Scribd Logo
Upload

Welcome to Scribd!

  • 159 views

    Two Factor Authentication

    Uploaded by

    PistolStar Tailored Authentication
    PortalGuard’s Flexible Two-factor Authentication options are designed as strong authentication methods for securing web applications. PortalGuard leverages a one-time password (OTP) as a factor to further prove a user's identity. The OTP can be delivered via SMS, email, printer, and transparent token. Configurable by user, group or application this is a cost effective approach to stronger authentication security. Tutorial: http://pg.portalguard.com/flexible_two-factor_tutorial

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    Two Factor Authentication

    Uploaded by

    PistolStar Tailored Authentication
    159 views32 pages
    PortalGuard’s Flexible Two-factor Authentication options are designed as strong authentication methods for securing web applications. PortalGuard leverages a one-time password (OTP) as a factor to further prove a user's identity. The OTP can be delivered via SMS, email, printer, and transparent token. Configurable by user, group or application this is a cost effective approach to stronger authentication security. Tutorial: http://pg.portalguard.com/flexible_two-factor_tutorial

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    PortalGuard’s Flexible Two-factor Authentication options are designed as strong authentication methods for securing web applications. PortalGuard leverages a one-time password (OTP) as a factor to further prove a user's identity. The OTP can be delivered via SMS, email, printer, and transparent token. Configurable by user, group or application this is a cost effective approach to stronger authentication security. Tutorial: http://pg.portalguard.com/flexible_two-factor_tutorial

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    159 views32 pages

    Two Factor Authentication

    Uploaded by

    PistolStar Tailored Authentication
    PortalGuard’s Flexible Two-factor Authentication options are designed as strong authentication methods for securing web applications. PortalGuard leverages a one-time password (OTP) as a factor to further prove a user's identity. The OTP can be delivered via SMS, email, printer, and transparent token. Configurable by user, group or application this is a cost effective approach to stronger authentication security. Tutorial: http://pg.portalguard.com/flexible_two-factor_tutorial

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 32

    Understanding PortalGuards

    Two-factor Authentication: A Tokenless Approach

    Highlighting the Multi-factor Authentication Layer of the PortalGuard Platform

    By the end of this tutorial you will be able to

    Define PortalGuard
    Understand the need for two-factor authentication Learn about PortalGuards Two-factor Authentication Options See the step-by-step Authentication Process

    Know the technical requirements

    The PortalGuard software is a Contextual Authentication platform which is focused on enhancing usability, while maintaining a balance between security, auditing and compliance for your web, desktop and mobile applications.
    Usability Single Sign-on
    Password Management Password Synchronization Self-service Password Reset

    Security
    Knowledge-based Two-factor Authentication

    Contextual Authentication
    Real-time Reports/Alerts

    Before going into the details


    Configurable by user, group or application Configure One-time Password (OTP) length, expiration and format

    Send OTP via SMS, email, transparent token and printer


    Enforced for direct access to applications, VPN using RADIUS and during a self-service password reset, recovery, or account unlock

    No SMS gateway required


    Cost effective and competitively priced

    Tailored Authentication for an exact fit

    A P P L I C AT I O N S

    Two-factor Authentication is Used to increase security by requiring: Something you know

    AND Something you have

    Arent all Two-factor Authentication Solutions the Same? They will increase your security however
    Inflexible Low usability High total cost of ownership Tokens are expensive, forgotten and need replacement/repair

    ONE-TIME PASSWORD (OTP)

    Web/cloud application directly VPN connection using RADIUS Self-service password reset, recovery, or account unlock

    Transparent Tokens

    How do I choose?
    SMS

    Attack Prevention both passive and active


    Total Cost of Ownership

    Support/Maintenance Requirements Client-side Software


    Ease of Use Portability

    Increased security - add an extra layer of authentication to application access, VPN access, or during a self-service password reset Reduce Risk - prevent attacks by leveraging credentials which expire after one use Usability - leverage hardware a user already has for increased user adoption Eliminate forgotten passwords - leverage a username and OTP only as credentials

    Configurable - to the user, group or application levels


    Flexible - multiple OTP delivery methods available

    HOW IT WORKS

    PortalGuard provides flexibility


    Allows you to configure whether the enrollment will be forced or able to be postponed x number of times by the user.

