Scorpion Software Blog

Scorpion Software's 2012 Holiday Schedule

Happy Holidays everyone! Everyone at Scorpion Software wishes you a Merry Christmas and Happy New Year.

Like many of you, Scorpion Software will be enjoying the festivities with family this holiday season. Below is a list of our hours of operation during the holidays, so you can adjust expectations accordingly:

• December 24th, 2012: 9am - 5pm PST
• December 25th, 2012: Closed except for emergency SERVER DOWN escalation
• December 26th, 2012: Closed except for emergency SERVER DOWN escalation
• December 27th, 2012: 9am - 5pm PST
• December 28th, 2012: 9am - 5pm PST
• December 31st, 2012: 9am - 5pm PST
• January 1st, 2013: Closed except for emergency SERVER DOWN escalation

As of January 2nd, 2013 we are back in the full swing of things.

If you need Emergency SERVER DOWN support please make sure you open a case at www.scorpionsoft.com/help so our support automation system can properly dispatch messages to staff so you can get a response in a timely manner.

For more information on our response times and what you can do to assist us in resolving your cases faster, please download our Scorpion Software Technical Support Guide.

Use multiple SoftTokens for easier access

Looking for easier access while using strong two-factor authentication? You can accomplish this by using multiple SoftTokens, one on your smartphone and one on a YubiKey. With the Grouped Users feature in AuthAnvil you can tie two SoftTokens to one user and simplify your access control.

If you already have an AuthAnvil SoftToken running on your smartphone, you may feel like you don’t want to give up the flexibility of having your authenticator on your phone. We understand that. We also know that you want fast access to the environments that you need to log into each day, and think you shouldn’t have to sacrifice that time savings so you can have another app on your phone.

So why not use both?

This is exactly what Grouped Users are for in AuthAnvil Two Factor Auth. Imagine you had a user with the windows account name of Bob. He has an iPhone and still wants the benefits of a YubiKey. Here is our suggestion:

• Create a Standard User called Bob-iPhone and assign a SoftToken to the account.
• Create a Standard User called Bob-YubiKey and assign a SoftToken to the account.
• Create a Grouped User called Bob and assign Bob-iPhone and Bob-YubiKey to the account.

At this point, you now have the ability to log into any resource that supports Bob with any of those three accounts. When you use “Bob”, you can use either SoftToken. In the audit system, you will get an event that says something like:

Grouped User ‘Bob’ was logged on by member ‘Bob-YubiKey’.

You can use this same methodology for shared accounts like “Administrator” or “root”, binding the authentication transaction with the actual account used. This is very useful when needing to audit just which technician logged into a critical account on a firewall, router or domain controller.

NOTE: When using two accounts bound together like this, the AuthAnvil licensing system sees this as two separate seats. You are not charged for the grouped user, but are charged for both accounts. The balance of cost vs. time saving in OTP entry has to be considered to ensure you are meeting your budget for authentication use. Most customers find the ROI if they log into more than five systems in any given day where an AuthAnvil credential is used. Take a look at your login workflow and account for this accordingly.

6 Tips for Happy Holiday Teleworking

Working from home during the holidays? Are you travelling this season to be with family and still need to finish some work back at the office? Here are some helpful tips to find the right balance so you can get the job done and spend quality time with family and friends this holiday season.

Tip 1: Make sure you have the logistics of working remotely figured out and tested ahead of time. It’s easy to pack up your tablet or laptop computer and head out to telework, but are you really prepared? How are you accessing company resources? Do you have the right permissions to all the files and programs you need to get the job done? Do you have a reliable internet connection? Head over to your nearest coffee shop to do a test run of your connections while enjoying a candy cane latte.

Tip 2: To be productive, find a dedicated space to work. There are many added distractions during the holidays and if you don’t separate yourself from them, you will get very little accomplished. You may end up spending twice as much time trying to get your work done as you try to accommodate your work tasks and family business at the same time. In the end both will suffer from lack of dedicated attention. Remove yourself to a private location and focus on what needs to get done - keep them separate.

Tip 3: Make sure you communicate back to the office. This may sound like a no brainer, but while you are remote you can easily become “out of sight, out of mind”. If your co-workers or supervisor are out of the loop you can quickly become disconnected. Keep everyone up to date on where you are at with your projects and looming deadlines. It’s also great to make sure you are on the right path so you don’t waste your holiday time on tasks that aren’t important.

Tip 4: Pace yourself. Don’t try to get everything done right away, or leave it to the last minute. Try and distribute your work time while teleworking to get the best results. If you have scheduled family gatherings or impromptu snowball fights happening in the back yard, participate! Plan your work activities around your family, friends or other activities. Christmas only happens once a year and you don’t want to miss out on great memories. Work while the kids are sleeping or while everyone is having their post turkey feast nap.

Tip 5: Make sure you have a plan. Snowball fights aside, you need to have a schedule and a plan to make sure you stay on task and get the work done. Find the right balance in your scheduling to accommodate work, rest and play. If you don’t schedule the time, it can be too easy to put it off and your work will pile up towards your deadline. Inform your family and friends of your schedule and let them know when you are not working, they have your undivided attention.

