SSO and Strong Authentication: How OhioHealth Built a Paperless Hospital
In this case study presentation, Joe Greene, IT Security Director at OhioHealth, explains how he and his team approached employee access challenges when they laid the IT foundation at Dublin Methodist, a brand new paperless hospital. More than a year after the doors opened at Dublin, their project is a proven success and there are many best practices and lessons learned to be shared with viewers. Download the webinar today!

Identity 360 - An Imprivata Blog

filter by tag: biometric identification

The "best" authentication technology?

May 29, 2008 at 3:47 pm by Rik Van Bruggen

I work in the field for Imprivata, working with customers day in, day out. And the single most heard question I get relating to our products is: "which authentication technology should I use". Fingerprint? Yeah that's good, I will never forget my finger, right? Or a prox card? Even better, because I can use that to open doors, pay at the lunch cashier, and so forth. Nah - maybe a smartcard is better. Or a one-time-password token. Or ...

And then the discussion usually derails. It's hard to choose a strong authentication token. There is so much choice. And it can cost a *lot* of budget to acquire and implement. So let's think about this for a while? What is the "best" authentication technique? Is there such a thing?

Of all of the suggestions I made above, none of them is ideal. All of them have pros and cons, and really, all of them have very different characteristics. In my mind, there are three/four things to ask yourself when choosing an authentication technique:

Does it meet your security objectives? Is the tool as secure as you want it to be? Can you use if for other security initiatives (eg. encryption, pre-boot auth...)? Does it feature login AND logout functionality?
Does it meet your productivity objectives? Does it work as fast and as reliably as you want it to, always?
Does it fit into your budget? Anything is possible - but it all comes at a price...
Most importantly (in my opinion): will your users ACCEPT it. At the end of the day, any authentication tool can be compromised, on purpose or by accident. But the likelihood that it will be compromised really depends on how well your users will take care of it. If they leave their token lingering around, with a small piece of sticker tape glued to it with the pin code on it, then what have you really achieved? User Acceptance is everything.

Therefore, my recommendation to my customers always is to test and retest any authentication technology, at a small yet significant scale, and to get the end-user buy-in before you roll out any authentication technology to your users. And luckily for you, Imprivata OneSign has built-in support for almost any type of authentication technique out there. That's just another reason why OneSign stands out - it allows you the freedom of choice among authentication technologies, it allows you the one that matches your organisation, not the reverse.

Tags: strong_authentication biometric_identification

Five Identity Management Trends to Watch

May 19, 2008 at 11:00 am by David Ting

I'm often asked what seems like a simple question: "what's new in identity management?" As simple as it is, it's a big question so here are five trends that I see out there for identity management... at least for now.

#1: The Pendulum Swing is Back to Thin Client Computing
Technology changes including the 64-bit computing platform, multicore processors, cost effective broadband connectivity, dirt-cheap storage, combined with rising costs of energy, cooling and space are forcing a re-evaluation of how we put computing power at the hands of the user. Virtualization has simplified the management of shared computing resources and to propel the shift back to thin client computing. This has put even greater emphasis on how you manage identities, control access and provision applications managed within these virtualized environments. The shift to centrally-managed, centrally-hosted environments, enables (and is driven by) greater mobility and flexibility in workflow and workforce - that puts new pressures on how identity management policy, procedure and technology all work together to create a secure yet flexible environment.

#2: De-Perimeterizing the Network: Softening of the Network Continues
Perimeters are no longer rigid, hard and securable, so firewalls, IDS and IPS are no longer adequate on their own. Defense in depth security comes to mind as the boundaries of the perimeter blur and soften with insider threats rising in prominence. The notion that the network can be secured is rapidly melting away as business practices force opening up access to partners, customers and remote workers. The emphasis shifts to knowing who is doing what with your data and applications regardless of where they are geographically. Strong authentication and contextual authorization including the notion of location-based authentication becomes even more critical in this environment as one tries to extend enforcement of access policies to critical corporate resources.

#3: Enterprise Biometrics Realizing its Potential
Look around you... everything is being biometrics-enabled - laptops and computer hardware are now manufactured with fingerprint readers nowadays, for example. Cost as a barrier to widespread adoption is no longer the issue as scanners become commoditized. With this change, enterprises are re-examining how best to deploy strong authentication within their organizations. Storing enterprise biometrics safely to support a mobile workforce is the key to unleashing the true power and usability of biometrics. Interoperability and assuring the privacy concerns for users that their biometric identities are properly secured are critical to widespread adoption. The time for biometrics is now.

#4: Enterprise-Level Functionality Moves to the Mid-Market
ESSO, strong authentication and access control have become mainstream. All of these technologies are becoming more cost-effective for the midmarket and easier to implement, making them more attainable. The economics are there for midmarket companies to achieve the security that was once thought of as an enterprise luxury, strengthening the security of our overall ecosystem of business worldwide. Joel Dubin hits this point well in his SearchCIO-Midmarket.com piece. The more midmarket companies can deploy strong security practices and technologies, the tougher time the bad guys have to wreak havoc.

#5: Higher Emphasis on Insider Threats Drive a Focus on Data Protection and Compliance
At Kuppinger and Cole's 2^nd European Identity Conference it was clear the events at Society Generale have elevated everyone's sensitivity to how much damage can be perpetrated by an insider. One speaker described succinctly when he said that "banks have money, a lot of money and often some of their employees feel they should have some of that money as well." It is clear insider threats will only become more frequent as we open up more access to critical systems. It is simply too lucrative and too easy to hide behind the anonymity of the digital identity - after all how are they going to prove it is you that has accessed the system when you used your colleague's logon credentials. As an enterprise, you better know who your people are, how they are getting on the system, what they are doing, and from where. The insider threat will be amongst the top threats in 2008, and is already a key discussion within identity management circles.

So let me put the question out to you? What are the trends that you are seeing out there? Chime in on the comments section, or drop me a line.

-David Ting, CTO