PasswordCourier Transparent Synchronization

Transcription

1 1 PasswordCourier Transparent Synchronization Courion s PasswordCourier provides added flexibility to increase usage and ROI through its Transparent Synchronization feature. This feature enables users to synchronize their own passwords using native password change tools in supported systems and applications. After authenticating with their existing password, users may select a new password in the native system s password change or expiration prompt. A listener on the system automatically intercepts this new password and tests it for policy compliance for each target system defined by an administrator to ensure successful synchronization.

2 Table of Contents 1. END USER CONVENIENCE HOW IT WORKS INSTALLATION CONSIDERATIONS SYSTEM REQUIREMENTS SUPPORTED SYSTEMS... 5 ABOUT COURION... 5 Courion s PasswordCourier provides added flexibility to increase usage and ROI through its Transparent Synchronization feature. This feature enables users to synchronize their own passwords using native password change tools in supported systems and applications. After authenticating with their existing password, users may select a new password in the native system s password change or expiration prompt. A listener on the system automatically intercepts this new password and tests it for policy compliance for each target system in the synchronization group (defined by an administrator) to ensure successful synchronization. Passwords for different systems and applications can be synchronized even when the user IDs are different, native system password policies are different, and password expiration frequency is different. And like all PasswordCourier activity, transparent synchronization actions are captured in detailed audit trails through automatic help desk ticketing or database logging. Users may then use the new password to authenticate to all target systems in the synchronization group. No administrative intervention is required. 1. End User Convenience For maximum security, password policies usually mandate frequent password expiration. Despite the maximum 30- day lifecycle recommended by security experts, frequent password expiration can result in several issues that often deter companies from enforcing such a policy: Lack of coordination across corporate systems and applications often means that different password expire at different times, confusing users and increasing the volume of forgotten passwords Inconsistent password change interfaces and password policies, unique to each system or application, confuse users and may result in unsuccessful password changes or account lock-outs. Password expiration warnings are ignored by users who then find themselves locked out of the system or application. Courion s Transparent Synchronization feature addresses all of these issues by enabling users to use the native password change utility on a supported system and have that new password automatically synchronized with any system, application or Web server set up by the administrator. Courion s Transparent Synchronization feature differs from other vendors solutions by providing the most flexible policy enforcement in addition to detailed logging and user notification. Once users successfully change their password using a supported target system (e.g. Windows NT), PasswordCourier propagates that password change through the remaining targets by following the same process as a self-service password reset. No steps are missed or regarded as unimportant. 2

3 All passwords are tested against the PasswordCourier strength checker before being changed on the synchronization targets and the trigger system. With a multitude of configurable policy tests, including password composition, length, dictionary and history, PasswordCourier can enforce stronger passwords than defined by the native systems. Only the targets defined by the administrator are reset. Administrators may configure PasswordCourier to synchronize only the available target systems or stop synchronization completely in the case of a failed synchronization. For example, if the targeted Unix system is down, all other systems in the Selective Synchronization group can either accept the new password or continue with the current password, depending upon the policy configuration. All user (e.g. name, department, ID number, ) and transaction data (client IP address, date, time, target systems) are automatically logged in a help desk trouble ticket or auditing database. The user is automatically notified via a customizable that the password change and synchronization has taken place. This notification may contain a list of all targets reset and may be leveraged to educate the user and further drive usage. Notifications can also be used to indicate failures on any platforms. 2. How It Works The user activates PasswordCourier Transparent Synchronization by simply using a native system tool to change the system s password. In this case, the user s identity is authenticated by the native system authentication (typically username/password). With successful authentication, the user is prompted to select a new password that meets corporate and application standards for password strength and history. Prior to completing the reset on the native system, the password is measured against the password strength settings configured for PasswordCourier s Transparent Synchronization. In this way, administrators are able to enforce password policies that may be even stronger than what the native system is configured for, and establish uniform policies across disparate native systems. Once the password meets the strength criteria established, the native reset is allowed to complete and users continue with their normal computing activities. On the PasswordCourier server, configuration parameters determine which additional systems that password should be synchronized to, as well as the account names for that specific user across the additional systems. The password synchronization takes place by leveraging the same Password Management Modules (PMMs) and secure communication channels that are used by all of PasswordCourier s other access options Web, DIRECT!, Telephone Access, Secure Kiosk, and Support Staff. Finally, end user notification of which resets were successful or non-successful is completed and the appropriate help desk ticket or database log entry is created/updated (as with all of PasswordCourier s features.) No administrative intervention is required for the secure password resets. 3

4 3. Installation Considerations Best practices from Courion s PasswordCourier customers indicate that self-service password management provides users with a more consistent approach that avoids confusion and offers administrators easier deployment and ongoing management. These issues should be considered before implementing Transparent Synchronization: All Transparent Synchronization solutions require installation and maintenance of software "listeners" for each system and application that will intercept and trigger the synchronization requests. No Transparent Synchronization solution offers listeners for all systems and applications. As a result, when users use a native tool to change their passwords on a system that doesn't have a listener (e.g. SAP R/3, Lotus Notes, PeopleSoft, SQL Server), they may incorrectly assume their new password was propagated to their other accounts. It is important to cleary communicate to the user community which passwords will be reset. This will help to avoid confusion and minimize help desk calls. When you synchronize all of your targets with the same password, this single password will need to be stronger and expire more frequently to prevent a hacker from gaining the "keys to the kingdom." A strong password that is harder to remember and expires more frequently will inevitably result in more user lockouts. With PasswordCourier you have the tools that enable you to require strong passwords that expire frequently. With strong, frequently expiring passwords user may lock themselves out more often. Courion DIRECT!, DIRECT! CP, Telephone Access Option and Secure Kiosk enable users to reset their own passwords, without calling help desk. 4

5 4. System Requirements 4.1 Supported Systems Transparent Synchronization can be initiated from: Microsoft Windows IBM iseries (formerly AS/400) ABOUT COURION Courion s award-winning Access Assurance solutions are used by more than 450 organizations and over 12 million users worldwide to quickly and easily solve their most complex identity and access management (password management, provisioning, and role management), risk and compliance challenges. Courion s business-driven approach results in unparalleled customer success by ensuring users access rights and activities are compliant with policy while supporting both security and business objectives. For more information, please visit our website at our blog at or on Twitter at Copyright 2011 Courion Corporation. Courion, the Courion logo, Access Assurance Suite, AccountCourier, RoleCourier, ComplianceCourier, PasswordCourier, ProfileCourier, and CertificateCourier are registered trademarks or trademarks of Courion Corporation. All other company and product names may be trademarks of their respective owners. 5