Software Token Installation and User Guide 22 September 2017
Notices Following are policies pertaining to proprietary rights and trademarks. Proprietary Rights The information contained in this document is proprietary and confidential to Mastercard International Incorporated, one or more of its affiliated entities (collectively Mastercard ), or both. This material may not be duplicated, published, or disclosed, in whole or in part, without the prior written permission of Mastercard. Trademarks Trademark notices and symbols used in this document reflect the registration status of Mastercard trademarks in the United States. Please consult with the Customer Operations Services team or the Mastercard Law Department for the registration status of particular product, program, or service names outside the United States. All third-party product and service names are trademarks or registered trademarks of their respective owners. Disclaimer Mastercard makes no representations or warranties of any kind, express or implied, with respect to the contents of this document. Without limitation, Mastercard specifically disclaims all representations and warranties with respect to this document and any intellectual property rights subsisting therein or any part thereof, including but not limited to any and all implied warranties of title, non-infringement, or suitability for any purpose (whether or not Mastercard has been advised, has reason to know, or is otherwise in fact aware of any information) or achievement of any particular result. Without limitation, Mastercard specifically disclaims all representations and warranties that any practice or implementation of this document will not infringe any third party patents, copyrights, trade secrets or other rights. Software Token 22 September 2017 2
Summary of Changes, 22 September 2017 This document reflects changes associated with Software Token Download functionality of Mastercard Integrated Issuing 1.0 Description of Change First Draft Software Token 22 September 2017 3
Table of Contents Table of Contents Summary of Changes, 22 September 2017... 3 Chapter 1 Overview... 6 Chapter 2 Install the RSA Client Desktop Application... 7 Chapter 3 Download and Save the RSA Desktop Application... 8 Chapter 4 Install the RSA Desktop Application... 11 Chapter 5 Token Download... 15 Chapter 6 Forgot PIN... 18 Chapter 7 Forgot Token... 21 Chapter 8 Unlock User... 24 Chapter 9 Receipt and Upload of Software Token... 26 Chapter 10 Using the Software Token Application... 28 Chapter 11 Create a Taskbar Shortcut... 31 Chapter 12 Delete a Token... 32 Chapter 13 Using more than One Token on the same PC... 33 Chapter 14 Change the Token Name... 34 Chapter 15 Troubleshooting... 36 Chapter 16 Frequently Asked Questions about Software Tokens... 37 Why is Mastercard moving from a hardware token (a fob) to a software token solution for user authentication?37 Will the end user require any software to be loaded on his or her computer?... 37 Will the software token solution require the use of any physical device for authentication?... 37 How long will it take to set up a software token implementation?... 37 How do I obtain my software token?... 38 What are my internal integration costs for a software token implementation?... 38 Will I need to provide the software for this type of authentication to the end users?... 38 Is there a software review process?... 38 Can the software token solution support users working from different computers?... 38 Can multiple users share the same physical workstation?... 38 Can the software token solution be deployed on mobile devices?... 38 Can software tokens be used on personal computing devices?... 39 Software Token 22 September 2017 4
Table of Contents What if the user's PC is replaced due to a repair or upgrade?... 39 How do RSA SecurID Software Tokens work?... 39 Is there a fee associated with using two-factor authentication?... 39 Software Token 22 September 2017 5
Overview Chapter 1 Overview This document explains the process to login to the Mastercard Integrated Customer portal. The process for login to Agent Portal and Collection portal is similar to Customer portal. This document also provides guidelines on downloading, saving, installing, and using the RSA desktop application on a Windows and OS X operating system. Software Token 22 September 2017 6
Install the RSA Client Desktop Application Chapter 2 Install the RSA Client Desktop Application The following options are available for installing the application: Each user can install the application. This option requires that users have administrative rights to their PCs. NOTE: The screenshots and procedures in this document/guide may vary slightly depending on your operating system. Software Token 22 September 2017 7
