1. Stephen Crick Business Development Manager Tokenless™ Authentication

2. SecurEnvoy Overview UK company - Founded in 2003 Inventors of Tokenless ™ Authentication Represented in 38 Countries (and growing) 700 global customers ¾ Million End User Devices Pure Channel Partner Sales Model Private and profitable company

3. Who uses SecurEnvoy? © 2009 Copyright SecurEnvoy Ltd. All rights reserved

4. SecurEnvoy Products SecurAccessSecurICESecurPasswordSecurMail

5. Evolving User Base

6. Mobile Workforce Technology is driving mobility Consumer and Business devices are becoming the same thing Social Networking is driving communications and business Connect Anytime, Anywhere on-demand Make it Secure and not Complex

7. Simple Facts Usability – Consumer / End User

8. Simple Facts Versatility – Technology / Capability

9. Simple Facts Simplicity – Administration

10. Simple Facts Cost – Upfront / On-going

11. Two Factor Authentication Factor One – Something You Know Factor Two – Something You Have

12. Problems With Passwords “Social engineering” Finding written password –Post-It Notes –10 PIN’s a day! Guessing password / pin –Dog / Kid’s name / Birthday Shoulder surfing Keystroke logging –Can be resolved with mouse based entry Screen scraping (with Keystroke logging) Brute force password crackers –L0phtcrack

13. Are you Secure?

14. Protect Yourself / Company Compliance –PCI –Sox –HIPAA –Government / Military / Education –E-Initiatives Policy –Stronger Security It’s now Your Digital Profile! –Your money –Your identity

15. Adding Another Level Something You Know Something You Own Andyk P0stcode 234836

16. Deploying 2FA

17. Tokenless ™

18. SecurAccess

19. Tokens Vs Tokenless ™ Traditional Tokens Usability –Extra hardware –Usually extra complexity to login –Not globally recognised Simplicity –Nightmare to manage –Extra Servers –Extra Databases –Extra Security Required –Extra maintenance Versatility –Usually One solution per item Cost –Expensive upfront and ongoing Tokenless ™ Usability –Uses what you already have (5 Billion Phones globally) –Intuitive process for login –Everyone understand SMS and Phones Simplicity –20,000+ users deployed in an Hr –Uses what you already have NO Extra Servers NO Extra Databases NO Extra Security Required NO Extra maintenance Versatility –Can support multiple apps Cost –Around 60% cheaper

20. SMS or Soft Token

21. SMS - Reliability

22. SMS – Secure? Phone Trojans –Need to install on the phone? Seed Record Hacking –No seed records Man in the Middle –User alerted on login attempt –Session cookie is fingerprinted –OTP – once the code is used it is locked / changed SMS capturing –User alerted on login attempt –Without Username & Password what is the SMS for? –Unidirectional – not susceptible to DDoS attacks

23. One SMS Solution? Real Time –What is true Real Time Flash vs Pure Text –What if there is no network coverage? –What if there are delays? Pre-Load –Available Now –Multiple Code Options –Still Secure –Uses SMS protocol to simplify Web Gateway / Modem –Voice / SMS / Pager

24. SecurMail

26. Password Reset Traditional Method Separate Database of user information User Enrolls with security questions Mothers Name First School Child Name First job Street name Traditional approach User answers a random set of security questions EnrollmentPassword reset User resets password via API Password Reset Complete This approach circumvents any password history checking

27. SecurPassword All User data stored in LDAP (AES 256 bit) Supported LDAP servers: Microsoft AD Novell e-Dir Sun One Linux IBM Enrollment User Enabled upon SecurEnvoy server User sent automatic enrollment request User selects Security questions User provides Security answers User Authenticates with Two-Factor User enrollment process complete

28. Self Service Reset User enters passcode and security answer User enters new password User selects password reset link Password policy elements are displayed

29. SecurEnvoy Usability – Consumer / End User Versatility – Technology / Capability Simplicity – Administration Cost – Upfront / On-going

30. Case Study T-Mobile (UK) – Mobile Telecoms Company –RSA User – 2000 approx. Change? Cost / Complexity – admin contractors etc. –SecurAccess – 6000 approx. –Competition Cryptocard Swivel –Reasons for choosing SecurAccess Simplicity – Administration / Msoft AD integration Cost savings (initial and ongoing) –Other benefits Deployed over a weekend Scripted for all new users – self administrating

31. Case Study Sykhuspartner (Norway) – Health Services –New user requirement – 70,000 users –SecurAccess – 25,000+ approx. –Competition SMS Passcode RSA –Reasons for choosing SecurAccess Simplicity – Administration / Msoft AD integration Cost savings (initial and ongoing) Reliability for delivering SMS (pre-load) –Other benefits Now looking at SecurPassword – 70,000 users

32. Case Study Imperial Tobacco (Global) –RSA User & SecurAccess – 12000 approx. Change? Cost / Complexity –SecurAccess – 7500 approx. –Competition RSA Vasco –Reasons for choosing SecurAccess Simplicity – Administration Cost savings (initial and ongoing) –Other benefits Due to RSA breach moving all over to SecurAccess Ability to support SMS Gateways Delivery of SMS

33. Case Study