If implemented correctly in an IT environment, smart cards remove the need for static passwords, thereby removing the Achilles heel that leaves many organisations vulnerable to an APT attack. This is according to Julian Lovelock, Senior Director, ActivIdentity, a global leader in secure identity solutions, part of HID Global.
“If you don't feel that an OTP token solution is enough to cover your enterprise security needs, the next step is to complement it (or maybe even replace it) with a smart card solution. Smart cards don't require seed files, thereby removing one point of attack,” stated Julian Lovelock. “Furthermore, given a detailed use-case study and appropriate workflow implementation, smart cards can even make user's interaction with IT systems more convenient. And if you add single sign on capabilities and self-help systems you can also improve productivity and overall security awareness, not to mention cutting help desk costs.”
“But before going about adding all these security features on top of your IT environment, it is important to recognise that if you want your security systems to function and truly deliver value, they have to be considered in their combined entirety and even be integrated if that is possible,” continued Julian Lovelock.
“Using different security credentials, albeit secure ones, for each system will only confuse users and hardly contribute to increased security. A strategic decision needs to be made to choose one (or maybe two) security credentials that should be used across all systems. For instance, smart cards can be used to access computers, networks, applications, VPN, and even doors. If that’s not enough, OTP tokens can be used to complement the solution by providing secure access to web based email from Internet kiosks and other devices where smart card usage might not be possible.”
“With a proven implementation methodology and well-defined integration approach delivered by people with solid experience, it is possible to make all this happen without significant impact on applications, users or productivity,” concluded Julian Lovelock.