Download and Save the RSA Desktop Application Chapter 3 Download and Save the RSA Desktop Application You will be using the 128-bit (AES) tokens. The RSA client desktop application to download is version 5.00. 1. Go to www.rsa.com. The page will look similar to the following image. 2. Note that the menu below provides links to various download based on the Operating System being used. 3. Click on the Microsoft Windows or Mac OS X option. RSA offers both a 32-bit (5.00) and a 64-bit (5.00) version of the application. Mastercard recommends that you download the 32-bit version which supports 64-bit operating systems. NOTE: Mastercard does not support the RSA Software on Mobile devices of any kind as noted below ***Choose the Software token application compatible with your Operation System and click on the Learn More tab and you will be routed to the RSA Software Token Authenticators download page**** Software Token 22 September 2017 8
Download and Save the RSA Desktop Application *Select the RSA SecurID Software Token Desktop Application that is compatible with your OS* 4. You may be presented with a user license agreement. You must complete that form before you can download the application itself. Please note: usage of the RSA application is free. Software Token 22 September 2017 9
Download and Save the RSA Desktop Application 5. Click Save when presented with the download options. You will be prompted to select the system folder in which to save the file. 6. Select the appropriate folder and click Save. 7. Click OK. 8. After you have downloaded and saved the zip file, you need to install the RSA application on your system. Software Token 22 September 2017 10
Install the RSA Desktop Application Chapter 4 Install the RSA Desktop Application After you have downloaded and saved the application, you need to install it. 1. Go to the folder where you saved the RSA Desktop Application Installation file and double-click on the RSASecurIDToken5.00.zip. a. The file is typically saved to the C:\Drive in the path below i. C:\Users\your user ID\Downloads 2. On the Welcome screen, Click Next. 3. If Windows7 is your operating system, click Next. Software Token 22 September 2017 11
Install the RSA Desktop Application 4. On the Place of Purchase screen, select the region where your company ordered the software, and click Next. 5. In the License Agreement screen, read the license agreement, and select I accept the terms in the license agreement. Click Next. ----Above 6. On the Setup Type screen, select "Typical to install it without the web browser plugin, and click Next. Software Token 22 September 2017 12
Install the RSA Desktop Application 7. On the Ready to Install the Program screen, click Install. Software Token 22 September 2017 13
Install the RSA Desktop Application 8. If Windows 7 is your operating system, click Yes to allow RSA to install the application on the PC, if prompted. You will see the following screen below. 9. When the installation is complete, click Finish. You do not need to restart your system. Software Token 22 September 2017 14
Token Download Chapter 5 Token Download NOTE: Token download must be done after clearing browser cache and relaunching the application in a new browser. 1. Click on token download link from the Integrated Issuing home page, you will be directed to the Login screen. 2. Enter the User ID and the temporary password (shared on Email, SMS) 3. Click Login. You will be directed to the change password screen. 4. Enter the Old Password. (Temporary Password) 5. Enter the New Password. (Refer the Password Policy to set your password) Software Token 22 September 2017 15
6. Confirm the New Password. 7. Click Submit. You will be directed to the Security Questions window. Token Download Software Token 22 September 2017 16
Token Download 8. Select the Security Question 1 of your choice. 9. Enter the Answer to the security question 1. 10. Select the Security Question 2 of your choice. 11. Enter the Answer to the security question 2. The security questions and their corresponding answers are required for retrieving password, PIN, re-downloading token, re-setting user ID, and unlocking user. 12. Click Submit. To download the token, 13. From the Integrated Issuing home page, 14. Click on the Token Download link, you will be directed to the Token File Download window. 15. Click on the Token Download link from the Token File Download window. A seed file will be downloaded on your local machine which you can save in any folder. 16. Double-click on the seed file for importing it to the RSA Application. You will receive an alert through Email and/or SMS with a temporary 4 digit RSA PIN. 17. Click Logout. From the Integrated Issuing home page, Software Token 22 September 2017 17
