Locking down the remote user

Companies are still grappling with the issue of securing their users in the field. One response is simply to restrict access. But a combination of smart card technology and public key infrastructure may provide a more productive alternative.

Technology innovation has made remote computing an integral part of our everyday work life. There are, however, many hurdles that stand in the way of progress. The latest varieties of malware, spyware and viruses impact access to enterprise networks. International travelers feel at risk when traveling, as they face the threat of laptop theft and the inconvenience of less than reliable broadband connectivity. The list goes on.

Whatever the cause for concern, businesses are increasingly pressured to find effective ways to ‘lock down’ their remote users. While some approach the challenge by scaling back usage or restricting remote user access, the reality is that this is nothing more than a one step forward, two steps back approach.

Getting to know you
A key element in meeting the remote access challenge is creating a rock solid identity and access model. That has been an elusive target for many enterprises. We’ve seen a number of strategies for authenticating and authorizing users applied to improving VPN security, each of which has its own pros and cons. Some organizations are working with multi-password and other challenge response schemes, such as one-time passwords in an effort to lock down VPN access. The major complaint with these approaches is user acceptance. The number sequences are often difficult to read and enter. For schemes where the password is changed every minute, users often run out of time before they can complete the sequence.

IT managers have tried to address these issues by issuing ‘soft’ tokens on laptops or desktops that automatically generate and/or submit a password. This creates another kind of security issue, however, if the laptop is lost or stolen, or someone copies software from those machines to plan an attack.

Issuing fobs or tokens for user identification can leave organizations vulnerable to man-in-the-middle attacks. Hackers can intercept the password entry from the fob and appear to connect legitimately to the system.

A highly effective solution is one that combines sophisticated identity management and strong encryption with entitlement-based communication and access to system resources. It is generally acknowledged that the most effective way to do this is through the PKI (public key infrastructure) model, a powerful security scheme that employs a combination of cryptographic keys and is well suited for two-factor authentication implementations. PKI is effective because it uses two mathematically related keys – one public, one private. The public key is used to generate a digital certificate of identity that can be published and distributed. The private key remains secret.

While PKI holds the most promise in terms of network security, there are some economic and logistical challenges to be addressed. One issue is lack of portability. Once a certificate is issued, the private key material is generally stored on a specific computing resource. If the certificate is on a particular desktop, for example, users can only access that information through that one device.

It’s also very complex, and consumes considerable time and resources to develop in-house. A comprehensive PKI infrastructure would be difficult to establish in less than one year. However, many of these challenges can be addressed by leveraging a managed PKI service combined with smart-card enabled technology.

The power of PKI and smart card
Managed PKI services can help alleviate the administrative and financial burden for enterprises, while delivering the security levels required. Combined with smart-card technology, it is also a very effective approach to securing remote access without having to incur infrastructure changes or high costs.

Pocket-sized, fully encrypted devices are now available that can address a number of threat-related issues and enable workers to conduct business remotely and securely without the need to carry a laptop.

This technology, when combined with a managed PKI service, allows fully encrypted, secure access to enterprise networks from any location, without data ever leaving the boundaries of the corporate firewall. That means travelers can travel lighter and safer, and organizations can benefit from providing employees with inexpensive mobile access to data, applications and network resources from practically any Internet-enabled Windows-based PC in the world.

Octagon Capital Corp. in Toronto has deployed a device combining smart-card technology with a managed PKI infrastructure to more than 40 of its investment advisors. As a tamper-resistant technology, the device meets stringent security certifications and can only be operated through a multiple-factor authentication process. If lost or stolen, it is completely ineffective and can be deactivated remotely if required.

This level of security is allowing considerably more freedom for remote functionality than ever before. The managed PKI platform means that remote workers can now safely access stock quotes, client information and monitor accounts – none of which could have been performed through regular Internet access.

For organizations such as Octagon, having this level of security for remote access is becoming an integral part of improving and expanding services to clients, as well as ensuring business continuity. Scaling up to meet the needs of a growing number of users is simply a matter of deploying additional devices.

QuickLink: 078718

Jerry Iwanski is Chief Technology Officer at Route1 (www.route1.com).