HOW TO STRENGTHEN SECURITY, MINIMIZE COSTS AND SIMPLIFY THE USER EXPERIENCE. Secure Identity Proofing.

1. White Paper
BESTPRACTICES FOR
MULTI-FACTOR AUTHENTICATION
HOWTO STRENGTHEN SECURITY, MINIMIZE
COSTS AND SIMPLIFYTHE USER EXPERIENCE

2. Introduction
Securemobileaccesstoenterprisesystemsandinformationcreatesacompetitiveadvantage.
Productivityriseswhenemployeescanworkfromanywhere,onanydevice.Employeesand
partnersaremoreresponsivewhentheycanaccessyoursystemsfromoutsidethebuilding
insteadofwaitinguntiltheycangettoyouroffices.Jobsatisfactiontendstoimprovewhen
employersintroducebring-your-own-device(BYOD)polices.
Today’sdisappearingnetworkboundariesmagnifytheimportanceofuserauthentication,
especiallyinregulatedindustriessuchasfinancialservices,healthcare,pharmaceuticals,andlife
sciences.Weakauthenticationpracticescanleadtolossofintellectualproperty,branddamage,
publicrelationsdebacles,revenuelossfromsystemoutages,andfinesforcomplianceviolations.
The Problem with P@55word5
Theusername/passwordcombinationalonefailstoprotectenterpriseassets.Ina2016study
ofmorethan64,000securityincidents,weakorstolenpasswordstoppedthelistofcauses.1
Frequentnewsheadlinesaboutdatabreachesunderscorethefactthatpasswordsareeasy
toguess,easytocrack,andeasytoextractfromemployeesviaphishingschemes.
Thesoberingtruthisthatyou’revulnerableevenifyouimplementthestrongestdatabase
protectionsandenforcerequirementsforcomplexpasswords.Why?Despiterecommendations
tothecontrary,manyemployeesusethesamepasswordformultiplesites.Therefore,abreach
toanotherorganization’spassworddatabasecanexposepasswordsthatyouremployees
usetoaccessyoursystems.Cybercriminalsexploitedthisfacttostealcustomercreditcard
informationfromamajorU.S.retaileraftersnaggingaccesscredentialsfromoneofthe
retailer’scontractors.2
Similarly,hackerswereabletotemporarilytakeovertwosocialmedia
accountsofFacebookfounderMarkZuckerbergafterbreachingathirdsocialmediasite’s
passworddatabase.3
Eighty-two percent of all
web attacks target user
credentials. Many succeed:
63% of confirmed data
breaches involve weak,
default, or stolen passwords.
Financial gain or espionage
motivated 89% of breaches.
VerizonDataBreachInvestigations
Report(DBIR),2016
1
Verizon,2016DataBreachInvestigationsReport
2
http://www.computerworld.com/article/2487425/cybercrime-hacking/target-breach-happened-
because-of-a-basic-network-segmentation-error.html
3
http://www.nytimes.com/2016/06/07/technology/if-mark-zuckerberg-can-be-a-hacking-victim-
so-can-you.html
1
synchronoss.com

3. Multi-factor Authentication Bolsters Security
Multi-factor authenticationisexponentiallymoresecurethanpasswordsalone.Before
accessingenterprisesystems,employeesandpartnersmustenteratleasttwocredentials:
somethingtheyknow(passwordoranswertoaquestion), somethingtheyhave(one-time
codefrom mobile app ortextmessage),orabiometric(typicallyafingerprint,voiceprint,or
retinascan).
Untilnow,strongersecuritycameattheexpenseofbudgetsandtheuserexperience.Multi-
factorauthenticationmeantpayingupforhardwaretokensorsmartcards.Todayyoucanadopt
multi-factorauthenticationaffordablyandwithoutcompromisingtheuserexperience.Follow
thefiverecommendationsbelow.
1. FOCUS ON THE USER EXPERIENCE
Giveusersachoiceofhowtoreceivetheirone-timepasscode—forexample,mobileapp,
email,SMStextmessage,orautomatedcalltoaphonenumberonrecord.Aconvenientuser
experienceencouragesadoption,whichacceleratesproductivitygainsfrommobilityandBYOD.
Tousebiometricsasasecondorthirdfactor,considermobileapps.Biometricsappsarealready
availableforscanningfingerprints,voices,faces,earprints,gestures,andretinas.Hands-free
authenticationbasedonproximityrequiresevenlesseffortfromusers.Theworkstationverifies
theuser’scredentialbyconnectingautomaticallytotheuser’smobiledevice.Topreventa
criminalcarryingastolendevicefromgainingaccess,besuretosupplementproximity-based
authenticationwithapassword.
2. TAKE ADVANTAGE OF CLOUD ECONOMICS
AND SCALABILITY
Thecloudmodelshiftscapitalexpenseforserversandsoftwaretoapredictableoperational
expense.Youpayasyougo.Savingsinclude:
• Noon-premisesinfrastructure(servers,storage,andnetworkresources).
• Nomaintenancefeesandhardwareandsoftwareupgrades.Youalwayshaveaccesstothe
latestfeatures.
• Noadditionalcapitalexpendituresasyouaddusers.
• Avoidanceofproductivitylosswhenon-premisessystemsgodown.Cloudservice
providerscantakeadvantageofeconomiesofscaletoimplementhigh-availability
architectures.
OutsourcingtoacloudproviderwithexpertiseinauthenticationalsofreesuptimeforyourIT
teamtofocusonthecorebusiness.
Gartner projects that
the number of identity
and access management
purchases involving
authentication as a service
will double from 20% in
2016 to 40% in 2020.
MagicQuadrantforIdentityand
AccessManagementasaService,
June6,2016
2
synchronoss.com