Token Download 18. Login to the application using your User ID and Temporary RSA PIN. 19. You will be directed to the PIN Change screen. From the PIN Change screen, 20. Enter the Passcode displayed on the RSA application. 21. Enter a New PIN. 22. Confirm the New PIN. 23. Click Submit. Your new PIN is set. You can now login to the Integrated Issuing 1.0 application using your User ID and the passcode generated using the new PIN. Software Token 22 September 2017 18
Forgot PIN Chapter 6 Forgot PIN You can retrieve the RSA PIN if required from this screen. To retrieve the RSA PIN: 1. Click on the Forgot PIN link from the Master Integrated Login Screen. 2. The Forgot PIN screen appears. Software Token 22 September 2017 19
Forgot PIN 3. Enter the User ID for which the PIN must be retrieved. 4. Click Submit. You will be directed to the Security Questions screen. 5. Enter the Answer for Security Question 1 & 2. 6. Click Submit. You will be directed to the OTP Verification screen. An OTP (one time password) will be sent through an Email and SMS to your registered Email ID and Mobile Number. 7. Enter the OTP. 8. Click Submit. The temporary PIN will be sent to your registered Email ID and Mobile Number. Login with new/changed PIN: From the Mastercard Integrated home screen. 9. Enter your User ID. Software Token 22 September 2017 20
Forgot PIN 10. Enter the PIN in the RSA application and generate the passcode. 11. Enter the Passcode. 12. Click Login. You will be directed to the PIN change screen. From the PIN Change screen, 13. Enter the Passcode. (The passcode can be generated by using the temporary PIN). 14. Enter New PIN. It must be 4 numeric digits in length 15. Re-enter the New PIN to confirm. 16. Click Submit. Close the browser before logging in with the New PIN. Software Token 22 September 2017 21
Forgot Token Chapter 7 Forgot Token You can retrieve the Token if required from this screen. To retrieve the Token: From the Mastercard Integrated home screen, 1. Click on the Forgot Token Link. The Forgot Token screen appears. 2. Enter the User ID for which the token must be retrieved. 3. Click Submit. You will be directed to the security questions screen. 4. Enter the Answer for Security Question 1 & 2. 5. Click Submit. An OTP will be generated and sent to your registered Email ID/ Mobile Number. You will be directed to the OTP verification screen. Software Token 22 September 2017 22
Forgot Token 22. Enter the OTP. 23. Click Submit. You will be directed to the Token File Download screen. 24. Click on the Token Download link from the Token File Download screen. You will receive an alert through Email and/or SMS with a temporary 4 digit RSA PIN; simultaneously a seed file will be downloaded on your local machine. 25. Double-click on the seed file for importing it to the RSA Application. 26. Click Logout. From the Integrated Issuing home page, 27. Login to the application using your User ID and Temporary RSA PIN. 28. You will be directed to the PIN Change screen. From the PIN Change screen, 29. Enter the PIN in the RSA Application to generate the Passcode 30. Enter the Passcode. 31. Enter a New PIN. Software Token 22 September 2017 23
Forgot Token 32. Confirm the New PIN by re-entering it. 33. Click Submit. Your new PIN is set. You can now login to the Integrated Issuing 1.0 application using your User ID and the passcode generated using the new PIN. Software Token 22 September 2017 24
Unlock User Chapter 8 Unlock User A user gets locked after 6 unsuccessful login attempts. The unlock user screen enables you to unlock the user. To unlock a user: From the Mastercard Integrated Login screen, 1. Click on the Unlock User link. The Unlock User screen appears. 2. Enter the User ID. 3. Click Submit. The Security Questions screen appears. 4. Enter the Answer for question 1 & 2. 5. Click Submit. An OTP is generated and sent to your registered Email ID and Mobile Number. Software Token 22 September 2017 25
Unlock User The OTP Verification screen appears. 6. Enter the OTP. 7. Click Submit. The user is unlocked. Software Token 22 September 2017 26
Receipt and Upload of Software Token Chapter 9 Receipt and Upload of Software Token NOTE: You must have the RSA SecurID Software Token application installed before importing your token. Refer to the installation instructions at the beginning of this guide if you need to download and install the application. 1. Your company will receive your software token(s) through an encrypted e-mail message. You can simply double-click the token (containing one or more.stdid extension-or.zip file) to import it. You can also run the application and click Import from File to browse to the location of your token file to import it. 2. The system will display the following dialog box after you have successfully loaded the software token. 3. Refer to the section Changing a Token Name later in this document to change the token name. Software Token 22 September 2017 27
