If HTML5 doesn’t work you’re probably using IE.  Sounds like a biased joke doesn’t it?  Well in some aspects it’s 100% correct.

Adrian Bateman, a program manager at Microsoft’s ID group stated once that they flat out don’t want to conform to the HTML5 <keygen> specification.    As a matter of fact, they want it removed (REFERENCE)

Basically it boils down to this, they think that if you use your browser to enroll for a certificate through HTML5 it’s somehow not secure.  Better to just log into a domain and get a cert pushed down to your PC behind the scenes?  We’ve been though this argument many times, if you get a certificate pushed down to your PC from your CA by just logging into the domain it’s really good for nothing more than device identification.  This shouldn’t be used for validation of a user, ever.

Why does the fact that Microsoft doesn’t conform to the HTML5 spec bother us?  Well it doesn’t really because we’re typically using Chrome, or Firefox, or sending letters via the USPS even but what is ironic is this, you can get a certificate using Chrome and then use that same certificate in IE as user authentication.  Are you seeing the humor here?

So, the main argument from Adrian is that it’s too insecure to allow users to enroll for a certificate in IE, sounds like the reason the domain admin didn’t want to allow iPads on the network right?  Well SecureAuth is now able to walk users through an enrollment process that not only ensures a users identity via the information they have in Active Directory but we can now create certificates in your browsers store via HTML5, that is as long as you’re using a intelligent browser like Chrome, Firefox or Safari.  If you still want to use IE you’ll still have to utilize the ActiveX controls, until Microsoft brings IE into 2012 and beyond.

SecureAuth is please to release the first enterprise grade variable authentication service that’s deployable with an iApp.

What’s a Variable Authentication Service?  It’s SSO & or 2-Factor to your SaaS applications, VPN or whatever you’d like!  It’s easy to use & deploy 2-Factor authentication for users trying to access your Sharepoint, Citrix or webtop deployment.  It’s also something that can consume authentication from inside of the F5 APM to preform SSO to cloud applications.  Let’s just say, it’s the yin to the F5 yang.

What’s so great about an iApp?  The iApp is a concept created by F5 that allows you to quickly deploy something.  Why spend hard earned cash that you might or might not have trying to recreate the wheel?  F5 has iApps for just about anything you’d care to deploy, Citrix, Sharepoint, Exchange, Oracle, SAP, Peoplesoft & many more. (REFERENCE)  Now you can use an iApp that’s been co-developed with some of the brightest minds at F5 to quickly secure your applications with 2-Factor authentication.  Basically, these iApps are there to make you look like a superstar.  Look for a video soon demonstrating how to install and use the iApp!

F5 iApp on DevCentral

SecureAuth hosted iApp

03/22/2012 – BYOD – “Bring Your Own Device!” 2012 is the year of iPhone, iPad, Android, Amazon Kindle, Barnes & Noble Nook, etc! SecureAuth and F5 show how to secure all your apps, cloud and web, to these devices!

A year later: Where Are We Now?

Seriously.  Many of the articles after the hack revealed what security types had already been saying for years (Bruce Schneier in lead) – the basic underlying premise of sending OTP codes for 2-Factor authentication is susceptible to simple Internet attacks, including Man-in-the-Middle attacks.

(After the attack – I even demonstrated to an assembled team of one of the largest security firms in America -FishNet Security- how easy it is to set up a Man-In-The-Middle (MITM) attack on RSA SecurID tokens. FishNet was so impressed by what was shown, they began to not only sell SecureAuth, but also use SecureAuth as a more secure and easier to use way of providing 2-factor authentication for their own remote access).

SecurID Does NOT Protect Against Modern Internet Attacks

• Authenticating the veracity of the user
• Authenticating the veracity of the authentication party

And…

Well, now the world is nothing but client-server authentication across the internet, most of which is done over public channels (e.g. a browser to a public facing web server). The move to the cloud, intelligent as it may be for cost-savings and efficiency, has greatly advanced this type of communication.

