HOW TO INTRODUCE STRONG PASSWORDS : THREE SIMPLE STEPS

More and more organizations and IT departments need to introduce password complexity. Implementing strong passwords that have to change regularly is not easy, and can get a lot of resistance from the end users, or generate unnecessary helpdesk calls. Here are three simple tools to help you introduce complex passwords in your organization:

1.Password Self-Service:
In order to reduce the number of helpdesk calls that are password related, make users autonomous on the management and recovery of their passwords. Results: less password reset calls, 24x7 service, increased security (helpdesk identification)SSRPM (Self-Service Reset Password Manager) by Tools4ever is a good tool allowing for password resets through security questions or strong SMS authentication.

2. Reduce the number of Passwords that users have:
Naturally the more passwords users have to manage the more they will resist to strong password policies. Introduce a tool that reduces the number of passwords.

Results: decreased number of passwords = user comfort

With Single Sign-On tools like Tools4ever’s E-SSOM (Single Sign –On Manager) it is possible to reduce the number of logins and password combinations to just one, and eliminate about 3 to 5 password logon combinations per day.

3.Help users creating strong passwords through a password creation wizard.
In order for users to not get frustrated when creating their new strong password, they may need some assistance. A simple windows integrated tool can assist users while creating their password, showing the complexity rules and flagging each requirement as it is fulfilled.

Results: Users can create strong passwords instantly without getting unclear Windows error messages.

A tool that assists users in creating strong passwords according to the company’s own rules is reset calls, 24x7 service, increased security (helpdesk identification)PCM (Password Complexity Manager). It is extremely user friendly and integrates seamlessly into the user environment.

If you have more questions on introducing complex passwords don’t hesitate to contact us.

Related to:

• Strong passwords


• Active directory password


• Password reset


• Password self-service


• Complex passwords


• Single sign on


• Password synchronization

ACCESS MANAGEMENT AND SOX COMPLIANCY/AUDIT

When talking with IT management on Identity and Access Management issues, we regularly meet companies that have to be compliant with SOX regulations. This usually has a big impact on the organization of processes, but also on the IT department, especially concerning the management of access rights. Three of the most common issues are:

Workflow and validations on access rights:
Whether it concerns a regular active directory user accounts, NTFS rights, active directory groups, e-mail or application authorizations, all the requests and validations have to comply with the SOX regulations which may mean that in order to create one user account the IT department needs the signature of the requester, the validating manager and the IT director.

We have seen companies where this process was entirely managed by paper driven processes, and each time at a SOX audit, the IT department would spend weeks of digging through the papers with the auditor. An automated workflow system such as UMRA (User Management Resource Administrator), can automate the
se validation steps and make the SOX audit a piece of cake for the IT department.
Instead of papers getting lost in the process and having people waiting for their access rights UMRA will automatically alert the right validators who with a simple action can validate a request before it is sent automatically to the next validator or IT for granting.

Traceability:
Naturally all requests for access and granting of access should be traceable in the identity and access management solution. This is a standard feature of the Tools4ever Identity and Access Management suite.

Segregation of Duty:
This aspect of SOX compliancy requires that certain tasks cannot be performed by one and the same person. For example an order may be placed by person X but this should be validated by person Y. This can have consequences for access management, in the sense that it requires the access to certain data, or the access rights within an application must be tightly controlled.

In terms of access management and authorization management this means that the access management system must block or alert whenever two of such authorizations are being granted to one and the same user. This is easy to realize with the reporting and provisioning mechanisms in the Tools4ever identity and access management solutions. We only have to know which of the authorizations cannot be combined and then the solution will manage and audit the requirement automatically.

Feel free to contact your Tools4ever. office if you have any questions about SOX compliancy, and Access Management workflows.

Single Sign On and Password Synchronization - A powerful combination.

Password synchronization solutions can prove extremely useful for increasing efficiency and reducing costs. As with Tools4ever’s Password Synchronization Manager, they allow end-users to use a single password for logging into their network, and all other applications they require access to. After end-users have changed their password, PSM ensures that they can log in directly to all the required systems and applications with a single set of log-on credentials. This can improve end-user productivity and minimize the number of password-related helpdesk calls. But is it possible to enhance efficiency and workforce productivity further still?