4. NISTLevel 1 NISTLevel 2 NISTLevel 3
Usernameandpassword
Secondfactor,suchasone-timecode
Usernameandpassword
Secondfactor
Fullsocialsecuritynumberanddateof
birth,checkedagainstpublicdatabases
Responsetoacalloremailtothe
phonenumberoremailaddress
onrecord
Usernameandpassword
Secondfactor
Fullsocialsecuritynumber,dateof
birth,andfinancialdata,checked
againstpublicdatabases
Responsetoacalloremailtothe
phonenumberoremailaddress
onrecord
OneormoreKnowledgeBased
Assessmentquestions,suchas
monthlymortgagepaymentor
makeandmodelofcarin2012
3. BEFORE ISSUING CREDENTIALS, VERIFY
THAT USERS ARE WHO THEY SAYTHEY ARE
Beforehiringemployeesyouverifytheiridentitybyreviewingofficialdocumentssuchasdriver’s
license,socialsecuritycard,orpassport.It’smorechallengingtoverifyoffsitepartners’and
contractors’identitybeforeissuingcredentials.HowcanyouverifythatJohnSmithisreally
theJohnSmithwhoworksforyouraccountingfirm—notsomeoneelsemasqueradingasJohn
Smith,orevenabot?Verifyingtheidentitiesofthirdpartiesisimportantinallenterprises,
andmandatedforcertaintypesofusers.Examplesincludehealthcareproviderswhouse
e-prescribingsoftwareandfinancialservicescustomerswhoconducthigh-valuetransactions.
TheU.S.NationalInstituteofScienceandTechnology(NIST)definesthreelevelsofidentity
proofing(levelsofassurance)thatdonotrequireanin-personvisit(Table1).Lookforacloud
providerthatoffersNISTLevel3identityproofingandisapprovedbyFederalIdentity,
Credential,andAccessManagement(FICAM).
Table 1 — Sample User Experience ForThree Levels of Identity Proofing
3
synchronoss.com

5. 4. CHOOSE A CLOUD SERVICE THAT MEETS
YOUR INDUSTRY’S SECURITY GUIDELINES
Table2listscommonsecurityrequirementsforregulatedindustries.Tomeetthese
requirements,cloudprovidersinvestindatacenters,technology,andprocessesthatcomply
withgovernmentstandardssuchasNISTandFederalInformationProcessingStandards(FIPS)
intheU.S.,andEUGeneralDataProtectionRegulationintheEU.
Table 2 — Data Security Requirements by Industry
INDUSTRY SAMPLE REQUIREMENTS
Financial Services U.S.PaymentCardIndustry(PCI)
U.S.Gramm-Leach-BlileyAct(GLBA)
U.S.SecuritiesandExchangeCommission(SEC)
U.S.FinancialIndustryRegulatoryAuthority(FINRA)
U.S.FederalFinancialInstitutionsExaminationCouncil(FFIEC)
U.K.tScheme
EuropeanBankingAuthority(EBA)
EuropeanSecuritiesandMarketsAuthority(ESMA)
EuropeanInsuranceandOccupationalPensionsAuthority(EIOPA)
BaselCommitteeonBankingSupervision(BCBS)
Healthcare U.S.HealthInformationPortabilityandAccountabilityAct(HIPAA)
U.S.HealthInformationTechnologyforEconomicandClinicalHealth(HITECH)
FederalIdentity,CredentialandAccessManagement(FICAM)
Life sciences U.S.FoodandDrugAdministration(FDA)
EuropeanMedicinesAgency(EMA)
GoodAutomatedManufacturingPractice5(GAMP5)
All enterprises Corporatesecuritypolicies
Sarbanes-OxleyAct(SOX)
4
synchronoss.com

