SanofiProfile• A global healthcare
leader.
• € 29 billion net sales
in 2009.
• 105,000 employeesin 110 countries.
Users• 800 R&D applications.
• 15 accounts per employee
on average.
• 21 R&D sites.

A large pharmaceutical company secures its workstations.
Making applications secure and available
A global pharmaceutical group, Sanofi is mainly involved in pharmacy, human vaccines andanimal health. Its products cover therapeutic areas as diverse as diabetes, cancer or
cardiovascular diseases. Its portfolio also features a wide range of consumer healthcareproducts and other prescription medicines including generics.
The company is subject to strict requirements in terms of security, confidentiality and dataintegrity. Also, guidelines on electronic records (such as 21CFR Part 11 in the US) define strict
conditions on the provision of electronic files to national authorities. For instance, users must
authenticate by name to sign electronic drug-related documents. The 15,000 research anddevelopment (R&D) employees of Sanofi must therefore individually authenticate to a large
number of applications.

Challenges

Single secure authentication• Improve access security.
• Simplify access toapplications.
• Protect users’ identity.

“The project’s starting point was access security for all R&D employees. Our researchersconnect to about fifteen applications on average every day", explains Vincent Rossetto, Project
Coordinator at Sanofi. “There was therefore a risk that the password they use to access their PC
and applications would be written down or revealed. We therefore decided to invest in asingle sign-on system for the Group's entire R&D organization."

Benefits• R&D applications
protected by SSO.
• Installation planned on all
the Group’s PCs.
• Extension planned foridentity management.

The Group launched an evaluation of the world's leading providers of authentication
management and SSO. The criteria: the solution must be easy to install and deploy, and beable to integrate a large variety of applications, online medical databases, documentmanagement, internal Windows and Unix applications and terminal emulation. After live tests,
Sanofi selected Evidian.
“We wanted to integrate our applications without limitations or modifications. The Evidian
solution is user-friendly, intuitive and comprehensive in terms of functionality. Essentially, wewere mainly looking for an SSO solution. Evidian remained available to provide support bothin terms of use and to integrate complex applications", says Vincent Rossetto.
Fulfilling another important criterion, Evidian's SSO and authentication management solution isbased on Sanofi’ existing Microsoft Active Directory. This ensures natural monitoring of user
movements and facilitates the solution’s scalability.

Case study > Pharmaceutical industry

www.evidian.com

An international deployment
Firstly the 6000 PCs in the Sanofi Research and Development (R&D) centres were equippedwith Evidian’s SSO solution. This helped improve productivity for many researchers andadministrators – authentication to applications, essential for legal reasons, no longer requires
each user to remember about 10 passwords. In 2006, after the takeover of Aventis, the newdivision’s R&D centers were also equipped, bringing the total number of users to almost
18,000.
Later on, the Group‘s medical sales representatives in the United States were given the SSO
solution on their laptops. Highly mobile, they authenticate using biometrics, or access thecompany’s web applications by smartphone. Having found that the Evidian solution could beadapted to two very different profile types - R&D and medical sales representatives - Sanofi
decided to extend it to all its employees worldwide.

“Evidian’s solution is easy to
manage because it iscentralized and based on ourdirectory. It is not intrusive andtherefore economic in terms ofsupport and maintenance.
The users appreciate the newease of use. They only have tolet themselves be guided.”Vincent Rossetto,
Information security andprotection department,
Sanofi.

A safe and open architecture
The Evidian offer is based on the company’s Active Directory; it is therefore easy to expand its
user base simply by extending the directory. Like any large pharmaceutical group, Sanofi
regularly acquires companies to develop its portfolio. Strong external growth, one of theGroup’s major strategic directions, requires new users to be integrated quickly - which theEvidian solution easily allows.
“The savings made by the disappearance of application passwords is considerable - the returnon investment can be measured in weeks. But it is the improvement in security which is mostsignificant: users no longer write down their passwords or use the same password everywhere.
Authentication is now much more secure” says Vincent Rossetto.

Daily identity and access management
The solution is maintained by three “application specialists” who cover Europe, Japan and theUnited States respectively. In addition to second-level maintenance, they configure the SSO for
new applications. Indeed, any application can benefit from single sign-on. Several applications
use the Active Directory password - but Evidian’s SSO still adds value, since entering thatpassword several times a day would create a security risk. Password reset, another importantfunction, can be activated by the users themselves without calling the help desk.

39 A2 85LV
51LX 03
02– Duplicopy – 2010

“Single sign-on is an excellent first step in a long-term identity and access management project.
The case is simple to argue and it is relatively easy to get a go-ahead decision. In a second
step, identity management features can be added to this foundation, which the Evidian makes
possible,” concludes Vincent Rossetto.

© Eviden. Evidian is the registered trademark of Eviden. All products, brand names, service marks, trademarks and other names mentioned in this document areproprietary to their respective owners and are protected by applicable trademark and copyright laws. Evidian reserves the right to modify the characteristics of its products
without prior notice.