What's in a password?

What’s in a Password?

Can password combinations put network security at risk?
A recent report* has shown that less than 1% of employee passwords are random sequences, with the majority of workers choosing simple combinations. These can easily be deciphered and therefore could put network security in jeopardy. For example, a startling 14% of passwords were found to be as basic as a first name and surname combination. e.g (JohnSmith)

The study also revealed more startling results:

• 8% of passwords contained place names – most included the area where the person lived or was born (LondonUK)

• 14% of passwords were purely numeric and in some cases consisted of consecutive numbers (12345)

• 25% of passwords were random dictionary words (computer)

• Another 8% or so were made up of keyboard patterns, short phrases, words within the email address, and repeating words (asdf, myblackcat, @apple, redred – respectively)

These results provide a concerning insight into how easily the security of networks can be breached, even when password complexity rules are put in place by system administrators. It also highlights the increasingly important role of identity management software in protecting businesses against these risks.

There are a number of solutions that can be put in place, one of which is two-factor authentication. This requires securing the primary login using a pass-card or biometrics. Users log-in by presenting a pass-card/biometric to a reader and entering a PIN code rather than the standard username and password. Combining a pass-card/biometrics and a PIN code ensures a much stronger authentication, minimising the possibility of a network breach.

Tools4ever’s Enterprise Single Sign On Manager (E-SSOM) offers full integration with all common two-factor authentication readers, such as HID, Mifare, Biometrie, Gridtoken, proximity-based devices and RFID readers. E-SSOM offers native integration with the driver software of the (card) reader and links the pass-card ID to the user credentials (username/password) in Active Directory. No additional software is required to create this link guaranteeing a user friendly and secure login for all users.

For more information visit http://www.tools4ever.com/products/enterprise-single-sign-on-manager/

*Source: The science of password selection by Troy Hunt

IAM: David versus Goliath

Towards the end of 2010, Gartner published its ‘Magic Quadrant for User Provisioning’ report. In it, Gartner outlines its vision for Identity & Access Management (IAM) for the near future as well as associated trends

But does this mean you should do business with them?. The Magic Quadrant draws a distinction between leaders, challengers, visionaries and niche players. In the User Provisioning quadrant, the market leaders tower above all other players. These leaders include global giants such as Oracle, IBM, Novell and CA, yet other vendors are closely grouped inside other quadrants. This seems to suggest that this elite group have a clear monopoly in this sector.

I have noticed more often than not, that when companies start IAM projects with solutions from elite vendors, they use a high-grade product as the centrepiece, and build an IAM solution around it. They often try to create a utopia that requires intensive modification of the IAM solution. They start by automating organisational processes (workflow management and RBAC) and then automate IT procedures for user account management across the network. The problem with this is that automating organisational processes is very difficult, and imputing the required authorisation information in an RBAC system is even more daunting. Also, organisational changes are bound to occur during the course of the project due to long lead times. As a result, these projects are often abandoned after a substantial investment has been made, or are only partly taken into production.

Therefore selecting a vendor belonging to this ‘elite group’ does not necessarily lead to a successful IAM project –something Gartner acknowledges in its report.  Elite vendors often use heavyweight project structures and impose a large number of conditions. Gartner notes that far too complex approaches tend to run IAM projects aground.

Gartner also highlights various issues, scenarios and requirements that an IAM vendor should cater for. Going against the norm, niche player Tools4ever, meets all these requirements. Its success can be attributed primarily to the following aspects, which correspond to the key factors identified by Gartner:

• The responsibility for the implementation is not divided between the vendor and implementation partner. For years Tools4ever has maintained that the success of an IAM implementation is determined by the skills and expertise of the IAM consultants involved and cannot be left to the implementation partner.

• A phased approach: One of the key elements of Tool4ever’s methodology.  By splitting up IAM projects into various smaller subprojects, slow progress can be prevented and solutions can be provided in number of days as opposed to the industry norm of weeks. IAM cycles can often be split up into steps, each of which will yield tangible results.

