Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Two-factor Authentication for Cloud Applications - A Guide to Securing Business Applications

325 views

Published on

Did you know that there’s an online black market in which hackers and cybercriminals sell stolen accounts/passwords? With a motivated market of people trying to steal them, relying on passwords alone is a lousy way to protect access to your business applications. In today’s vulnerable business climate, two-factor authentication is a great way to reduce risks. Read this whitepaper to learn how.

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Two-factor Authentication for Cloud Applications - A Guide to Securing Business Applications

  1. 1. WHITEPAPER Two-Factor Authentication for Cloud Applications
  2. 2. Whitepaper Building the Business Case for Cloud SSO 2 Table of content The Benefits of Two-factor Authentication 3 Choosing a Second Factor 3 Balancing Convenience and Security 4 Single Sign-On (SSO) and Two-factor Authentication 4 Always Have a ‘Plan B’ 5 Summary 5 About CloudEntr by Gemalto 6
  3. 3. Whitepaper Building the Business Case for Cloud SSO 3 Two-Factor Authentication for Cloud Applications Did you know that there’s an online black market in which hackers and cybercriminals sell stolen accounts/passwords? Stealing and selling passwords can be profitable at scale. With a motivated market of people trying to steal them, relying on passwords alone is a lousy way to protect access to your business applications. Once you implement single sign-on, password security is even more critical. If one of those hackers gets access to the single sign-on credential, they can access everything within the SSO portal. Unless, that is, you’ve added a second factor to the SSO login. In today’s vulnerable business climate, two-factor authentication is a great way to reduce risks. The Benefits of Two-Factor Authentication There are many ways to steal a password: > Phishing (tricking people into revealing passwords) > Sharing accounts inappropriately (you know people do that) > Keyloggers planted through malware or on public kiosks > Intercepting passwords over insecure WiFi connections (Want a little data breach with your coffee?) With two-factor authentication, attackers can steal the password but they cannot get into the account without the second factor. And if that second factor requires access to a physical device, or is communicated over another communication stream, the attacker’s job is a WHOLE lot harder. Using two-factor application makes your cloud SSO much more secure from breach. It also helps in compliance by demonstrating that you’re making a best effort to protect access to sensitive data. Choosing a Second Factor The cost, expense and convenience of two-factor authentication all depends on which type of additional factor you chose. The established security practice is to have authentication factors from at least two of the different “types” of factors – something you know, something you have, and something you are.
  4. 4. Whitepaper Building the Business Case for Cloud SSO 4 A hacker in China might guess, steal or purchase your password, but they need to be physically near you to gain access to your badge or fingerprint impression. Conversely, if someone steals a hardware token, it is useless without the knowledge factor (the password). The table below lists common authentication technologies in each category. Something you know Something you have Something you are Password/PIN Security questions One-time password* Hardware token Smart card/ID badge One-time password generator* Fingerprint biometrics Iris scanning The One-Time Password (OTP) can be a special case. It’s a pin or password generated at the time of the connection – hence something you know. It has a very short life, so even if a keylogger steals it, they cannot use it. But if you have the password generator in your possession, it then becomes something you have, equivalent to a hardware token. Using a smart phone to either receive or generate an OTP essentially turns a commodity smart phone into a physical authentication device. Balancing Convenience and Security Security and convenience are always in opposition. The challenge in any multi-factor authentication deployment is balancing the increase in security with the potential hassle of providing the second factor. Be sure to consider the following: > Your business security and risk profile – Are you dealing in state secrets or large dollar transactions? How sensitive is the data? How high profile is your business? > The login environment – Do people reconnect frequently, and how time-sensitive are those logins? How diverse is the equipment people use? > Deployment cost and effort – What’s it going to cost to get everyone running with a second factor? Do you want to buy and provision hardware tokens? Do you need to get contractors or temporary staff up and running quickly? Biometric methods (based on physical characteristics of the person) are sensitive to environmental factors. For example, you don’t want to use fingerprint biometrics in situations
  5. 5. Whitepaper Building the Business Case for Cloud SSO 5 where people are wearing gloves. And you need the fingerprint readers at the point of login, so it matters what devices people are using. Hardware tokens and badges require people to have another device with them – and to remember to keep that device with them. Decisions about authentication often must be made on an application-by-application basis. Some cloud applications support only a certain subset of strong authentication methods. Single Sign-On (SSO) and Two-Factor Authentication If you use Single Sign-On (SSO) for cloud applications, you should think pretty seriously about using two-factor authentication. Because consolidating logins also consolidates your business risk if someone compromises the SSO login. The good news is that using SSO makes two-factor authentication more practical and less of a hassle. If you put the second authentication factor on the SSO login, then people only have to present the second factor once. All ‘downstream’ logins are automatically protected. Always Have a ‘Plan B’ You know how people forget their passwords and have to reset them? The same kind of thing can happen to other authentication factors: > People lose their smart phones – or drop them in water > Fingerprints can be obscured by bandages or gloves, or fingerprint readers can malfunction > ID badges or smart cards can be left at home or sent through the washing machine Just as you need a “Forget your password?” link, you will need a streamlined and secure way to give people access when the second factor is not available. You don't want to shut people out of doing their work. Summary Does two-factor authentication increase security and reduce risk? Absolutely – and it’s even more important if you are using single sign-on. Is it expensive, complex or difficult to deploy or use? That depends on the approach you take. There is no single ‘right’ choice for a second authentication factor. You’ll need to balance your business needs with convenience and cost concerns. A growing number of authentication technologies take advantage of smart phones – devices people already have and carry with
  6. 6. Whitepaper Building the Business Case for Cloud SSO 6 them through the day. These approaches make two-factor authentication practical and viable even for smaller businesses with remote and mobile employees accessing their cloud applications. About CloudEntr by Gemalto CloudEntr by Gemalto gives businesses a simple and secure way to manage cloud application access. Using CloudEntr, businesses regain control of their trust networks and cloud applications, while offering users convenient one-click access for all web applications in a single interface. CloudEntr reduces complexity while helping businesses operate anywhere, anytime, and at the right scale. Gemalto’s security and authentication expertise is trusted by many of the world’s largest financial institutions and governments. For more whitepapers, videos or eBooks or to download a buyer’s guide to Cloud SSO, visit www.cloudentr.com/latest-resources.

×