Tip 6: It is also very important to take the necessary security precautions while remotely connecting back to the office. You don’t want your remote session to be a potential open door to sensitive corporate information and assets. Never use un-trusted or public Wi-Fi, use a secure 3g, 4g or wired connection instead. Always lock your device while unattended. Enable two-factor authentication and single sign-on to access points that support it. Do not share passwords over email or write them down on the back of your aunt May’s famous gingerbread recipe, use a password manager. And if you are staying with family, do not use your 13 year old nephew’s computer that doubles as a Minecraft server to do your work on.

 

We hope that these helpful tips will take the guesswork out of teleworking for you. Remember, the goal is to find the right balance so you can work smarter and get the most out of this holiday season.

Join us in our Google+ Hangout today @ 3pm PDT where we will be discussing "Teleworking during the Holidays". We will sit down and have a candid chat with some of our customers about their thoughts on allowing staff to telework over the holidays and how this can be a real business opportunity in the coming weeks.

How are YubiKeys made?

Ever wonder how YubiKeys are made? In our controlled test lab, we were able to create one, in a not so traditional manner. Watch the video below to find out how.



For more information on AuthAnvil and YubiKeys check out www.scorpionsoft.com/yubikey. And if you haven't already checked this out download our Free eBook, "The Definitive Guide for using YubiKeys with AuthAnvil" and learn how AuthAnvil Password Solutions provides a solution that bridges the gap between security and usability.

Programming your YubiKey to support AuthAnvil

Using a YubiKey with AuthAnvil is simple. As far as AuthAnvil is concerned, it is simply another device that supports an AuthAnvil SoftToken. That means it uses the same license, and the same activation system.

When you receive your YubiKeys shipped directly from Yubico, download the AuthAnvil programmer for YubiKey. This is a Windows MSI package that can run on any Windows desktop or server that has Microsoft .NET Framework v3.5 or newer. You can even deploy the MSI using Active Directory Software Distribution Policies if you wish to permit entire departments or sets of organizational units the ability to program their own YubiKeys.

Combine that with the AuthAnvil Self Service Portal that is installed on your AuthAnvil server by default, you can remove a lot of administrative overhead and have the users take care of managing their YubiKeys themselves. It will even take care of enrollment and activation to your AuthAnvil environment.

TIP: Once a YubiKey is activated with the token programmer it will function no different than any other AuthAnvil SoftToken. All documentation, guidance and best practices will follow suit. Anywhere you see an AuthAnvil passcode prompt you enter in your personal PIN, and then touch the YubiKey to generate your one-time-password.

If you would like more information, head over to our YubiKey page, or download our FREE eBook for more great tips.

AuthAnvil SoftTokens and YubiKeys

A SoftToken on your mobile device is quite handy. However you may find youself re-typing your passcode too often during the day if you manage many different entry points. A great solution is to add a SoftToken to a YubiKey, so now you can enter that credential with a simple touch. Check out this video to learn more. 



For even more information, download our latest free eBook, " The Definitive Guide to using YubiKeys with AuthAnvil".

BYOD and the Security Risks to your Business

Most MSP’s and IT Service Providers rely on their staff’s ability to access company resources while working remotely. It allows greater flexibility for your employee’s and empowers them to work from anywhere. They may need to work from home due to bad weather or illness, or perhaps they are travelling to a customer and need to connect back to the office while on site. More often than not, the connection is done via the employee’s personal Smartphone or tablet. Bring Your Own Device (BYOD) is encouraged, as it cuts down on hardware costs for the employer and it gives freedom to the employee to use their personal device that they always have with them.

Regardless of the type of device used to access your company assets remotely, there is a risk. Using public WiFi to connect to your resources is one of the biggest security risks, due to the insecure nature of WiFi. Public environments where someone with malicious intent can view on screen activity is also a risk. Even when on-site at one of your client’s locations in a private environment, using that untrusted computer at their location to connect back to the office is a potential risk.

When taking every precaution using a personal mobile device, such as connecting only over a 3g or 4g network and only ever using SSL, the mobile device itself can be the primary target and weakest link in your company’s security.

The problem is with the known security vulnerabilities on the device’s outdated OS. 

According to the latest statistics from Gartner, Android now has a 72% market share of all mobile devices in Q3 of 2012. Of that, more than 50% of those Android devices are running on the Gingerbread OS (Android 2.3.6, last updated over a year ago). Now this represents a huge section of mobile users in the wild running an out of date and insecure OS. According to Kaspersky, Gingerbread is the most targeted version of Android for malware and Trojan SMS programs. Can you trust that your employees are updating their devices to the latest, most secure versions of the OS to avoid these vulnerabilities? For most Android users, Gingerbread is a dead end unless they buy new hardware, so upgrading isn’t an easy option.

The best practice is to use Two Factor Authentication for all remote access points to your business’s assets and those of your clients. This significantly reduces your risk. Even if that one time password is captured, due to lax security policies or vulnerabilities from an outdated employee mobile device, the credential can never be reused again to login to those assets.

Take a look at what devices your staff is currently using to remain productive outside the office and ask yourself; is there a potential risk involved? The answer is most likely yes. In the age of BYOD the problem will only further persist. Protect your business assets with strong authentication to reduce your risk to an acceptable level. Spend less time worrying about your staff’s woefully out of date and insecure mobile devices and focus on the business at hand.