Home / server / Questions / 44746
Accepted
user13846
Asked: 2009-07-24 09:42:50 +0800 CST

Which multi-factor access tokens are most suitable for use in an enterprise network?

  • 772

I am interested in exploring all of the options to enable multi-factor domain authentication on an Active Directory network. I exclude no technologies from this question however I do prefer simpler implementations to elaborate configurations. Fingerprint readers would be ideal since the end-user is generally up to speed on not losing their fingers. Small hard tokens would also work such as smart cards, usb tokens etc...

security active-directory token

5 Answers

  1. Best Answer

    Personally I would avoid fingerprint readers they are not as reliable as you would think - the glass gets smudges, the user cuts thier figers, etc. Also they can be defeated by a Gummy Bear.

    The standard right now seems to be Smart Cards or some sort of Token with a random number - RSA being the biggest name. Personally I am partial to Tokens as I can hook them to my key chain and not have to worry about another card. I would start with RSA since they are the biggest name, and would be the most likely to integrate into all of your systems.

    • 6

  2. I've worked a bit with the ActivIdentity 4Tres AAA solution and using it for Citrix remote access. It allows the use of the usual PIN-entry fobs/cards, this single button credit card-sized generator, and also SMPP text messaging. Since the tokens can be pricey, it may be desirable to use SMPP messaging to deliver the one-time password to the cell phone registered with the Active Directory user.

    • 2

  3. Phone Factor. Works especially well in environments where employees have cell phones, blackberries.

    • 1

  4. As an end user, I found the Yubikey (http://www.yubico.com/products/yubikey/) much easier to use than the RSA SecurID (http://www.rsa.com/node.aspx?id=1156).

    End user experience is not the only consideration, and as others have pointed out, there is an ecosystem of products supporting SecurID. Looking over the IT fence to the security guys, however, SecurID never seemed particularly easy to manage.

    As for "something you are" component, it does seem that the current set of widely available fingerprint readers may not be as securely implemented as a CSO would require.

    • 1

  5. I'm also a fan of one time password type tokens like RSA's SecurID as they are basically quite simple and generally easy to manage at large scales. The traditional key-fob token provides a good level of authentication that is better than plain old passwords but they fail to authenticate both ends of the transaction and unless they are wrapped in a decent outer layer that ensures mutual authentication the overall system isn't robust. Using such tokens over any unsecured network without a secure wrapper is just asking for a Man-In-The middle attack. Active USB type tokens \ Smart Cards do a much better job of this but they are much harder to support - resetting\re-issuing\initial provisioning are all a lot more work but for high value situations they are a much better solution.

    • 0