SecurID Information. General Card Information. Card Precautions. Security Features FRED HUTCHINSON CANCER RESEARCH CENTER

Transcription

1 FRED HUTCHINSON CANCER RESEARCH CENTER SecurID Information General Card Information The SecurID card is a credit-card-sized microprocessor token that lets authorized users access the SCHARP secure web site. It calculates and displays codes that change unpredictably every 60 seconds. Card Precautions The SecurID card is rugged enough to withstand reasonably adverse conditions, but: Don t immerse the card or get it wet. Don t let it be exposed to temperatures colder than -5 or hotter than 120 F, nor to sustained temperatures above 90 F, to prevent excessive drift by the internal clock. Don t subject it to excessive (i.e., dangerous to people) electric or electromagnetic activity, including such radiation as microwaves, X-rays, or electrostatic shock. Don t drop it onto a hard surface, bend or otherwise stress it excessively. In particular, don t carry it in a pants pocket or put it in a wallet carried in a back pocket. The LCD is glass and can be damaged by too much pressure. If your card ever stops displaying new numbers, is lost, or stolen, please contact Rana Bonnice at (206) or rana@scharp.org as soon as possible. A new one will be issued and the old one disabled for security. Note that each individual is responsible for the SecurID cards issued to it. If one is lost or broken from negligence, the SC must be reimbursed for the cost of the card. Security Features The user authentication process used by SecurID is based on two-factor authentication - the concept of both physically having something (the SecurID card) and having to know something (your Personal Identification Number or PIN). With a conventional security system it is easy for someone to learn your password and log in under your identity. Requiring two factors ensures reliable identification and authentication. Page 1 of Fairview Avenue North, MW-500 P.O. Box Seattle, WA FAX (206)

2 User Responsibilities You are responsible for protecting the authentication factors entrusted to you. Users must make every effort to not compromise the security of the system. This includes not writing your PIN on your SecurID card, not leaving connected terminals unattended, etc. Keep your PIN secret and protect your SecurID token against loss and theft. Because this system creates an audit trail that cannot be repudiated, you may be held accountable for activities recorded identifying you as the perpetrator. Avoid the unauthorized use of your identity and privileges by protecting the secrecy of your PIN and the possession of your token. As such, we do not recommend sharing cards. Do not reveal your PIN to anyone. Memorize it; do not write it down. If your SecurID card is missing, if you forget your PIN, or if you think that someone knows it, report the situation to Rana Bonnice. SecurID Access The SCHARP network has different layers of security, depending on approval. SecurID can allow access to the SCHARP internal network via Terminal Window the HVTN secure website the SCHARP SCP server (secure file transfer) the SCHARP modem pool (including internet access) Remote Desktop (via Metaframe/Reflection X) Each SecurID card can be customized to grant permission to only the approved remote resources. Using Your SecurID Card: Preliminary Procedures A few steps must be taken when using the SecurID card to get into SCHARP. This document details the initial steps required in order to use SecurID, as follows: SecurID Initial Authentication Logging-in using SecurID Troubleshooting SecurID login problems. Further documentation is available that covers: Remote Access Overview How to Connect - ISP and Dial-Up Remote Access Features Page 2 of 6

3 Card Authentication The New-PIN Procedure In order to use your SecurID card for the first time, you must setup a PIN to authenticate the card for use. Once you are authenticated into the system with this password, you will be asked to select a Personal Identification Number (PIN). To begin the authentication procedure, you must have internet access and web browsing software that supports logging-in to secured (encrypted) web sites. Common browsers such as either Netscape or Internet Explorer allow encryption by default. RSA supports Netscape Navigator versions 1.1 or later and Microsoft Internet Explorer versions 3.0 or later browsers for authentication through the WebID authentication forms. Other browsers may work, but you should consult their manufacturers to make sure the browsers support HTML forms and Persistent Client State HTTP Cookies. 1. To connect to the SecurID authentication web site, point your web browser to the following URL: Enter your login name (username) as displayed below. Please be sure that it is in lower case only: Username: your SCHARP username PASSCODE: enter the numbers that are currently displayed on your SecurID card Then click the Send button. Your token is in New PIN mode. Enter a new PIN in the fields provided, then click the "Send" button. Use the "Reset" button to clear the PIN if you make a mistake. PINs must contain 4 to 8 characters and digits. 2. Select a PIN (password) You may choose any 4-8 character combination of numbers and letters. PINs are not case-sensitive: A is the same as a. PINs cannot start with a 0 (zero) or contain any non-alphanumeric characters (@#$%&, etc.). Do not create an obvious PIN like your address, birthday or phone number. Do not use your ATM bank card PIN. Type in the PIN that you have created. Be sure not to write this down. No one, not even the system administrator, can ever obtain your PIN except from you. If you have picked a PIN that is unacceptable or mistyped so the PINs do not match, you will get: Page 3 of 6