• Modularity: The technical solutions have a modular set-up that simplifies further development. This means preliminary results are achieved rather than endpoints.

• Flexibility: The IAM cycle usually starts with streamlining the current operation. Optimising existing processes will free up time and resources to focus on the next steps.

• An end-to-end portfolio: Tools4ever offers customers an end-to-end portfolio of solutions that have proven their worth in our customers’ production environments. Tools4ever is also just as proficient in the role of part supplier.

Thanks to Tools4Ever’s approach, virtually all projects are successful. Customers now find themselves in a situation where they can easily cater for future IAM trends or the next phase in current trends.

So, just like the age-old fable of David and Goliath- the underdog can come out on top. As long as they’ve got the right tools. 

Two-factor authentication

Tools4ever’s Self Service Password Management has always been available with a web interface, in order to allow users to reset their Active Directory passwords from an intranet or via the web. On the basis of a number of simple, predefined questions end-users can reset their password. Although this has been widely adopted in mostly educational establishments, some form of two factor authentication has been requested by many of our corporate customers.

On the 18^th of February we released SSRPM Security Module, which adds two-factor authentication via email. Two-factor authentication (TFA or 2FA) means using two independent means of evidence to assert an entity's identity to another entity.

When a user logs onto the Active Directory domain for the first time following an SSRPM deployment, as well as answering a question set configured by the administrator, they will also be asked to supply a private email address. If an end user should subsequently forget their password, they can answer the challenge questions in the standard way. However, before they can reach the final stage and submit a new password, they must first enter the PIN emailed to their private address. This scenario illustrates the basic parts of most two-factor authentication systems; the "something you have" + "something you know" concept.

Two-factor authentication secures the web interface already. But we intend to extend this even more by enabling the forwarding of PINS to mobile phones by SMS. Watch this space for further information!

Keeping Active Directory Clean

One of the issues that frequently arise, especially in larger organization, is the need to provide contractors, consultants and temporary employees with access to network resources and email.  The concept of automating the lifecycle by integrating with a Human Resource system breaks down because these types of employees are rarely entered there.

We have solved this dilemma numerous times for companies by implementing a web-based workflow.  The hiring manager access an internal web page and completes the relevant information  - name, department, type of employee, expected length of service, etc. Once the form is submitted, the IT or helpdesk can review the information and process it automatically. An email is delivered back to the hiring manager with the username, email address and initial password. 

The key element here to keep AD clean is the expected length of service date.  As that date approaches a notification can be delivered to the manager asking if the date should be extended. If yes, the manager clicks on a link in the email and can enter a new end date. If no, the process automatically disables the user on the last day of service. A manger can also be given an option to disable or terminate immediately if the person has already left. 

After sitting in a disabled status for a period of 60 to 90 days, the record can automatically be purged from AD.  Implementing a process like this saves time, potential licensing costs and increases security all while making life easier for the OIT department.

To learn more about this application of Identity Management and many others, please visit our website;

Manage Outlook Office Assistant without direct access to the mailbox

A common situation in organizations: an employee is ill and absent for a long period of time and his/her Outlook Assistant is not activated. Result: e-mails are not answered, poor service and angry customers.

Because of data protection, it is not possible to turn on the Outlook Office Assistant without direct access to the mailbox. Another employee must be aware of the login credentials of the absent worker to read e-mails, forwarded e-mails and turn on the Outlook Office Assistant.

That can create an insecure situation. However, this situation can be easily resolved with Out of Office Manager Tool (OOMT) by Tools4ever, http://www.tools4ever.com/products/out-of-office-manager/.

With OOMT, administrators or helpdesk personnel can turn on Outlook Office assistant wizard without logging into the mailbox of the user. This task can also be delegated to departments, even without additional admin rights.

