Password Synch versus Single Sign On

In many implementations of our Self Service Reset Password Manager (SSRPM), a client will request that we send the new password to several other applications.  On the surface, this seems like a simple request and a function that our product is certainly capable of providing. Once you delve deeper there are a number of mitigating factors that need to be considered:

• Are user names the same across all systems? If yes, implementing is easy. If no, a translation table will need to be built up to make sure JDOE in system 1 is equal to John_Doe in system 2 and DOEJ in system 3 and so on.
• Are password complexity rules the same in all systems? If yes, implementing is easy. If no, the most complex password requirement now becomes the defacto standard. Special character restrictions can also become an issue.
• What happens if System B is unavailable when the synch occurs? A password storage vault and error handling need to implemented to insure a reset can occur when the system becomes available. 
• While SSPRM addresses forgotten passwords, how do we handle capture password changes and synch them?

While Tools4ever has the products (PSM and PCM) and expertise to address these issues, there needs to be a determination of feasibility and reliability. This determination directly corresponds to the number of systems that need to be synched. Sending password resets to 2 or 3 systems, in addition to Active Directory is a complex requirements but entirely feasible. 

When the number of systems expands much beyond that, the recommendation would be to lean towards a Single Sign On (SSO) solution that eliminates all of the issues above.  SSO can capture and cache all credentials for any number of systems making the synch unnecessary. All users need to remember is one set of credential; their AD username and password. SSO can handle password resets automatically for all systems and complexity rules are a non-issue as they are addressed at the application level.

For more information, please visit our website.

Workflow and Identity Management

One topic we seem to running across with increased regularity is employees starting work before they are actually entered into the HR system. When this occurs, completely automating the user account creation breaks down. The employee will need access to the network, email and applications on their first day but HR can have a lag of a few days to a few weeks before all information is compiled, approved and entered into the HR system.

To resolve this issue, we have several creative methods to insure the employee has what he or she needs to be productive on Day 1. In at one recent customer install, we implemented Web forms to allow a hiring manager to start the user account lifecycle process. Basic information, such as name, department and title are entered into the web form. From there an automated workflow process takes over and routes system access request to the appropriate individuals.  As approvals are granted, the system automatically creates the accounts in Active Directory, Office 365 and several other systems based on the user requirements. This process insures the new employee has what they need on their first day of work.

Once the automated process detects the user is added to the HR system, a synching process occurs and adds other relevant information to the Active Directory such as employee number, address, office location and cell number. The automated process also detects changes in employee status such as departmental transfers and takes appropriate actions to re-provision access as appropriate. The HR system also feeds termination dates to the User Management application to insure access is disabled. The HR team and managers also have a web form where they can mark an employee terminated immediately insuring that access to the network is revoked instantaneously.
To learn more about utilizing the Tools4ever User Management solution to delegate account creation responsibilities, please visit our website.

Who is it?

The majority of calls received by the IT helpdesk require caller verification. After all, the helpdesk agent will want to be certain the caller is who they claim to be before granting access privileges to sensitive business applications. But how can helpdesk agents determine the identity of end users?

Many organizations require a physical form of identification in order for the helpdesk to make changes. For instance, employees will be asked to provide a document signed by their manager or a copy of their identification before being assigned any privileges. On the other hand, faster approaches, such as a simple call to the helpdesk, often involve too many risks.

In response to these challenges, Tools4ever has developed Helpdesk Caller ID Verification. This solution offers a simple mechanism for determining a caller’s identity. To this end, the caller will first be prompted to provide answers to a series of personal questions, such as “What is your mother’s maiden name?” Thanks to the use of an intelligent technique, the helpdesk agent will not see the answer to the question, but only parts of the answer (e.g. the first and last characters). The helpdesk agent will subsequently ask the caller which characters have to be entered.

Helpdesk Caller ID Verification does not require any additional hardware, making it a cost-efficient, easy to implement solution. This means organizations can easily verify the identity of callers in a secure fashion.

For more information, please visit our Website.

HOW TO INTRODUCE STRONG PASSWORDS : THREE SIMPLE STEPS

More and more organizations and IT departments need to introduce password complexity. Implementing strong passwords that have to change regularly is not easy, and can get a lot of resistance from the end users, or generate unnecessary helpdesk calls. Here are three simple tools to help you introduce complex passwords in your organization:

1.Password Self-Service:
In order to reduce the number of helpdesk calls that are password related, make users autonomous on the management and recovery of their passwords. Results: less password reset calls, 24x7 service, increased security (helpdesk identification)SSRPM (Self-Service Reset Password Manager) by Tools4ever is a good tool allowing for password resets through security questions or strong SMS authentication.

2. Reduce the number of Passwords that users have:
Naturally the more passwords users have to manage the more they will resist to strong password policies. Introduce a tool that reduces the number of passwords.

Results: decreased number of passwords = user comfort

With Single Sign-On tools like Tools4ever’s E-SSOM (Single Sign –On Manager) it is possible to reduce the number of logins and password combinations to just one, and eliminate about 3 to 5 password logon combinations per day.

3.Help users creating strong passwords through a password creation wizard.
In order for users to not get frustrated when creating their new strong password, they may need some assistance. A simple windows integrated tool can assist users while creating their password, showing the complexity rules and flagging each requirement as it is fulfilled.

Results: Users can create strong passwords instantly without getting unclear Windows error messages.