    Step 1: 7: 6: 5: 4: 3: 2:
    PortalGuards loginin thetosends the OTP tocontinue. expired web-application. The user entersaccessaOTP they received and and data. On. that was presented when user visits the This PortalGuard screen user attempting toauseclicks Log OTP is angains server isthe web-application an example of The user enterstheir username and clicks the users mobile phone The user is prompted for a password and OTP. never 5-10 Once the expired OTP an SMS. withinused. seconds, in the form ofis entered, the user is denied access and prompted to cancel the process or request a valid OTP.

    Step 1:
    PortalGuards login screen is presented when a user visits the web-application.

    Step 2:
    The user enters their username and clicks continue.

    Step 3:
    The PortalGuard server sends the OTP to the users mobile phone within 5-10 seconds, in the form of an SMS.

    Step 4:
    The user is prompted for a password and OTP.

    Step 5:
    The user enters in the OTP they received and clicks Log On.

    Step 6:
    The user gains access to the web-application and data.

    Step 6:
    This is an example of a user attempting to use an expired OTP that was never used. Once the expired OTP is entered, the user is denied access and prompted to cancel the process or request a valid OTP.

    RADIUS Support:
    An internet standard that was designed primarily to authenticate remote users
    Cisco Juniper Citrix Checkpoint

    Network Access Server (NAS) = RADIUS Client

    PortalGuard = RADIUS Server


    User accounts defined locally LDAP Authentication X.509 certificates RADIUS

    Step 1:
    The user attempts to connect to the NAS/firewall using either a browser or VPN client software and is prompted for username and password.

    Step 2:
    The NAS communicates the credentials to the PortalGuard server using the RADIUS protocol. Step 3: The PortalGuard server validates the users credentials against its configured user repository (e.g. Active Directory).

    Step 4:
    The user attempts to connect to the NAS/firewall using either a browser or VPN client software and is prompted for username and password. Step 5: PortalGuard replies to the RADIUS request with an Access-Challenge response that includes a custom message that should be displayed to the user and a random identifier (the state) that the NAS will send back to PortalGuard to identify the same user session.

    Step 6:
    The NAS displays the custom message requesting the user to enter the OTP that was sent to their mobile device.

    Step 7: The user enters the OTP from their mobile device and submits it to the NAS.

    Step 8:
    The NAS communicates the credentials to the PortalGuard server using the RADIUS protocol. Step 9:

    The PortalGuard server replies to the RADIUS 2nd request with an Access-Accept response.

    Step 10: The NAS accepts the users authentication and the VPN tunnel/session is established. The user is then able to access internal resources (e.g. crm.acme.com).

    Configurable through the PortalGuard Configuration Utility:


    Delivery format, including From, Subject and Body fields Expiration, aka time-tolive (TTL) Length Format
    Numeric characters only Upper/lowercase characters Upper/lowercase & numeric characters Upper/lowercase, numeric and symbol characters

    TECHNICAL REQUIREMENTS

    A MSI is used to install PortalGuard on IIS 6 or 7.x.


    This version of PortalGuard supports direct access and authentication to cloud/browser-based applications, only.
    .NET 2.0 framework or later must be installed (64-bit OS only) Microsoft Visual C++ 2005 SP1 Redistributable Package (x64) IBM WebSphere/WebSphere Portal v5.1 or higher Microsoft IIS 6.0 or higher Microsoft Windows SharePoint Services 3.0 or higher Microsoft Office SharePoint Server 2007 or later Microsoft Windows Server 2000 Microsoft Windows Server 2003 (32 or 64-bit) Microsoft Windows Server 2008 (32 or 64-bit) Microsoft Windows Server 2008 R2 The network appliance must support RADIUS as an authentication option The network appliance must support the Access-Challenge response type as well as the State and Reply-Message attributes PortalGuard must be licensed for RADIUS support End-user enrollment of mobile devices or challenge answers must be performed external to the RADIUS protocol

    THANK YOU
    For more information visit PortalGuard.com or Contact Us

    You might also like