Receipt and Upload of Software Token 4. After the software token has been installed, close any RSA SecurID Token applications that are open. ** If you are migrating from a hard token, use the same PIN that was previously issued to you. Software Token 22 September 2017 28
Using the Software Token Application Chapter 10 Using the Software Token Application NOTE: You will need to import a token before you can use the RSA application. If you start the application before importing the token, the system will display the Import Token screen. Please see the previous section for more information. To generate a token code (passcode): 1. Click the Soft Token icon shortcut on your desktop Or Click the Start menu button, point to Programs, then RSA, then RSA SecurID Token, then RSA SecurID Token. The system will display a window for you to enter your PIN. You should see your token serial number in the left-hand corner of the RSA application: 2. Enter your 4-digit PIN in the PIN field and click the arrow: Software Token 22 September 2017 29
Using the Software Token Application 3. RSA will start generating 8-digit passcodes. The passcodes change every 60 seconds. You can click the Copy button, or manually enter the 8-digit code into the password field of the application to which you are trying to authenticate (Mastercard Integrated, Mastercard Connect, MasterCom, etc.) without the space. NOTE: Do not select and CTRL+C to copy; do not select/highlight the passcode to copy. Only click the Copy button: 4. Enter your User ID in the User ID field in Mastercard Integrated Issuing 1.0. Enter the 8-digit passcode currently visible in the RSA software without the space into the Passcode field. If you have used the Copy button, right-click on the field and select Paste. Software Token 22 September 2017 30
Using the Software Token Application 5. You should now be successfully logged in. If you experience problems, please perform the troubleshooting steps below. Contact support if you are still unsuccessful. 6. For any subsequent uses of the token, you must wait for the token to change. The application will continue to generate a new passcode every 60 seconds until the last code is reached, after which you will be prompted to re-enter your PIN. 7. To re-enter your PIN, click the Re-enter PIN button located on the RSA SecurID application window. Software Token 22 September 2017 31
Create a Taskbar Shortcut Chapter 11 Create a Taskbar Shortcut 1. From the start menu, click All Programs, point to RSA, then RSA SecurID Token, then RSA SecurID Token 2. Right click on the RSA SecurID application icon and then click Pin to taskbar. Software Token 22 September 2017 32
Delete a Token Chapter 12 Delete a Token 1. Open the RSA SecurID Software Token application. 2. From the Options menu on the RSA SecurID Software Token application, click Manage Token, then Delete Token 3. A confirmation message will appear 4. Click Yes to delete the token. You will receive a confirmation message that the token has been deleted. Software Token 22 September 2017 33
Using more than One Token on the same PC Chapter 13 Using more than One Token on the same PC Note: The RSA SecurID Software Token application can support multiple users on the same PC by using more than one token. Multiple tokens must be loaded onto one PC before you can select a different token. To change tokens: 1. From the Software Token application, locate the section at the top that identifies the token currently in use: 2. Click the drop-down arrow and select a different token: 3. Enter the PIN associated the selected user s token. 4. Enter a PIN and then click the arrow to the right of the 8 digits that are generated. Software Token 22 September 2017 34
Change the Token Name Chapter 14 Change the Token Name Tokens are pre-assigned with user names, to change the name associated with a token: 1. Launch the RSA Software Token application. 2. On the options menu, click Manage Token, then Change Token Name. 3. Type the new token name into the change name window 4. Click OK. You will receive confirmation that the token name has been changed. Software Token 22 September 2017 35
Change the Token Name Software Token 22 September 2017 35
Troubleshooting Chapter 15 Troubleshooting Contact your institution s PC help desk for help with the following: Installation of the RSA client desktop application Using the RSA client desktop application Software Token 22 September 2017 36
