Comprehensive Password Management:
From Policy Definition to Deployment

Trevor Roskewich

Solutions Lead

Novell, Inc.

Paul McKeith

Solutions Lead

Novell, Inc.

Hal Henderson

Sr. Software Engineer NMAS

Novell, Inc.

Dave Horne

Mgr Auditing & Identity Services

Novell, Inc.

Overview

Planning and Deployment Methodology

Password Management with Novell Nsure® solutions

Benefits of Implementing a Password Management Solution

Current challenges of “Password Inflation” in Organizations

Challenges of “Password Inflation”

Access to multiple resources and applications requires users to remember many different passwords

User productivity is hampered by logging in and out of multiple systems with different passwords

As services are added, the problem is further exemplified:

Referred to as “password inflation” by Gartner, Inc.

Additional Costs of “Password Inflation”

Many passwords makes forgotten passwords more likely, resulting in increased administrative costs for password resets

Sensitive information may be jeopardized with weakened security

Users may ease their password burden by using simple passwords or reminders

Benefits of a Password Management Implementation

Ease of Use

Cost Reduction

Enhanced Security

Security Risk Assessment

Password Management Deployment

Password Management Design

Planning & Deployment Methodology
Password Management

Security Risk Assessment

Identify password-protected assets and their associated risks

Determine Requirements for Upgrading Password Management Capabilities

Prioritize Requirements

Establish Scope and Project Plan for Implementation

Password Management Design

Design technology and business implementation

Includes:

Communication Plan to users

Thorough testing process design

Password Management Deployment

Business and Technical Implementation

Includes:

Knowledge transfer to users and support groups

Nsure Password Management Solutions

Ease of Use

Password Synchronization with Nsure Identity Manager 2

Single Sign-On

SecureLogin (client), Novell iChain® (web)

Enhance Security

Password Synchronization, Single Sign-On

Enhanced Password Policies

NMAS Advanced Authentication

Cost Reduction

Password Synchronization, SSO, Password Self-Service

Enhanced Password Policies
for Universal Password

Available Policies include:

Min/Max characters

Repeatable/Consecutive characters

Exclude list

Expiration settings

Numeric/Special characters (!@#$%^`&*())

Require unique passwords

Forgotten Passwords

Password Policy Documentation:

www.novell.com/documentation/dirxml20/index.html?page=/documentation/dirxml20/admin/data/ampxjj0.html

Universal Password

Feature of eDirectory™ 8.7.3

Password is stored in an encrypted, but reversible format

Novell Modular Authentication Service (NMAS) policies determine how Universal, Distributed and NDS-hashed passwords are updated and maintained

They can be synchronized or isolated

Password Manager

Simple Password

LDAP

NMAS
Universal Password

NMAS Client

Apache/HTTP

DirXML®

eDirectory™

Proxy

iManager

ConsoleOne®

Client32™

NDS®

Password

Method

Simple

Password

Method

LDAP App

CIFS

AFP

Enabling Universal Password

Policy can be assigned to:

user

parent container

partition root

tree (Login Policy)

All password self-service (including forgotten password functionality) will be governed by the user’s effective policy.

Demo

Novell Modular Authentication Services: Features

Designed to offer many authentication methods to secure network resources

Password

Physical Device

Biometrics

Purpose is to verify the identity of those accessing resources

Advanced Logins with NMAS

Many bundled and third-party methods available

Multiple methods can be combined to access sensitive areas (Graded Authentication)

Device removal can force automatic logout (Secure Workstation)

Login Factors

Password authentication (something you know)

Universal Password, NDS password, etc.

Physical device authentication (something you have)

Smart Cards, Tokens

Biometric authentication (something you are)

Static (fingerprint, iris)

Dynamic (voice)

Demo

What is Password Synchronization?

A mechanism to replicate a user's password amongst multiple directories: eDirectory, Active Directory, NT 4, etc.