4 PIN Format Error: PINs must contain 4 to 8 characters and digits Either retype the PIN (for a mistype) or try a different PIN, making sure to meet the PIN requirements detailed above. If the system rejects your PIN twice, you will see the message: New PIN rejected. Please try again. and this new-pin session will be terminated. Wait for the cardcode to change and start over. Once your PIN has been accepted, you will see the message: New PIN accepted. You are required to authenticate with your new PIN. Please wait for the number to change on your token and then use it in the space provided. 3. Final Step: Login With New PIN You will be prompted to again enter a SecurID PASSCODE. Wait for your cardcode to change, and when that happens, you can login using the new PIN you just created. Follow the directions in the next section. Once you have successfully logged in using the web browser, you can close the application. Logging In Once you have setup a PIN, whenever the system prompts: Enter PASSCODE: it is asking for the combination of PIN followed by the number that appears on your SecurID card. For example, if your PIN is testing and your card is currently displaying , the procedure might go like this: Enter PASSCODE: testing [the PIN/numbers don t actually appear on the screen, or may appear as * s] If your PIN contains letters, they can be entered in either upper or lowercase: testing is the same as TesTINg. If you enter a valid PASSCODE you can access the system. If you enter it incorrectly, this appears: Access Denied. The ACE/Server rejected the passcode you supplied. Please try again. Page 4 of 6

5 Try again. Troubleshooting Unsuccessful Logins Once accepted, a SecurID PASSCODE can not be used again. If you try to login twice before the cardcode changes, you will not succeed the second time and will have to wait until it does change. For security purposes, SecurID cards are automatically disabled after three unsuccessful consecutive login attempts. If your card is disabled, contact the SecurID Administrator to have your card re-enabled for use. The Next Tokencode Prompt Sometimes after you ve typed your PASSCODE incorrectly more than three times, but succeeded at the last prompt, the system may ask you to enter the next cardcode that comes up to verify that the card has not been stolen: Enter the next cardcode: Wait until the card code changes, then go ahead and type it in, followed by <Return>. (Do not enter your PIN, just the number that appears on the card). Now you should be able to gain access. This request is not necessarily due to an error on either your part or the part of the SeucrID server; it is a step in the system s evasive-action strategies. This prompt may also appear if your card has not been used to login for a few weeks. Connecting to SCHARP Once your card has been authenticated for use (you have setup a PIN), you will be able to use it to connect to SCHARP remotely. For instructions on how to connect, refer to the Remote Access Documentation. Page 5 of 6

6 Quick Setup Guide You will need to authenticate your card (create a PIN) before you can use their SecurID cards for anything else. To do this, follow the steps listed below. 1. Connect your web browser to the following page: 2. Enter your username at the "Username" field. 3. Enter just the numbers shown in the LED on your SecurID card at the "PASSCODE" field and click the Send button. Note about Personal Identification Numbers (PINs): You may use the PIN you have been using. If you wish to use a new PIN, we strongly recommend that you give this some thought before hand. You may choose any 4-8 character combination of numbers and letters. PINs aren't case-sensitive: "A" is the same as "a". PINs cannot start with a "0" (zero) or contain any non-alphanumeric characters (@#$%&, etc). Don't create an obvious PIN like your address, birthday or phone number. Don't use your ATM bank card PIN. 4. Type in the PIN that you have chosen. If you have picked a PIN that is unacceptable, you will get: PIN Format Error: PINs must contain 4 to 8 characters and digits. Enter in a compatible password and click the Send button. 5. After you make up and enter an acceptable PIN, you will be promptedwith the following message: New PIN accepted. You are required to authenticate with your new PIN. Please wait for the number to change on your token and then use it in the space provided. As the message states, wait for your cardcode to change, and when that happens, you can log in using the new PIN, along with the SecurID number. Once you have completed these steps, you should gain access to the secured site and can close the web browser. Your card is ready for use. If you have any questions, please contact the SecurID administrator, Rana Bonnice, at (206) Page 6 of 6