Evidian

Boost PIV compliancewith Enterprise
Access Management

Personal Identity Verification (PIV) program

To remediate security issues, federal agencies adopted the Personal Identity Verification (PIV) program, a new authentication system based on
Smart cards and public Key Infrastructure. Deploying this new system was expensive, but nothing compared to the actual cost of enforcing
smartcard use across multiple systems, applications and devices.

Password limitations

HSPD 12

PIV program implementation

Passwords are widely accepted securitysystems. Everyone understands how to usethem, they are free, they work from every
platform and in every situation. For all thehypes about multi-factor authentication,
every application still comes with a password
authentication. A Password is safe, in andof itself, as long as the application it guards
uses encryption. It would take hackers 19.24
years to try every combination, assumingthat those hackers have enough computing
power to mount a 100-billion-guesses-asecond effort, in order to break a 10-character
password.

Recognizing the risks associated withpasswords, the federal government signed
Homeland Security Presidential Directive
12 in August 2004. This directive mandates
Federal agencies to issue a PIV (PersonalIdentity Verification Card) to all staff anddeploy a Public Key Infrastructure that willprocess certificate authentications.

But what about the legacy applications?
PIV enabling legacy applications represents
a huge undertaking. For some of thoseapplications, especially mainframe systems,
the smartcard enablement is simplyimpossible.

It is with the end users, the password holders,that we have a problem. Passwords become
vulnerable because end users have too manyof them, so they write them down, they try to
get away with “easy to remember” passwords
and they reuse the same password acrossas many applications as they can. Also, end
users are not as good as they should at
keeping those passwords to themselves, theyshare them, for convenience and expediency.
All too often, they get abused by hackers andtheir passwords get fished.
Adopting strong password policies, whichmeans forcing end users to choose complex
passwords and change them regularly, may
look good on paper. But the hardest it isfor end users to remember passwords, themore they are going to write them down…
Password policies are a never-ending whacka mole game.

PIV cards are smartcards, their chips contain
an authentication certificate. The cardallows end users to sign in using certificate
authentication and 2 factors (what I have, thecard and what I know, the PIN code) which ismuch stronger than a simple password login.
PIV cards are a major tool to secure access togovernment networks and applications.
Once the PIV cards got deployed, the firstobjective for federal agencies was to protectdesktop and network access with smartcard
authentication, instead of the default
Windows password. Their long-term objective
has been to replace all password login withPIV authentication, starting with sensitive
applications and privileged accounts. To
that effect, Office of Management Bureau
memorandum 11-11 ask that all new systems
under development be enabled to use PIV
credentials, prior to being made operational.

Even for the seemingly simple windows login,switching to smartcard login turned out tobe more challenging than it looked. Windows
desktops must be configured for mandatory
smartcard logon. But this Windows setting
has two unfortunate side effects:
1) The end-user Windows password isobfuscated in Active Directory, as a result,
all the applications that worked with
the Windows password are rendered
inoperable.
2) There is no easy solution to grant
temporary access to workers who misplaceor forget their smartcard.
For some federal agencies, those issues
have proved insurmountable for others, PIV
implementation is almost achieved but fora few lingering passwords. Whatever thesituation, Evidian Authentication Manager hasa solution to tackle your issues.

Enterprise Single Sign-On

The indispensable companion for smart card deployment
With Evidian Authentication Management (EAM), Evidian Enterprise SSO and Authentication manager software’s from Atos, federal agencies
can take full advantage of their smartcard infrastructure. EAM helps its customers enforce smartcard logon, using the native Microsoft
authentication system. Smartcard logon compliance is fully audited. With EAM, organizations also extend the security that comes withsmartcard logon to most of their applications without having to modify those applications. EAM comes with a safe yet easy solution to unlock
workers who lose or forget their smartcards. Thanks to EAM, password security is enforced, yet there are no more passwords to remember, typeand change and there is no more password reset calls. Beyond security benefits, EAM boosts smartcard adoption, improve workers’ productivity
and reduce support costs.

Replacing password log in with a
PIV card authentication
Evidian Authentication Manager (EAM)
automates the login for legacy and webapplications. Once the passwords arecollected from end users (in the normal
course of their work), they are strengthened
and randomized. Those passwords can’t beguessed, hacked or fished because they arecomplex and because the users themselves
do not know them anymore. Although
EAM still technically delivers password
authentication to the applications, thosepasswords are like tokens and they areencrypted at all time with each user’s own
PIV card certificate. With EAM, users access
all their applications seamlessly after one
single PIV card authentication. As for theapplications, they have never been modified,thanks to EAM, they have been PIV enabledwith minimal efforts.

Smartcard Login with EAM
Our solution enforces Smartcard logon
without erasing the Windows password.
EAM captures and randomizes the Windowspassword. As a result, the end-user is forced
to use the smartcard login. When the end
user logs in to an application that request
the Windows password, EAM injects thepassword into the login field and the user
seamlessly access the application.

locked, as a result, the user can communicate
and fulfill most of the daily tasks, but thesecurity standards are not compromised.
Our solution issue a report for security
administrators which list the users that had
to go through emergency access, from thisreport it is easy to single out users whoabuse the emergency access.

For all the legacy applications (whether or
not those applications use the Windowspassword) the administrator can either let
EAM seamlessly do the authentication (SSOauthentication) or challenge the user for
the PIN code in order to reinforce accesssecurity (Re-authentication followed by SSO
authentication).

Emergency access when the PIV
card is lost or forgotten

Provide reports about PIV
enablement

We offer an emergency access solution for
end-users who misplace or forget their PIVcard. The user selects the emergency access
option and answer a challenge (Questionand answers/ OTP/call to support or a mixof those methods), then EAM issues atemporary password that will last until thePIV card is recovered or reissued. While theuser is in emergency access mode, it is up tothe administrator to decide which accounts
can be accessed and which ones remain

Every single authentication is logged
in a central database and the systembuild reports that outline the percentageof users who utilize the PIV card.
Our reporting tool also offers crucial
data for accounts management,
application deployment and use. It gives
management a perfectly clear picture ofPIV card enablement and allow you toreport progress to the Chief Information
Security Officer and the OMB.

Aventex & Evidian partnership
Evidian EAM, the Enterprise Access Management has a long-proven track record helping organizations deploy smart card projects. Evidian
EAM is a leader in Enterprise Single Sign On and authentication management. Evidian EAM secures and automates logins for web and legacy
applications, it also helps clients replace the default Windows password with 2 factor authentications. Aventex is a New York based consulting
firm which resells, and support Evidian EAM in the US and in EMEA. Aventex executives, all former Evidian staffers, have a combined 25 years’
experience deploying EAM. Aventex’s knowledge of PIV needs for federal agencies combined with Evidian’s security expertise and technology
creates a strong EAM partnership.
Evidian EAM is an Identity and Access Management product of Atos.

Boost PIV compliance with Enterprise Access ManagementBrochure

About EvidianEvidian is the Identity and Access Management (IAM) software suite of Eviden.
Evidian IAM is the European leader in identity and accessmanagement with a presence which is growing rapidly
beyond Europe, particularly in Japan and the US.
More than 5,000,000 users in more than 900 organizations throughout the world connect to their companies every day and manage their access rights with Evidian identityand access management solutions.

For more information: evidian.com© Eviden. Evidian is the registered trademark of Eviden. All products, brand names,service marks, trademarks and other names mentioned in this document areproprietary to their respective owners and are protected by applicable trademark
and copyright laws. Evidian reserves the right to modify the characteristics of its
products without prior notice.
CT-200629-RY-J4130-EVIDIAN-BR-BOOSTPIV