A password update in one system is applied to the other participating systems

Access Security is relaxed for sake of convenience

Password Synchronization with
Identity Manager 2.0 - Features

Unidirectional and Bidirectional Password Flow

Can enforce eDirectory and Connected System Password Policies on Synchronizing Passwords

Can check the synchronization status of a user's password

Includes several Password Synchronization scenarios

Includes User Password Self Service

Includes Forgotten Password Recovery

Can invoke notification or action on Password Set Failure

Password Synchronization with IDM 2

NMAS 2.3

Distribution

Password

Universal

Password

NDS

Password

Simple

Password

IDM 2

Connected

Systems

Demo

Password Redirection
Features

Feature of IDM 2 Platform Services and Linux User Management (Open Enterprise Server)

Authentication Modules for Linux, Unix and FreeBSD platforms

User authentication is redirected to eDirectory via LDAP

Local Store is bypassed

Demo

Single Sign-On (SSO)

Central store/management of multiple passwords

Authenticates to applications using stored credentials

User accesses with only one password

Client Single Sign-On With SecureLogin

Responds to credential prompts and completes authentication automatically

Accessed by workstation login

Securely store application credentials in eDirectory

eDirectory

Password Management -
SecureLogin

For automatic presentation to applications

Password Management -
SecureLogin

eDirectory

Application

Server

Provide
Credentials

Application
Starts

Launch
Application

Credential
Challenge

Client

Workstation

Log-in

How it Works: Login experience before Novell SecureLogin

Launch application

Credential challenge

Authenticate
to eDirectory

NSL presents credentials to application

SecureLogin retrieves credentials from directory

How it Works: Login experience after Novell SecureLogin

Application

Server

Client

Workstation

Directory

Password Management with SecureLogin

Novell SecureLogin manages a unique set of credentials for each application the user accesses

Passwords are not synchronized, allowing the enforcement of a password policy specific to each application

One userID and password is used to authenticate to the directory and the user’s credential store

Credential Store can be eDirectory, Active Directory or LDAP

Novell SecureLogin supports a myriad of applications

SecureLogin

Supported Applications

Web

Windows

Java

Citrix/Terminal Server

Host-based/Terminal emulator

Web Single Sign-On With iChain®

Store is in eDirectory or generated from rules

(e.g. form-fill based on eDirectory attributes)

Credentials (entered or stored) are passed on to back-end resources protected by iChain

Accessed by authentication to iChain proxy

Demo

Password Self-service

Complete password management experience for end-user

Change Password

Set hints, challenge questions/responses for password recovery

Forgotten Password Recovery/Reset

Change Password (End-user)

If challenge questions are answered correctly, end-user may set a password that fits policy criteria.

Change in policy voids old password

New password must conform to rules of assigned policy

Console displays rules to help users create compliant passwords

Forgotten Password: What is it?

End-User Self-Service for Password Recovery

User authenticates by providing pre-defined answers to Challenge Questions

Successful authentication allows one of the admin-defined recovery options:

Show hint on page

E-mail password to user

Allow password reset

Configuring Forgotten Password
Administrative

Challenge sets must be configured and assigned

Defines a set of questions that users provide responses to for password recovery

Mandatory and Random selection from a set

User provides responses to password hint and challenge questions upon first login to self-service portal

Configuring Forgotten Password
End-user

Demo

Question & Answer

These gray lines show the margins that need to be adhered too. If your slide content extends beyond the margins you may need to move to a full screen slide layout.

Most importantly keep the area under the “N” clear

Corporate color palette and margins

Yellow

Palette

Green

Palette

Blue

Palette

Gray

Palette

Misc

R 252

G 194

B 79

R 225

G 213

B 75

R 182

G 201

B 207

R 186

G 189

B 182

R 237

G 238

B 236

R 224

G 0

B 0

R 107

G 108

B 105

R 100

G 132

B 164

R 157

G 176

B 41

R 232

G 128

B 0

R 201

G 86

B 22

R 115

G 126

B 31

R 77

G 68

B 102

R 46

G 52

B 54

R 204

G 0

B 0

R 188

G 225

B 141

R 0

G 149

B 48

R 0

G 98

B 90

SUSE

Palette

2003-12-08T12:43:39