State of Hesse (Germany)
Profile• IT service provider for theHessian stateadministration.
• 800 employees provide
practical solutions.
Users• 60,000 staff forming partof the Hessian stateadministration.
Challenges• Easy and secure accessto applications.
• Many different user IDsand passwords.

A local government simplifies and secures access.
Facilitating work for the state administration's staff
As IT service provider for the Hessian state administration with locations in Wiesbaden andHünfeld, HZD operates as a state enterprise under business management. At the core of HZD'sactivities is a market-oriented IT expertise combined with 40 years of administrative experienceand customer-focused solutions ranging from project planning to implementation andoperation.
Data processing at the administrative level is meant to serve citizens and businesses, andfacilitate the work for the state administration's employees. Especially in these economicallydifficult times, HZD is committed to make processes more efficient and less costly.
Since 1970, HZD has steadily expanded its competence as an IT service provider for the Stateof Hesse. In close cooperation with the Hessian state authorities, about 800 dedicatedemployees develop and implement practical solutions for citizen-oriented administration.

Single sign-on: the way out of a dilemma
Benefits• Higher security as eachuser only needs toremember a single
password.
• More efficient workthrough simple interaction
between individual
applications.
• Cost savings throughproven reductions of up to30% in the help desk'sworkload.

Sign-on procedures for a variety of specialized applications complicate Hessian stateadministration staff’ daily tasks at PC workstations. Each such application can have its own user
administration system with separate passwords and password rules, making it necessary forusers to recall a correspondingly large number of different user IDs and passwords.
The undue burden this places on many people gives rise to high security risks. Many users
resort to choosing identical passwords for the various specialized applications, or noting
passwords down somewhere. When such measures fail, this often necessitates a reset offorgotten passwords or an unlocking of user accounts, thereby placing a high workload on thehelp desk.
As a solution to this dilemma, single sign-on (SSO) allows state administration staff, via a soleauthentication procedure, to access all computers and specialized applications for which they
are authorized.
Linked with Active Directory, this centralized solution optimizes utilization of the Hessian stateadministration's existing infrastructure and complements it with the security features of SSO.

Case study > Local government

www.evidian.com

Integrated, single sign-on
The Hessian state government comissioned HZD to research and implement a single sign-on(SSO) solution. The Evidian Enterprise SSO product offered by T-Systems International was
selected after an extensive bidding process and practical tests of leading SSO systems. EvidianEnterprise SSO could be integrated smoothly into Hesse's IT infrastructure and met all
requirements for security as well as application support.

"Multiple login procedures withdifferent user name / password
combinations often complicate theeveryday work of state employees.
With the SSO solution, Hessian stateadministration staff can use a single
authentication procedure to accessall computers and services for which
they are authorized, without having
to sign-on again each time. This alsoincreases IT security."
Manfred Pospich,Head of Planning and Procurement,HZD.

The single sign-on mechanism takes over the user identification tasks. First of all, the user must
successfully log into Windows to enable a non-recurrent transfer of data relating to theintegrated, specialized applications which the user is authorized to access. After that, thesystem provides a dialog instructing the user to enter their passwords. From then on, the user nolonger needs to remember these passwords.
The SSO module performs all password changes automatically in accordance with theguidelines prescribed for the specialized applications. The passwords are stored securely inencrypted form. This is done both locally (for offline operation) and centrally. Regardless of theworkstation at which the user signs on via an SSO client, the related passwords are thenrelayed to this client for the purpose of automatic authentication.
From then on, the SSO client performs the entire password management for the integrated,specialized applications. Changes to any of these applications are processed automaticallywithout the need for any user intervention.

Improved security and comfort

39 A2 46LX 03• Minimizing user IDs and passwords
The often tedious management of diverse user IDs and passwords is minimized by SSO to useof a single user ID and password. State administration staff simply need to log into the system attheir respective workplace using their personal identification. Any further authentication, forinstance, at the employee portal, is automatically performed by single sign-on mechanisms. Thiseliminates the need for separate sign-on by the user again.
• Increased security during user authorization
The user does not need to remember any further IDs or passwords to access authorized
applications following regular sign-on at the workplace. Central password rules compliant withgeneral security standards for each individual, specialized application guarantee protection
against misuse. Unnoticeable to the user, password complexity can be increased - exclusively
at the system end - to a level at which it becomes practically impossible for third parties to crack
passwords.
• Lower burden on users and central services
Reducing diverse collections of user IDs and passwords to realize a single sign-on procedure
facilitates work for users, shortens the time required to access specialized applications, andsignificantly relieves the help desk with regard to unlocking user accounts and resetting
passwords.

© Eviden. Evidian is the registered trademark of Eviden. All products, brand names, service marks, trademarks and other names mentioned in this document areproprietary to their respective owners and are protected by applicable trademark and copyright laws. Evidian reserves the right to modify the characteristics of its products
without prior notice.