A tool that assists users in creating strong passwords according to the company’s own rules is reset calls, 24x7 service, increased security (helpdesk identification)PCM (Password Complexity Manager). It is extremely user friendly and integrates seamlessly into the user environment.

If you have more questions on introducing complex passwords don’t hesitate to contact us.

Related to:

• Strong passwords


• Active directory password


• Password reset


• Password self-service


• Complex passwords


• Single sign on


• Password synchronization

ACCESS MANAGEMENT AND SOX COMPLIANCY/AUDIT

When talking with IT management on Identity and Access Management issues, we regularly meet companies that have to be compliant with SOX regulations. This usually has a big impact on the organization of processes, but also on the IT department, especially concerning the management of access rights. Three of the most common issues are:

Workflow and validations on access rights:
Whether it concerns a regular active directory user accounts, NTFS rights, active directory groups, e-mail or application authorizations, all the requests and validations have to comply with the SOX regulations which may mean that in order to create one user account the IT department needs the signature of the requester, the validating manager and the IT director.

We have seen companies where this process was entirely managed by paper driven processes, and each time at a SOX audit, the IT department would spend weeks of digging through the papers with the auditor. An automated workflow system such as UMRA (User Management Resource Administrator), can automate the
se validation steps and make the SOX audit a piece of cake for the IT department.
Instead of papers getting lost in the process and having people waiting for their access rights UMRA will automatically alert the right validators who with a simple action can validate a request before it is sent automatically to the next validator or IT for granting.

Traceability:
Naturally all requests for access and granting of access should be traceable in the identity and access management solution. This is a standard feature of the Tools4ever Identity and Access Management suite.

Segregation of Duty:
This aspect of SOX compliancy requires that certain tasks cannot be performed by one and the same person. For example an order may be placed by person X but this should be validated by person Y. This can have consequences for access management, in the sense that it requires the access to certain data, or the access rights within an application must be tightly controlled.

In terms of access management and authorization management this means that the access management system must block or alert whenever two of such authorizations are being granted to one and the same user. This is easy to realize with the reporting and provisioning mechanisms in the Tools4ever identity and access management solutions. We only have to know which of the authorizations cannot be combined and then the solution will manage and audit the requirement automatically.

Feel free to contact your Tools4ever. office if you have any questions about SOX compliancy, and Access Management workflows.

Single Sign On and Password Synchronization - A powerful combination.

Password synchronization solutions can prove extremely useful for increasing efficiency and reducing costs. As with Tools4ever’s Password Synchronization Manager, they allow end-users to use a single password for logging into their network, and all other applications they require access to. After end-users have changed their password, PSM ensures that they can log in directly to all the required systems and applications with a single set of log-on credentials. This can improve end-user productivity and minimize the number of password-related helpdesk calls. But is it possible to enhance efficiency and workforce productivity further still?

Password Synchronization solutions alone still require the end-user to manually log-in to each application and system they use, which can be extremely time-consuming. A recent survey has shown that an alarming 28% of us have to remember over 12 different username and password combinations in order to do our work on a daily basis, with the majority of us having to key-in up to seven. In addition, 85% of us think that we would be able to work more efficiently if the time it took to log-in to systems was reduced.

Single Sign On (SSO) solutions, such as Tools4ever’s E-SSOM offer effective solutions to these issues. Once a user has logged into the network, and logged on to their required applications, E-SSOM will remember the login credentials required for each applications/system and automatically log the user in thereafter, whenever the applications/systems are launched.

However, with the combination of PSM, there is no need for this process as PSM communicates directly with E-SSOM. When a password is changed in Active Directory, PSM will immediately ensure that all applications/systems receive and apply the new credentials, and will communicate the current password credentials to E-SSOM, which will then launch all applications and systems automatically.

The combination of these two solutions makes login procedures significantly more efficient. Optimizing user convenience and simplifying the process for system administrators when access to new applications have to be added to user accounts, and when applications/systems require users to frequently change their login credentials.
With the combination of the two solutions, time-consuming log-in procedures can become a thing of the past. End-user convenience can be at an optimum level, with increased workforce productivity.


More information on Single Sign On and Two-factor Authentication on our website.

Single Sign On not enough?

A major concern for hospitals is the security and accessibility of their computers, applications and data. Clinicians often share a common user name and password with several of their peers in an area of the hospital in order to make it easy for them to sign on the computer and not have to waste time switching users. With several users logged in together, it is impossible for the hospital to track what each individual user is doing in the system to construct an audit trail. Recently, HIPAA reviewed these practices and recommended changes to improve the security risks. They no longer want user names and passwords to be shared and instead want each user to be identified in the system.

The most practical solution to this problem is the use of a Single Sign On product. Single Sign On would allow each user to sign into the system once and thereafter be automatically logged into each of their applications on the computer without having to enter additional credentials. Results from a Single Sign On pilot in the healthcare market revealed some concerns though with Single Sign On. Their concern was that the e-mail applications of the users might be available to others. The users voiced concerns that they felt very protective over their e-mail and wanted to make sure that no one is viewing their personal information.

This concern could be easily alleviated though with Two-factor Authentication. Two-factor Authentication would ask users to present two forms of identification (pass card, pin code, USB token, etc.) in order to access the workstation which would ensure security of their e-mail accounts. The conjunction of Single Sign On and Two-factor identification solves the HIPAA problem of security while also addressing the users concerns of privacy of their email accounts. The Two-factor Authentication also allows for fast user switching thereby reducing time spent by clinicians waiting on their profile to load.

More information on Single Sign On and Two-factor Authentication on our website.