christine_allen
asked on
Secure Token-two factor Authentication
Hello,
I was wondering if anyone out there is using a token to replace the username/password domain authentication process for internal users to access network resources? If so, can you recommend a provider? How difficult was the move? What is the second authentication factor either password or challenged response, etc.
Thank you,
Christine
I was wondering if anyone out there is using a token to replace the username/password domain authentication process for internal users to access network resources? If so, can you recommend a provider? How difficult was the move? What is the second authentication factor either password or challenged response, etc.
Thank you,
Christine
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
OTP - can be software or hardware authenticator. common one is securID. you need an authenticator server provision though so that this one time password is sync when you keyed in. See this comparison for summary
https://store.emc.com/Product-Family/EMC-Store-Products/c/EMCStoreProducts/layout?layoutType=false&page=0&grid=true&q=:relevance:ProductFamily:RSA%20SecurID%20Products&PID=EMC_PRD-RSASIDSAM-D99E_SPLSH
Phone based
- There is one called PhoneFactor that allows a server to communicate a one-time additional code with the user’s mobile phone at the time of access. It is now under Microsoft suite and support Azure Cloud (Amazon Cloud has MFA and using smartcard or token if I recalled correctly, is gemalto)
https://www.phonefactor.com/solutions.shtml
Some example using include https://2factor.musc.edu/2fa/
- And even google has apps for mobile called the authenticator
https://code.google.com/p/google-authenticator/
We do try to avoid going too complex with PKI and lesser footprint but at the same time able to scale and stay flexible. Hence smartcard wasnt always the liking though it is more secure compared to simple OTP...of course if machine has keylogger or browser MITM, the PIN and OTP can easily be siphoned ...