CIO Canada — Companies are still grappling with the issue of securing their users in the field. One response is simply to restrict access. But a combination of smart-card technology and public key infrastructure may provide a more productive alternative.
Technology innovation has made remote computing an integral part of our everyday work life. There are, however, many hurdles that stand in the way of progress. The latest varieties of malware, spyware and viruses impact access to enterprise networks. International travelers feel at risk when traveling, as they face the threat of laptop theft and the inconvenience of less-than-reliable broadband connectivity. The list goes on.
Whatever the cause for concern, businesses are increasingly pressured to find effective ways to "lock down" their remote users. While some approach the challenge by scaling back usage or restricting remote user access, the reality is that this is nothing more than a one-step-forward, two-steps-back approach.
Getting to Know You
A key element in meeting the remote access challenge is creating a rock-solid identity and access model. That has been an elusive target for many enterprises. We've seen a number of strategies for authenticating and authorizing users applied to improving VPN security, each of which has its own pros and cons. Some organizations are working with multi-password and other challenge response schemes, such as one-time passwords in an effort to lock down VPN access. The major complaint with these approaches is user acceptance. The number sequences are often difficult to read and enter. For schemes where the password is changed every minute, users often run out of time before they can complete the sequence.
IT managers have tried to address these issues by issuing "soft" tokens on laptops or desktops that automatically generate and/or submit a password. This creates another kind of security issue, however, if the laptop is lost or stolen, or someone copies software from those machines to plan an attack.
Issuing fobs or tokens for user identification can leave organizations vulnerable to man-in-the-middle attacks. Hackers can intercept the password entry from the fob and appear to connect legitimately to the system.
A highly effective solution is one that combines sophisticated identity management and strong encryption with entitlement-based communication and access to system resources. It is generally acknowledged that the most effective way to do this is through the PKI model, a powerful security scheme that employs a combination of cryptographic keys and is well suited for two-factor authentication implementations. PKI is effective because it uses two mathematically related keys—one public, one private. The public key is used to generate a digital certificate of identity that can be published and distributed. The private key remains secret.
