Symantec VIP Overview

Symantec VIP Overview

Symantec VIP OverviewTable of ContentsAbout this guide.6What is the VIP Authentication Service?. 6What is strong authentication?. 6What are credentials?.7Using a credential. 8Using one credential with multiple sites. 8Credential types.8Time-based credentials. 8Hardware security tokens. 8VIP Access for Mobile credentials.9Event-based credentials.9Security cards. 10Related resources. 10Documentation.10Files. 10Integration guides and binaries.11Planning for your VIP Authentication Service deployment.12How to plan for VIP Authentication Service. 12Impact of VIP credential deployment.12Creating a Product Marketing plan. 13Defining the credential rollout scope. 13International, Domestic user base. 13User access channels.14Selecting applications. 14Defining credential fulfillment strategy. 14Out-sourced.15In-house.15Creating a Marketing Program for VIP credential rollout. 15Marketing two-factor authentication. 15Educating users about credentials.16Educating users that credentials are available.16Educating users on how to order a credential. 16From the web site.16From the Help desk. 16Defining credential branding. 16Design credential branding - VIP Authentication Service branded or co-branded. 172

Symantec VIP OverviewDefining credential shipment packaging. 17Choosing an envelope. 17What should be printed on the envelope. 17What’s inside the envelope.17Designing a One-sheet Brochure or Instruction Sheet. 17Shipment Planning. 18Creating Policies and Procedures for Credential User Interaction.18Ordering a VIP Credential. 18How does the user order a VIP credential?.19What do you do when a user orders a VIP credential?.19Activating a VIP Credential. 19How does a user activate a VIP credential?.19What do you do when a user has received a VIP credential and asks you to activate it?. 19Logging in with a VIP Credential.19What does the user do to log in with a VIP credential?. 19What do you do when a user logs in with a VIP credential after activating it?. 20What do you do if a user logs in with a VIP credential that isn’t yours?. 20What do you do if a user shares a VIP credential?.20Handling Credential Validation Errors.20What does the user do when attempting to log in with a VIP credential and the authentication fails?. 20What do you do when a user can’t log in with a VIP credential after activating it?.20Forgotten Credentials.20Lost or Broken Credentials. 21Providing Temporary Security Codes. 21Defining Business Requirements for Credential Rollout.21Developing a Security Policy. 22Set Security Policies. 22Security Policy Considerations. 22Mitigating Risk.22Legal and Risk Management. 22Developing a Privacy Policy. 22Defining Technology Requirements. 22Defining Network Operations Requirements. 23Resource and Capacity Planning. 23Hardware Procurement. 23Network Security. 24Ordering Pilot Credentials.24Planning for Help Desk Integration to Support Credentials.24VIP Help Desk User Functions.24Choosing a Help Desk Implementation. 243

Symantec VIP OverviewDeveloping with the Web Services API.25Using VIP Manager.25Developing a QA Plan for Validation and Test.25Planning for Back-end Integration for Credential Fulfillment. 25Allocating Resources for Development and QA. 25Usability. 25Network Operations.26Integrating Credential Fulfillment Functions. 26Creating a Support Plan for VIP Authentication Service.26Identifying Support Resources.26Identifying Support Staff.26Support Training Plan. 27Defining a Support Policy. 27Defining Support Channels. 27Defining Support Scope. 27Providing Expertise to Support Credentials.28Defining the Customer Support Role.28Security Considerations. 29About Facility Security. 29Potential Security Targets with VIP Authentication Service. 29Recommended Best Practices.30Authentication. 30VIP Authentication Service Machine Security. 30Credential Security. 30Supporting and Maintaining VIP Authentication Service. 32Support Preparation.32Support and Maintenance Tasks. 32Describing Credentials to Your Users. 32Sample FAQ. 32Why should I use the hardware credential?.32What exactly is the hardware credential?. 33How do I use the hardware credential?. 33Will it work with my computer?. 33How does the hardware credential work?.33What if I lose or break my hardware credential?. 33Where should I keep my hardware credential?. 33How much does it cost?. 33Support Processes.34Login Support. 344

Symantec VIP OverviewActivation Support. 34Validation Support. 34Synchronization Support. 35Providing Users with Temporary Security Codes. 35Hardware Credential Shipping Support. 35Restoring a Locked Out User. 35Managing Credentials (Hardware Security Tokens or Security Cards). 35Managing Credential Distribution. 36Maintenance Preparation.36Renewing Your Account.36Copyright Statement. 375

