Cloud Services Depot (CSD) is a wholesale distributor of Managed Services software and private-label services for Managed Services Providers (MSP). It has a wide product portfolio from Hosted Kaseya software, private-label Help Desk, Project and NOC services. As you can imagine, there is a lot of sensitive information stored in the cloud using such services, and access to critical business resources across many different client networks becomes trivial if someone was able to share, steal or circumvent the portal password.
The team at CSD realize this, and have done something about it. They care about the security of their clients, and understand that to some of their partners, this risk is something that may need to be mitigated. Knowing that many of their clients already have our AuthAnvil Strong Authentication Server deployed in their organization, CSD has integrated AuthAnvil authentication right into their portal. And they did one better. Thinking through the typical business workflow of their clients, they architected it in a way to provide risk-based authentication decisions based on access needs.
What this means is that CSD clients can selectively decide WHO may need strong authentication, and who does not. Using AuthAnvil's web service API architecture they simply use secure SOAP/XML to communicate with their client's AuthAnvil server for accounts that have been configured in this manner. And because the authentication settings are applied on a per user basis, each user can authenticate to a DIFFERENT AuthAnvil server if necessary. This is important if you hire outside consultants from time to time and wish to have their CSD account to auth to their own AuthAnvil server. Of course, you can also use AuthAnvil's proxied delegation feature to do this, further giving you the flexibility to meet whatever security objectives you have in your organization.
The side benefit of this is CSD clients can keep their costs down with AuthAnvil, by only issuing tokens to those accounts that have privileges that may require the stronger authentication mechanism. This is a great usage of AuthAnvil, and one we are happy to see deployed in a cloud-based solution such as CSD. It applies strong two-factor authentication where appropriate, without burdening users who may not need it.
Here is what it looks like.
This new identity assurance component is included for all CSD customers absolutely free, and they now have integration guidance published here. This means you get to further leverage your existing investment in AuthAnvil without additional costs or requirements at CSD. By revoking a staff member's token in AuthAnvil at your office, you simultaneously revoke his access to CSD, eliminating any opportunity for an exiting employee from gaining access to all the sensitive information and client network access that CSD allows through its powerful cloud-based services. And of course, the risk of unauthorized capture and use of the critical portal password goes away, since without the unique one-time nature of an AuthAnvil passcode, an attacker cannot gain access.
Congratulations to Frank and his team at Cloud Services Depot. I am impressed that you have thought through you client's security needs, and adapted it to work directly with AuthAnvil. And as a thank you to all your clients, for the next month Scorpion Software will offer ANY CSD client that implements AuthAnvil in this way an additional three months of AuthAnvil subscription credit absolutely free.
Don't have AuthAnvil yet? Mention you are a CSD client when making your purchase and we will be pleased to offer you an installation session with one of our engineers absolutely FREE (a value of $150) that will not only install AuthAnvil for you, but also configure your CSD portal to take advantage of it. Need more information on how to get started? Let's Talk.
So if you haven't heard, a recent hack to RockYou.com exposed over 32 million accounts, including the user's passwords. This is one of the largest lists of real world passwords being used by people on the Internet. You can read more about this breach in an article in the NY Times.
Research of the password list by Imperva shows that the strength of passwords selected by users is extremely poor. Only 0.2% of users had what would be considered a strong password of eight or more characters that contains a mixture of special characters, numbers and both lower and upper case letters.
Worse yet is that nearly 50% of accounts used names, slang words, dictionary words or trivial passwords which makes it extremely easy to attack these systems and gain access. And further research is starting to show that many of these users are using the same weak passwords at several sites on the Internet.
So ask yourself this. How many of your peers are using similar weak passwords on your corporate network? We all want to believe we use strong password policies at work, but how many companies have relaxed policies for the sake of usability? Sadly, too many.
And people wonder why we are passionate about strong two-factor authentication at Scorpion Software. A dynamically generated one time password (OTP) that changes every time it is used is vital in a business, especially if remote access to information assets is available for the company. Why? Because as this breach has shown, the weakest link in access security is the human factor. People and passwords don't mix. That's why we developed AuthAnvil for the SMB space.
So it's time to purge the password problem. Let's talk about what we can do to mitigate this risk in your own business. Give us a call anytime. We would love to discuss this with you.
An interesting feature in Windows Server 2008 R2is RD Web Access. Formally called TSWeb, this is Microsoft's web portal solution that allows you to publish application over the web using RD RemoteApp. Imagine when you have needed to open an Office document while at home, only to find you do not have the same version as you do at work. Or when you need to work on your Simply Accounting journal entries, but don't have time to drive into the office. With RD Web, that isn't a problem.
Obviously, this can be a great risk to your business. Allowing applications to run remotely from the web is only as secure as the password. Someone who is able to share, steal or circumvent a password can gain complete access to the application, and more importantly the data, pretending to be you.
One way to reduce this risk is to enforce a requirement for the user to prove their identity through strong two-factor authentication (2FA). And this is where AuthAnvil comes in.
Scorpion Software is pleased to announce that we now have support for integrated 2FA right in the RD Web logon page on Windows Server 2008 R2. When a user browses to the RD Web Portal, they are confronted with their typical domain credentials along with a request for their next AuthAnvil passcode. In this way, you can gain the benefit of identity assurance while at the same time using the same business workflow as you have before for RD Web Access. Below is a picture showing this in action:
Of course, our RDWeb Logon Agent also has the ability of using risk based authentication decisions. You can selectively decide if certain users can gain access without the need of an AuthAnvil credential. In this way, you have the fine grained control that you need to roll out strong authentication to your remote users in a staged manner.
If you are using RD Web Access and would like to add AuthAnvil authentication to it, please make a request by opening a case in the Customer Portal. This is a FREE agent available by request to any customer with a current AuthAnvil subscription. We would be happy to help you roll it out.