Frequently Asked Questions about Software Tokens Chapter 16 Frequently Asked Questions about Software Tokens Why is Mastercard moving from a hardware token (a fob) to a software token solution for user authentication? We continue to hear from customers that they want an authentication solution that is more robust and flexible, with much faster deployment and a longer life span. Software tokens have a 10-year life span versus hardware tokens that have a two-year life span. Will the end user require any software to be loaded on his or her computer? Yes, a small application from RSA Security will need to be installed on the user's computer. Once the RSA software is installed, the software token seed issued by Mastercard can be loaded. Will the software token solution require the use of any physical device for authentication? The RSA SecurID Software Token software is a small application that must be loaded on the end users' computer and used for authenticating into Mastercard systems. Hardware tokens (fobs) are no longer required when using this authentication method. How long will it take to set up a software token implementation? If installed on the user's computer, software tokens can be issued within hours, Software Token 22 September 2017 37
How do I obtain my software token? The software token can be downloaded from the website www.rsa.com. What are my internal integration costs for a software token implementation? The RSA SecurID Software Token software is a free download from RSA. Because software tokens have a 10-year life span, there also is less time and effort associated with managing fobs. And since the software token functions similarly to a hardware token, user training is minimal. Will I need to provide the software for this type of authentication to the end users? The small RSA application can be provisioned to the users' computer either by the user's organization support group, or by the user downloading software from the RSA site. Please note that the user must have administrator access to his or her PC to install the software. Additionally, the RSA software should be a d d e d to the customer's approved software list for standard PC builds. Mastercard can provide a process f or implementing the software token solution. Is there a software review process? Thousands of companies have successfully deployed the RSA Software Token authentication solution. If requested, Mastercard can work with the customer's Information Security and/or desktop support group. Can the software token solution support users working from different computers? Yes, the same software token "seed" record (the secret key used to generate the authentication code) for a given user can be installed on multiple computers, thereby supporting the needs of users who move from one workstation to another and call centers Can multiple users share the same physical workstation? Yes, the software token seeds for multiple users can be installed on the same computer. Users also will have a unique PIN known only by the token holder that is associated with their specific software token seed. Can the software token solution be deployed on mobile devices? Software Token 22 September 2017 38
Frequently Asked Questions about Software Tokens Currently Mastercard does not support the installation of the RSA application or the import of any SecurIDs on client based mobile device, PDS or smartphones, the software token solution can be used only on Mastercard-issued mobile devices. For security reasons, the mobile device must be under Mastercard s control to remotely lock or wipe the device. Can software tokens be used on personal computing devices? No. The software token solution is only available for company-issued devices that support remote deactivation capabilities. Software tokens are not to be installed on a user's personal device that is outside company control. What if the user's PC is replaced due to a repair or upgrade? During the initial installation, the user will receive an e-mail from Mastercard containing the seed file for the software token. It's important for the user to keep this file in a secure location. If a repair or upgrade to the user's workstation is required, the RSA software and the seed file will need to be re-installed on the user's new computer. How do RSA SecurID Software Tokens work? Organizations that want to use RSA s SecurID Software Token for two-factor authentication will need to download and install a small client application from RSA on each company-owned device on which their users will work. Mastercard will issue (via secure email) token files for users for that organization who have requested products that require two-factor authentication within www.mastercardconnect.com.to learn more about software tokens, refer to the installation and user procedures in this guide. Is there a fee associated with using two-factor authentication? Organizations that elect to use hardware tokens will pay a quarterly fee per token. Software tokens may be used free of charge. Software Token 22 September 2017 39