Symantec VIP OverviewAbout this guideThis document includes a high-level description of VIP Authentication Service and how it can be used. It describes the VIPAuthentication Service, its planning recommendations, uses, and deployment methods. This document also describes theVIP Authentication Service components, and architecture.This guide is intended for users of all levels. It is the “read me first” book for administrators and IT personnel in yourorganization who install the VIP Authentication Service and roll it out to end users. This overview is intended for readerswho are involved in the organization, development, planning of the VIP Authentication Service deployment process.What is the VIP Authentication Service?VIP Authentication Service is a comprehensive solution that provides identity protection for consumers interacting online.VIP Authentication Service integrates with your existing Web site to strengthen and streamline your network security andhelp prevent account takeovers.Users are provided with a more secure login that employs strong authentication, including factors such as hardwaresecurity tokens, security cards, and Mobile Access credentials which, in addition to username and passwordauthentication, keep unauthorized users out of your network.NOTEA token is another word for a credential (a security application stored on a hardware security device, securitycard, mobile phone, or computer). A one-time password (OTP) is another word for a security code (a uniquecode that a credential generates to protect an end user’s identity).What is strong authentication?Single-factor authentication uses passwords alone. With VIP Authentication Service in place, users can more securelylog in to virtually any application on any network through a two-factor authentication process. VIP Authentication Serviceadds a layer of security by requiring users to employ a credential such as a hardware security token or security card, or aMobile Access credential to access online accounts, in addition to a username and password.Two-factor authentication virtually eliminates security problems associated with using passwords alone. A common formof two-factor authentication is a bank debit card. To purchase something using your debit card, you provide something youknow (your PIN) with something you have (the debit card itself).A potential attacker needs both your PIN and debit card, and without possession of both these factors your account isprotected from unauthorized use. Typical authentication factors are:Table 1: Authentication factorsDefinitionExampleWhat you knowPasswords, ATM PINWhat you haveHardware security token, security card, debit card, mobile deviceWho you areFingerprint, iris scanCredentials detailed in this guide and supported by the VIP Authentication Service can include hardware security tokens,security cards, or mobile devices.6

Symantec VIP OverviewVIP Authentication Service allows users to authenticate themselves before accessing your secured Web sites. Whileusernames and passwords can be guessed or otherwise discovered, only users have access to the physical credentialthat generates the security code.What are credentials?Your organization provides users with credentials. All credentials generate security codes, and some types also havea USB connector and storage capacity for digital certificates, encrypted data, or both. Each time users log in to aparticipating Web site, they must enter their username, password, and a new security code to authenticate. Becauseusers generate a security code only when they need to access their accounts, unauthorized users cannot guess orotherwise discover the security code as they might with a traditional password. If a credential is lost or stolen, anunauthorized user must still enter a username and password for any registered member Web site, before an unauthorizeduser could access a user’s accounts, making the credential useless for unauthorized access. The following figureillustrates the VIP Authentication Service authentication process.The VIP Authentication Service validates security codes that the hardware credential generates. Each time a userauthenticates, the user first enters a standard password, then generates a security code using the credential.A number displays on the credential. Users input the security code into the Web application to authenticate themselves aslegitimate users.A VIP Authentication Service credential consists of both a shared secret or shared key and a unique VIP AuthenticationService credential identification. The shared secret or shared key is protected by, and/or embedded in, a device in thephysical possession of an end user. The VIP Authentication Service credential ID is a string of numbers and letters up to12 characters which identifies the VIP Authentication Service credential itself.The VIP Authentication Service credential secret is known both to the device and Symantec. Using a known cryptographicalgorithm process, the VIP Authentication Service credential generates a security code. The security codes generated bythe device can then be compared to the value generated for that device at Symantec, and if the values are the same, theVIP Authentication Service credential is validated. The VIP Authentication Service credential is anonymous and provides asecond authentication factor when it is bound to a local user identity at a VIP Authentication Service Member’s Web site.The VIP Authentication Service Network is designed to support multiple types of devices that include VIP AuthenticationService credentials. VIP Authentication Service credentials may come embedded in dedicated security hardware devices(such as hardware security tokens) and can also be embedded into consumer-oriented devices, such as mobile phones,flash storage devices or credit cards. The VIP Authentication Service Network supports OATH (Initiative for OpenAuthentication) compliant as well as other second-factor authentication credentials.7