Why you need a stand-alone two-factor authentication server

admin
2015-09-10T14:21:00+00:00

We do a fair amount of testing and documentation for commercial and open-source VPNs (Cisco, SonicWall, Sophos, Checkpoint, etc, etc). Increasingly, we see VPNs embedding some type of two-factor authentication into their product. The idea is to make it simple to add 2FA to your VPN services, a laudable goal and perhaps sufficient for some small organizations. So, when should you consider using a stand-alone service instead?

1. When you have critical infrastructure or data that needs securing for security or compliance reasons. A prime example would be any system with credit card information covered by PCI or PII covered by HIPAA.

2. When you have privileged accounts with multiple users. Privileged account management is of increasing concern. If you are thinking about it, then you need to think about adding two-factor authentication to it.

3. If you need two-factor authentication for customers. No point in having two separate systems. We increasingly see SaaS providers needing two-factor authentication.

4. If you need two-factor authentication for out-bound access. We have recommended this in the past as way to find all the services sending data out of your network - and whether they should be or not!

5. If you allow vendors in your network. Think Target and their HVAC vendor.

6. You plan on implementing SSO. SSO means keys to the kingdom, so best protect them.

7. If you provide non-VPN remote access, such as with Bomgar or VMWare View.

In short, any place you use a password could be a place you use two-factor authentication. Two-factor authentication: Not just for remote access!

And, of course, you can download the WiKID server and set up five free users anytime.