6. 5. DON’T FORGET PEOPLE AND PROCESS
Eventhemostsophisticatedauthenticationtechnologycannotpreventbreachesresultingfrom
usersleavingtheirpasswordsinplainvieworreusingtheirworkpasswordforotherservices.
Requireemployeestoattendmandatorycybersecurityawarenesstrainingthatcovers:
• Regulatorycompliance.
• Creatingstrongpasswordsandkeepingthemsecure.
• Recognizingphishingattacks.Somecompanieskeepemployees’skillssharpby
periodicallysendingoutafakephishingemail.Employeeswhoclickthelinkaretaken
toawebpageexplainingthatthelinkcouldhavebeenmalicious.
• Understandingthevalueofmulti-factorauthenticationandusingyour
organization’ssolution.
ImplementsecureITpracticesinconjunctionwithemployeetraining.Besuretosegmentthe
networktolimitriskifacybercriminaldoesgainaccessusingstolencredentials.Inaddition,
monitorthenetworkfordatatransfersoutsidetheorganizationtoidentifyandmitigate
vulnerabilities.
Synchronoss Universal Identity,
Authentication in the Cloud
SynchronossUniversalIdentity(ID)isacloud-basedservicethatreducestheriskoftargeted
attacks,credentialtheft,andidentifyfraudbyprovidingapowerfullayerofauthentication
security.Whetheryouextendaccesstoemployees,partners,vendors,orcustomers,
Synchronossreliablyverifiesuseridentitiesandensuresthatonlytherightpeoplegain
accesstoyournetwork.Theresult:yourcompanyandyouruserscanconductbusinesssafely,
confidently,andsecurely.
SIMPLE GROWTH, LOW PER-USER COSTS
Asacloudservice,SynchronossUniversalIDrequiresnoon-premiseshardwareorsoftware.
There’snoupfrontcapitaloutlay,andyoualwayshaveaccesstothelatestfeaturesandsecurity
enhancements.Helpdeskcostsarenominalbecauseuserscanresettheirownpasswords.The
pay-as-you-gomodelmakesiteasyandaffordabletoaddnewemployeesandotherusersas
yourbusinessexpands.
In the 2016Verizon study,
92% of all phishing attacks
aimed for passwords.
The most effective phishing
websites succeed 45% of
the time in enticing visitors
to enter information.4
VerizonDBIR,2016
4
http://services.google.com/fh/files/blogs/google_hijacking_study_2014.pdf
5
synchronoss.com

7. FAST ONBOARDING OF NEW USERS
NewuserscanbeginusingSynchronossUniversalIDwithinminutestosecurelysignin.
Theyvisit a self-serviceportaltosignup,downloadingasimpleapplication.Thecloudservice
verifies their credentialstotheneededNISTlevel.Ifyouhavealreadyverifiedtheidentity
ofsome or all of your users,youcanaddthemtothecloudservicewithoutrepeatingthe
identityproofingprocess.
WIDE CHOICE OF AUTHENTICATION OPTIONS
Synchronossoffersmoremulti-factorauthenticationoptionsthananyothervendor.Asyour
secondfactor,choosefromasoftwaretoken,aone-touchmobileapp,QRcodescanning,email,
SMSmessage,IVRcall,andotheroptions.
SIMPLIFIED COMPLIANCE
Industry-specific securityregulationsevolvecontinually.Synchronossexpertsmanagethe
complexities, eliminatingtheneedtopurchaseregulation-specificsoftwareandhiretalent
todeploy and maintainit.We’vedesignedourdatacenters,technology,andprocessesto
meetthe most stringentgovernmentstandardsandindustryregulations.TheU.S.Federal
Government and the U.K.GovernmentselectedSynchronossUniversalIDforstrong
authentication based onourscalableplatformandportfolioofsecuritystandards.
TheSynchronossUniversalIDserviceis:
• FICAMLevel3certified,thefirstcloudservicetoreceivethiscertification
• FederalInformationSecurityManagementAct(FISMA)approved
• FederalBridgeCertificationAuthority(FBCA)certified
• NIST800-63-2and800-53compliant
• FIPS199and140-2compliant
• HIPAAcompliant
• U.S.AccessBoardSection508compliant
• EUGeneralDataProtectionRegulationcompliant
©Synchronoss,Inc.AllRightsReserved 1-0616 6
synchronoss.com

8. About Synchronoss
REALIZE THE PROMISE OF ENTERPRISE MOBILITY
Uncompromised productivityandsecurity.OurSecureMobilityPlatformmeetstoday’sneeds
andcan help make tomorrow’spossibilitiesareality.Itisdesignedtoenhanceandcomplement
existing mobility investments,soyougetabetterROI—andcanfinallyrealizethetruepower
ofmobility.
Synchronoss Enterprisedeliversrealmobilityforenterpriseswiththemoststringentsecurity
requirements.The SecureMobilityPlatformenableshighlyregulatedbusinesstobuildtoward
modernmobilityinawaythatcomplementsexistinginvestments.
SynchronossEnterprise,inajointventurewithGoldmanSachsandVerizon, isextending
deeper into the enterprisetobridgethegapandsolvetheinherentcomplexityassociatedwith
mobilityandidentity.
Since2000, we’ve providedcloudsolutionsandsoftware-basedactivationtocommunication
service providers acrosstheglobe.CompaniessuchasAT&T,VerizonWireless,Comcast,Time
Warner Cable, Apple, andMicrosofthaveusedourscalabletechnologysolutionstoallowtheir
customers to connect, synchronize,andactivateconnecteddevicesandservicesthatpower
theconnectedworld.
Weknowmobility.Weknowsecurity.Wecanhelpyourorganizationdosecurebusiness,everywhere.
Learn More
To find out how you can reduce risk, strengthen security, and confidently extend network
access to employees, partners and customers, visit www.synchronoss.com/identity.
synchronoss.com
©Synchronoss,Inc.AllRightsReserved 1-0716 7