Password Synchronization solutions alone still require the end-user to manually log-in to each application and system they use, which can be extremely time-consuming. A recent survey has shown that an alarming 28% of us have to remember over 12 different username and password combinations in order to do our work on a daily basis, with the majority of us having to key-in up to seven. In addition, 85% of us think that we would be able to work more efficiently if the time it took to log-in to systems was reduced.

Single Sign On (SSO) solutions, such as Tools4ever’s E-SSOM offer effective solutions to these issues. Once a user has logged into the network, and logged on to their required applications, E-SSOM will remember the login credentials required for each applications/system and automatically log the user in thereafter, whenever the applications/systems are launched.

However, with the combination of PSM, there is no need for this process as PSM communicates directly with E-SSOM. When a password is changed in Active Directory, PSM will immediately ensure that all applications/systems receive and apply the new credentials, and will communicate the current password credentials to E-SSOM, which will then launch all applications and systems automatically.

The combination of these two solutions makes login procedures significantly more efficient. Optimizing user convenience and simplifying the process for system administrators when access to new applications have to be added to user accounts, and when applications/systems require users to frequently change their login credentials.
With the combination of the two solutions, time-consuming log-in procedures can become a thing of the past. End-user convenience can be at an optimum level, with increased workforce productivity.


More information on Single Sign On and Two-factor Authentication on our website.

Single Sign On not enough?

A major concern for hospitals is the security and accessibility of their computers, applications and data. Clinicians often share a common user name and password with several of their peers in an area of the hospital in order to make it easy for them to sign on the computer and not have to waste time switching users. With several users logged in together, it is impossible for the hospital to track what each individual user is doing in the system to construct an audit trail. Recently, HIPAA reviewed these practices and recommended changes to improve the security risks. They no longer want user names and passwords to be shared and instead want each user to be identified in the system.

The most practical solution to this problem is the use of a Single Sign On product. Single Sign On would allow each user to sign into the system once and thereafter be automatically logged into each of their applications on the computer without having to enter additional credentials. Results from a Single Sign On pilot in the healthcare market revealed some concerns though with Single Sign On. Their concern was that the e-mail applications of the users might be available to others. The users voiced concerns that they felt very protective over their e-mail and wanted to make sure that no one is viewing their personal information.

This concern could be easily alleviated though with Two-factor Authentication. Two-factor Authentication would ask users to present two forms of identification (pass card, pin code, USB token, etc.) in order to access the workstation which would ensure security of their e-mail accounts. The conjunction of Single Sign On and Two-factor identification solves the HIPAA problem of security while also addressing the users concerns of privacy of their email accounts. The Two-factor Authentication also allows for fast user switching thereby reducing time spent by clinicians waiting on their profile to load.

More information on Single Sign On and Two-factor Authentication on our website.

Identity Management Metrics

A recent article in PC WORLD, identified ten important metrics that are critical to success if any IDM project. I would like to take a look at a few of these items and expound upon how Tools4ever can provide software and services to provide a clear and concise implementation that will lead to a quick ROI.

Monthly Password Reset Volume – The article points to this as an indicator of password policy effectiveness. Too few resets requests might mean users are using simple passwords or writing them down on sticky notes. Too many requests could indicate the complexity standards are very stringent and users are having difficulty remembering their passwords

Solution – Self Service Reset Password Manager (SSRPM) – allows companies to enforce complex passwords without inundating the help desk with user reset or unlock requests. The product can be deployed in an average organization in less than one day and the ROI is typically a few months.

Number of Credentials per User – A recent Tools4ever survey uncovered the average user has 10-12 separate, distinct sets of credentials and the article reiterated this fact. Once again, the large number of credential can lead to a large number of calls to the help desk and sticky notes with user name and passwords on the monitor.

Solution – Enterprise Single Sign On Manager (E-SSOM) from Tools4ever provides a cost efficient method to reduce he number of credentials to one – the AD username and password. This product is easily deployed by Tools4ever consultants in a few hours to a few days – depending on the number of applications. Two factor or strong authentication via biometrics or smart cards eliminated the normal security concerns with SSO implementations.

