SOFT TOKENS SERIAL NUMBER
SOFT TOKENS INSTALL
SOFT TOKENS PASSWORD

In a perfect world, using a serial number to match up a token with a specific user could be a useful way in reducing variables and controlling authentication from the start.īut ‘Assign, then distribute’ doesn’t have to be the more secure of the two. Organizations need solutions that are practical enough and secure enough to balance users’ behaviors and address the likeliest, most frequent and most impactful security concerns.Īn argument could be made that ‘Assign, then distribute’ is the more secure of the two methods. The longer answer is that-just like IAM broadly-distribution and authentication should meet your business needs. The short answer is that both methods can work-and that there is no ‘best’ model for distributing hardware tokens.

Whatever amount of ‘registration trust’ that’s used to authenticate a token becomes that token’s limiting factor over the course of its lifetime. Moreover, any trust that the business places in the token can’t be significantly higher than the initial trust the user creates during registration-that’s particularly true for FIDO tokens, as they can be sourced from anywhere. The trickier part comes in binding the token to a specific identity, which needs to occur securely. No need to worry about which token gets sent to which user.Īlternatively, users could go out and purchase their own tokens-including FIDO2 tokens. Even just mailing them is easier: somebody just has to mail one token (any available token) to each recipient. It’s also cost-effective: just have a bunch of unassigned tokens available for every user to pick up. This method works best if your security team has a way of authenticating users securely during the assignment process. The user receives exactly the token that belongs to them. The costs can be a bit higher because in this case, admins can’t ship the tokens in bulk.īut the higher cost might also buy greater security: admins can ship disabled tokens to users, then activate them once the user confirms receipt. In this scenario, an admin assigns a specific token to a specific user, then ships that token to the user (ideally with some tamper-evident packaging).

This is a good method for businesses that already have a secure delivery mechanism. It’s something that I wish businesses spent a bit more time on earlier in the process-because it’s another opportunity for businesses to develop IAM processes that meet their needs.īusinesses can choose between two methods for managing this step: 1. It’s an important question-and one that businesses spend a lot of their time weighing.Īnother question that’s equally important but that tends to be overlooked is: ‘How should we assign authenticators to users?’ During a recent webinar, I shared some of the factors that businesses should consider when deciding between hard and soft tokens. I’ve been helping SecurID customers configure their IAM processes for nearly 20 years, and by now it’s clear to me that every business has its own identity needs. The two methods for managing hard token distribution and assignment

SOFT TOKENS PASSWORD

That functionality alone can add up to big savings: at larger businesses, nearly 50 percent of IT help desk costs are allocated to password resets. Users can even reset their PIN via the SecurID Access Cloud Authentication Service MyPage.

SOFT TOKENS INSTALL

Employees may not want or be allowed to install business-related software on their private smartphonesīut hardware doesn’t need to be hard to distribute, hard to handle, hard to manage or hard to replace: SecurID hard tokens can be assigned, enabled, disabled and configured from the cloud.Soft tokens are typically deployed on smartphones-and while that’s handy for most use cases, in some instances, bringing a smartphone into a highly controlled or sensitive environment could be a non-starter.Hard tokens provide much higher protection for the cryptographic material (the seed) and reduce the chance of any malware accessing the token.There are several reasons why an organization may opt to use hard tokens: SecurID software authenticators work however and whenever our customers do, providing the simplicity, security and convenience every business needs to address its unique identity challenges.īut being the trusted identity platform means ensuring that we’re able to support every use case, and as easy as SecurID soft tokens are to use and manage, sometimes hard tokens are still the best way to go. Roughly 13,000 organizations use SecurID to verify that their 30 million users are who they claim to be.