• The Client (Desktop, Mobile, Tablet)
• The Server (Enterprise, Cloud, SaaS, PaaS)

• SecureAuth is: A bilateral, browser-based authentication system that validates the LEFT (Client) and Right (Server) side of the authentication – BEFORE passing a “Green Light” signal to the relying party (Enterprise and/or Cloud-based resources). (See image #4)

• Automatically issuing a cryptographic credential to the user
  • For Desktop
  • For Mobile
• Authenticating by the SecureAuth Solution
  • On Premise or
  • In the Cloud
• Passing the identity
  • To an on-premise resource (web, VPN)
  • Cloud Resource (Google, Salesforce, Workday, SuccessFactors, Amazon, etc)

SecureAuth: Bi-Lateral Authentication that Solves MITM Attacks

Having put together over 100 webinars for SecureAuth – I also take the time to listen to other firms webinars.   (And yes – I am e-mailing and IM’ing through theirs – like others do to mine – all’s fair.)

What’s relevant about the other product webinars I listen to – is NOT what is included – but what is omitted.

There is not question that consolidating your SaaS/Web access to a single portal – is the right answer.   And it’s also the right answer to consolidate access to an ID that your users already know.  (E.G. “Federated the identity from your Active Directory – or other known idenity.)

But what is OFTEN omitted – is, well, how do you do all that boring stuff around the password???  E.G.:

• User Self Password Reset
• 2-Factor Self-Password Reset that meets Regulatory Compliance
• User Password Lock-Out and Unlock
• Password Synch to Cloud like Google
• Enforcing Password Strength across
  • On-Premise Web Applications
  • Cloud Applications

Well – this is exactly what the “SecureAuth 2-Factor IdP” is able to do. (See figure #1)

Image #1: SecureAuth becomes the centralized 2-Factor Password Mechanism for your user data resource (AD, LDAP, SQL, etc).

The SecureAuth solution is the 2-Factor “Instant IdP” that allows you to convert your present user store into a fully functional IdP for the modern enterprise deployment of applications.  (On-premise and SaaS web deployments.)

Enterprises today, need to provide:

• SSO between applications
• 2-Factor for remote access
• AD SSO for SaaS applications
• Federation to the Cloud
• And…
  • Full Password Control

Check out the full SecureAuth Password Functionalities here.     Contact us – and we will tell you more!

–

Garret Grajek is CTO and a co-founder of SecureAuth. SecureAuth is a single appliance solution that delivers configurable 2-Factor and SSO authentication for Web, VPN and SaaS based solutions.

Had the pleasure of F5′s (wonderful) Peter Silva come by the SecureAuth booth @ RSA and record our BYOD (“Bring Your Own Device”) Story.

Video Blog:    RSA 2012 Spotlight – SecureAuth

The SecureAuth BYOD story is what the IT world is clammoring for: 

• Agnostic device 2-Factor authentication
  • iPhone, iPad, Android, Nook, Kindle
• Full App access integration
  • Gateway (F5 BigIP)
  • On-Premise Web Apps
  • Cloud Apps (Google, Salesforce, Success Factors, Workday)

As been will be detailed in our upcoming webinar with F5  (F5 APM and SecureAuth and FishNet Webinar – BYOD security for Web and Cloud Apps) – we will point out the importance of allowing any device access to your apps.

And this is what came out during the RSA show.   The attendees:  IT directors,  security engineers, consultants – where  looking for solutions on how to:

• Maintain their Access Control guidances
  • PCI DSS, NCUA, FFIEC, HIPAA/HITECH
• But still allow access to the new devices
  • iOS, Android, BlackBerry, etc

This is the SecureAuth story – and specifically the SecureAuth/F5 APM story.   Contact us – and we will tell you more!

F5 APM and SecureAuth and FishNet Webinar – BYOD security for Web and Cloud Apps
Thursday, March 22^nd,  10am PST

–

Garret Grajek is CTO and a co-founder of SecureAuth. SecureAuth is a single appliance solution that delivers configurable 2-Factor and SSO authentication for Web, VPN and SaaS based solutions.