. 3. If the user fails to return the token, or it is lost, the admin must initiate cost recovery procedures or the company must pay for a replacement token. 4. Admin eventually receives the token. 5. If the token is damaged, the admin must initiate cost recovery procedures or the company must pay for a replacement token. 6. Admin notifies the user that the token was correctly received and intact. 7. Admin marks the token as ”returned” and adds the token serial to a pool of free tokens 3

About Tectia CorporationTectia Corporation, (formerly SSH Communications Security Corp.) is the market maker in real-time information securitysolutions for modern, networked organizations. We create an invaluable Circle of Trust for our customers and theirstakeholders by securing, automating, managing and sharing confidential information with Tectia solutions in fixed, mobile,and cloud environments.We enable and enhance business for thousands of customers in multiple industries in the private and public sectors aroundthe world. We operate in the Americas, Europe, and APAC regions, with headquarters located in Helsinki, Finland. Thecompany was established in 1995, and holds 15 patents. Its shares are quoted on the NASDAQ OMX Helsinki.About tyntectyntec is a global mobile interaction service provider, offering high-quality mobile messaging and information servicesto mobile network operators, enterprises, mobile service providers and internet companies. tyntec offers its customersa unique level of quality in 2-way SMS interaction services. This promise is based on the company’s pioneering servicelevel agreements (SLAs) and security of message transmission from end-to-end. tyntec enables its customers to reachmore than 90% of global subscribers and offers a 15-second SMS delivery guarantee, real-time delivery notifications of allmessages and a no-message loss policy.tyntec allows companies in a wide range of sectors to implement via SMS in a reliable, secure and straightforward way.Building mobile authentication components, such as (OTPs) or mTANs (Mobile Transaction Numbers), into the transactionprocesses gives companies access to a powerful, personalized and cost-effective identity authentication tool.www.tyntec.comContact • Email sales@tyntec.com • Call +49 89 202 451 216 • Web www.tyntec.com 4

Comparison of Hardware Tokens and SMS One-Time-Passwords

by tyntec

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Comparison of Hardware Tokens and SMS One-Time-Passwords Document Transcript