Average time to provision or de-provision a User - No one wants a new employee to sit idly for days waiting on network and email access. Even worse, a terminated employee should not have access to anything once they have left the building. Too often the information flow from HR to IT is slow or non-existent in both of these scenarios leading to a loss of productivity or a potential security breach.

Solution – User Management Resource Administrator (UMRA) allows companies to implement a closed loop process that encompasses creation, modification and deletion of user accounts. A common scenario is to synchronize Active Directory with the authoritative data source, typically the HR system, to insure the correct account status and security rights are always present. We forms are easily deployed to handle non-employees such as consultants, volunteers and contractors.

The article has many other great discussion topics and is a quick, informative read.

To learn more about Toosl4ever solutions for Identity and Password Management, please visit our website.

Getting Started with IDM

One of the questions often encountered when an organization decides to start an Identify Management project is “where do we start?” Undoubtedly, when looked at as a whole, the task can be daunting if not completely overwhelming. What is the source of data, how do we define roles, dozens of applications to interface with and the list goes on.

The approach we recommend is to start small – replace the manual, paper intensive process that is currently in place with a more automated, web based solution. Most organizations have a new hire form that has basic information – department, location, title, etc. and this is frequently coupled with another form that outlines what the new employee will need – network account, email, computer, phone, access to certain applications and group memberships to name a few.

A portal, such as the one in UMRA, can easily replace the paper request forms with web forms. The HR department or hiring manager completes the form online in lieu of the paper. Workflow processes automatically take over and distribute the information to the appropriate parties for approval or action. Active Directory and email accounts can quickly and securely be created while emails can be delivered to the system owners to insure provisioning occurs and hardware requirements are fulfilled. As items are completed, the owners indicate such in the portal allowing for ease of tracking.

A similar process can easily be set up for termination. Instead of HR sending the help desk an email, a quick entry into a web form can kick off the entire account disable and delete process. This allows for a much better level of security and reduces the risk a terminated employee will continue to have access to systems for days, weeks or even longer!

Once the “electronic” forms are in place, more time can be spent defining further requirements such as Role Based Access Control, electronic interfaces to other systems and even employee self-service. The net result, however, is a quick win for the entire organization – reduced paper work, better accuracy, timely account creation and, just as important, account deletion.

For more information, please visit our website to learn more about our phased approach Tools4ever.com.

Combining migration with implementation?

Many companies are apprehensive about implementing UMRA when they are in the middle of a migration process to an Active Directory (AD) environment. This may be due to the misconception that the migration must first be completed before UMRA will work properly, or starting another project while they are in the process of migration might overcomplicate the project, thus delaying the project deadline. The fact is that UMRA assists with migration both pre and post project and streamlines the process. Tools4ever expertise in this area provides a valuable project management asset and speeds up the migration process.

There are two common migration scenarios. The first of which is domain consolidation, multiple AD domains are being collapsed into a single domain. In this scenario UMRA is able to recreate the user account and, more often than not, retain the username in the new domain. Organizations also have the choice to implement new naming conventions. This occurs in circumstances where the migration results in several duplications of names. UMRA will then create a new user name and alerts end users, via email, what their new username will be along with the date that name will be made effective.

Not only is the user migration process streamlined, but the resources of those users as well. This includes items like group memberships and home directory data. As users are migrated UMRA will retain their group memberships, and if one of groups in question doesn’t reside in the new domain UMRA creates it automatically. Home directory data can either be copied to a new server in the new domain or re-permissioned on the existing server with the SID of the newly migrated account.

UMRA also assists and eases the migration process by:

Eliminating Pollution-Most migration tools will copy 1:1 which will includes erroneous and/or stale accounts. UMRA migrates users by reconciling them against a HR/SIS system so that pollution is not included. Activity reports on which groups are not being used are generated so that unused objects are not migrated.

Fill Attributes-When migration takes place there might be some missing information such as “title” or “Department”. UMRA automatically populates this information as needed.


To learn more about UMRA please visit our website.