It is also possible to integrate OOMT in Tools4ever’s User Management Resource Administrator (UMRA) in order to make a connection with the HRM system of the company. The HRM system keeps up with employees that are sick, on vacation or on business trip, and when an employee leaves the organization. Thanks to this integration UMRA can automatically install the Out of Office Assistant and also forward e-mail so they can be answered.

Professional handling of email traffic in your organization is guaranteed.

Active Directory, Controlled Assessment & UMRA

Traditionally, schools and colleges use UMRA to keep Active Directory up to date, either by reading information from a CSV file, or by dynamically connecting UMRA to their pupil information system such as SIMS, CMIS or SITS.

Part of Tools4ever's Identity Management Suite is UMRA Forms, a secure interface to quickly and accurately manage the life cycle of a user. However, when a school links Active Directory to their student information system, all student account changes are automated, with no need for manual intervention. This negates the requirement for UMRA Forms.

However, a couple of months ago we were approached by Adrian Edgar of Culford School in Suffolk with an interesting problem regarding controlled assessment. Adrian creates exam accounts for pupils, with home directories shared in the normal way to each user. In the home directory he creates a series of "Exam" folders, which the pupil should only access during a Controlled Assessment session. As a boarding school, the pupil may need to use their exam account outside of a controlled assessment period, so enabling and disabling the account as required is not a suitable solution.

What Adrian really required, was a way to control NTFS permissions on the exam folders within the home directory for each account. So, Tools4ever built a simple interface, delegated to teaching staff, that switches access to the exam folders on and off at the click of a button.

Now Adrian has shifted the tedious task of controlling exam accounts back to teaching staff. More importantly UMRA is logging every action to keep the auditors happy.

You can read more from Adrian on his blog here

Single Sign On

Back in July we were contacted by one of the leading Scotch Whisky Distilleries to discuss a project for Single Sign On. Following a brief online demo, the client purchased a small number of ESSOM licenses and entered into an agreement with Tools4ever to conduct a pilot. At this point I was somewhat disappointed that the customer purchased only a handful of licenses, but as the relationship blossomed, it transpired the customer had already been burnt by another vendor!

Oracle E1 and Active Directory 

Their main application, which provides access to all of the company’s activities from order processing through to delivery, is a web portal based on Oracle’s E1. The usernames and passwords for this application were not synchronized with Active Directory. As the system was managed by a team separate from the IT department, password resets created unnecessary and expensive downtime, coupled with end user frustration. The customer insisted that if we could not work with this web portal, the project would most likely be cancelled.

I started the project remotely from our offices in Gloucester and completed installation of the main ESSOM components by 9.30am. This comprises of a Windows Service, a database (from Jet through to SQL) and a small desktop component. The customer then gave me a walkthrough of the E1 system to give an understanding of the portal and at what point we needed to submit the username and password. Most of this was simple, however there was a self service page embedded deep within the web site that had challenged other vendors. Although I needed to brief another consultant we still completed the first phase by lunch time.

It was then time to put the call into the customer and show him what I had done. Never have I had such an excited and enthusiastic response following a live demo! The customer informed me that the other vendor had taken three months to reach the conclusion that they could not work with the self service page on the web site.

Single Sign On on core applications

We have now completed Single Sign On for three of their core applications. The web portal, a standard Windows executable and a Citrix published application.

The final phase was to install SSRPM, to enable end users to securely reset their Active Directory password from the Windows GINA. Now, the customer has a complete and effective system, ready to roll out to the enterprise.

Enjoyable work!

Tools4ever’s Enterprise SSO Manager (E-SSOM) is an organization-wide Single Sign-On software solution enabling end-users to log in just once, after which access is granted automatically to all the authorized network applications and resources. E-SSOM operates as an extra software layer intercepting all log-in processes and completing the details automatically. Once the end-user has logged into the network, E-SSOM takes over the log-in process further and initiates an automatic log-in to all the applications and systems to which the end-user has access.