1. RSA SecurID November 10, 2005

2. Two-Factor User Authentication Most Common Application

3. Why Focus on Authentication?
Authentication is the essential foundation for trusted business process
Establishes trust by proving identities of the participants in a transaction
“On the Internet, no one knows you’re a dog”
Also: Authentication is a core competency of RSA Security Inc.!
NON-Repudiation!

4. Why Focus on Authentication?
Authentication is the foundation for other critical services
Authorization / Access Management
Audit/Compliance
Personalization
Business policy: liability, assurance for transactions
Applications and services: access control and authorization
Presentation / Personalization: what the user sees
Authenticated Identity
(user, device, application, group, organization)
Also: Authentication is a core competency of RSA Security Inc.!
Defining relationships through quality of experience
Relationships between identities and information
Relationships between people, groups, and organizations
Source of graphic: Burton Group, “Enterprise Identity Management”, October 2002

5. Authentication Market Drivers
Expanding access
Increasing numbers of mobile workers and telecommuters
Extension of the enterprise network to third parties
Customers
Partners
Increased awareness of issues with online computing
“Willy Sutton effect”
Increase in sensitive information accessed remotely
High levels of internal compromise/theft
Growing security awareness
The problem with passwords
Passwords provide weak security
Multiple passwords are unmanageable
Passwords are surprisingly expensive
According to Frost & Sullivan, these are the top drivers for authentication technologies.
This list can reasonably be simplified into 3 high-level drivers:
Expanding access
Increasing value of online information -- Willy Sutton was a famous bank robber from the 1930s; when asked why he robbed banks, he reportedly answered “because that’s where the money is”
The problem with passwords
There’s no argument about the reality or impact of expanding access.
However, the reaction to the increasing value of information has been slow -- an August 9, 1999 article in Info World (“Sorting Out Security”) refers to it as a “creeping pressure to secure their companies’ crown jewels.”
Likewise, the recognition of passwords as (a) weak and (b) unmanageable at large scale has been slow, but is increasing.
[D. Brink, 5/1999]
Source: RSAS, adapted from Frost & Sullivan

6. Authentication Choices Relative Strength
PIN +
PIN
PIN
PASSWORD + + +
Password Policy
POLICY +
All of us need to be able to ask the right questions to determine which level of authentication is most appropriate for our customers … and to be able to explain and defend the relative positioning of various authentication alternatives.
Single factor
Two factor
Three factor
Weaker
Stronger

7. RSA SecurID Authentication Solution
Calculates passcode
Authentication Agent
User enters Passcode (PIN + token code)
User Authenticated!
Authentication Manager

8. RSA SecurID Time Synchronous Two-Factor Authentication
RSA Authentication Agent
RSA Authentication Manager
Seed
Time
Algorithm
Cisco PIX, ASA, Routers
Seed
Time
032848
Algorithm
Same Seed
Same Time

9. RSA SecurID Authenticators
RSA SecurID Hardware Tokens
Key fob
Standard card
PinPad
USB Hybrid
RSA SecurID Software Tokens
Windows PC
Microsoft PocketPC
Palm Handhelds
BlackBerry Handhelds
Wireless Phones

10. RSA SecurID Common Applications

11. Typical Uses for RSA SecurID VPN Applications
Corporate Network
Encrypted tunnel through public network
Internet
VPN Gateway
VPN Client

12. Typical Uses for RSA SecurID Application Control – perimeter defense
Corporate Network
FTP, HTTP, SMTP, IM, Peer–to-Peer
Firewall

13. Typical Uses for RSA SecurID Web Access Control
Corporate Network
Internet
Web Server
Web Browser

14. Typical Uses for RSA SecurID Restrict Administration Functions
Corporate Network
Internet
Access Devices
Admin Console

15. Remote Access Auth Agent 5.3 for Web streamlines authentication to OWA
SecurID passcode prompt replaces the password

16. Citrix – No Password Required!
Citrix Web Interface 4.j0 ships in April
For Citrix Web Interface 4.0, users only need to supply a username, domain, and PASSCODE!

17. RSA SecurID Appliance Secure and Simple

18. Bundled Pricing Options
RSA SecurID Appliance Bundled Solution An all-in-one solution for Small to Medium size businesses
Easy to Purchase
Solution bundle up to 250 users
Includes h/w, s/w, tokens, and maintenance
Easy to Deploy
Installs in 15 minutes
Solution ready in <1 hour
Easy to Manage
Easy to Upgrade
Customer support from RSA
3-yr Tokens
RSA SecurID Appliance
SW License
1YR HW Warranty
What is an appliance?
“A(n) …. appliance is a single-board computer with a hardened operating system, a limited application set and no user software installation”
Penetration of appliances
10% of servers in small businesses
5% of servers in midsize businesses
Gartner analysis
Some SMEs lack awareness of the benefits of appliances
But 40% of SMEs will be using appliances (either in house or via service providers) by 2005
ATT and other managed service companies have expressed interest in an RSA ACE/Server appliance
Server OS in SMBs
Dominated by Windows (75%), then Linux (10%)
1YR SW Main
Bundled Pricing Options
10, 25, 50, 100, 150 & 250 Users

19. RSA SecurID Appliance Key Features & Benefits
Purpose-Built Appliance
Hardened Windows® Server 2003
Disabled Components & Services
Hardened TCP/Stack
Limited Group/User Sharing Options
Application Hardening
Authentication Manager v6.0 Full Feature Set
Web Management Interface
Embedded Web Server (IIS 6.0) plus Authentication Agent for Web
Benefits
Lower TCO
Faster Implementation
Stronger Security
Full Functionality
Easy to Manage

21. Non-Appliance Bundles
Includes Authentication Manager Software and Tokens
AUTOPRO10, AUTOPRO25, AUTOPRO50
Supports Windows®, Unix and Linux
Maintenance sold separately
12 month 8X5
12month 24X7

22. What RSA Security’s Customers Say— from the recent The Info Pro survey
“It’s solid. It just works. High assurance of proper authentication.”
“Experienced, trusted.”
“The number 1 vendor in providing authentication.”
“Ubiquity makes support easy and reliable.”
“The server stays up. It is scalable and has a great track record.”
“Great for us. It is reliable and it works when it should.”
“Very solid and dependable.”
“Very impressed with RSA and their products. They are a great company and I always get the answers I need. They’ve been fantastic.”
“Their tech support is the model for a help desk and quality of support. They are the best I’ve ever seen.”

23.  2004 RSA Security Inc. All rights reserved
Award Winner 23
 2004 RSA Security Inc. All rights reserved