DIRECTOR, MEMBER SERVICES

Transcription

1 #32071 TO: FROM: ALL MYOCC AND ENCORE USERS SHEILA ZAK DIRECTOR, MEMBER SERVICES DATE: JANUARY 11, 2013 SUBJECT: UPDATE: RSA SECURID REPLACEMENT Phase 2 of this project will be installed in February 2013 instead of January All users are still required to complete phase 1 by creating their security profile. The instructions to do so are provided below. OCC uses RSA SecurID to manage user access and authentication for MyOCC and ENCORE. RSA has become an administrative burden because it requires software tokens to be downloaded onto users computers and it must be compatible with certain Internet browsers and versions of Java. In February 2013, OCC will replace RSA SecurID with Entrust IdentityGuard which is a tokenless Strong Authentication technology that will provide multifactor authentication for end-user and device authentication. In addition, this will also include the implementation of a self-service portal for security profile maintenance. This project will impact all external users to MyOCC and ENCORE. The new security solution will not change a user s current username, password, or entitlements. OCC will install this project in three phases which are described below. OCC will offer WebEx training for each phase of the installation. The Operational Readiness Testing (ORT) environment is available now. PHASE 1 Phase 1 requires all external users to create their security profile in Entrust which will be used to authenticate a user. This will consist of providing an address and mobile phone number along with answering three security questions. OCC has installed a Manage My Account Profile link onto MyOCC to access and create their Entrust Security Profile. Listed below are the procedures for creating the profile.

2 1. Click on the Manage My Account Profile link on the MyOCC page. 2. Users must provide an address, and may additionally provide a mobile phone number to receive text (SMS) messages. This information will only be used to send onetime verification codes in the event a password needs to be reset or the user is connecting from an unrecognized location.

3 3. Users must select three predefined security questions and provide answers to each.

4 4. After the security questions are selected and answered, a verification code will be sent to the default location previously selected. 5. The verification code (sent via or text (SMS) message) should be entered into the Security Profile.

5 6. The final step will allow the user to proceed to MyOCC to login or update their newly created security profile. Phase 1 will also include the implementation of a self-service account administration portal for limited account administration. Self Service Account Administration Upon successful login to MyOCC, users will be able perform some changes to their security profile. A link will be added to the MyOCC home page which will allow users to change their security question and answer parings, change their default location of where one-time verification codes are sent, or change the address and mobile phone number where the code is directed. The registration process in Phase 1 will only collect and store security questions, s and/or mobile phone numbers. This information will be effective after Phase 2 is installed. Until that time, users must continue to contact the OCC to reset a password or download an RSA software token.

6 PHASE 2 In February 2013, Phase 2 will replace RSA SecurID with Entrust IdentityGuard for authentication to critical infrastructure systems, services, and applications. Authentication Method One of the authentication mechanisms used by Entrust is called IP geo-location authentication, which means that a user is authenticated based on their computer s IP address and the users geographical location. The first time a user attempts to access an area in ENCORE that requires higher level authentication, a user will be prompted to enter a one-time verification code. Users will be required to authenticate their computers the first time and if they access ENCORE from another computer and/or a new geographical location. Verification Code The security questions and verification code are tools used to verify a user. The verification code is a one-time code that is sent to the default location selected by the user, or text (SMS) message. Upon receipt of the verification code, a user will need to enter the code to gain access to a secure area of MyOCC or ENCORE. This code is a system generated code which is created after a user has successfully answered their security questions. Below is an example of a verification code sent via and text.

7 Sample Text Sample From: MyOCC Verification Code: 8NT856E6 Expires: Fri Oct 26 12:37:40 CDT 2012 Enter online at prompt Self-Directed Password Reset The self-directed password part of this project will be installed at a later date. A new memo will be posted when the functionality becomes available. If you have any questions regarding this memo, please contact Member Services Help Desk at the following numbers: or Within Canada, please call Clearing Members may also us at memberservices@theocc.com.