WIXLIB

TECHNOLOGY AUDITEntrust IdentityGuard Version10.1Entrust IncReference Code: OI00070-106Publication Date: February 2012Author: Andy KellettSUMMARYCatalystEntrust IdentityGuard is a function-rich, identity-based software authentication platform. It supportsa broad range of secure authentication products. Its facilities cover the breadth of theauthentication market, ranging from smartcards, mobile device usage, risk-based approaches, andone-time tokens, through to lighter controls that fit the needs of specific business activities. Thetools, which can be software and hardware-based, include IP geo-location checks, out-of-band,certificate authentication, and e-grids.Entrust recognizes that different organizations and users have different authenticationrequirements. Its products are designed to handle these variations and support the use of mixedauthentication techniques across user groups. The new IdentityGuard release, version 10.1,focuses on extending the business use of mobile devices and the opportunity to combine logical(LACs) and physical (PACs) access controls using a single authentication approach.Key findings Entrust provides one of the broadest ranges of authentication tools available in theidentity and access management (IAM) market. Physical as well as logical access facilities are supported. Mobile device authentication can be used to deal with the physical and logical accessrequirements of mobile workers, online clients, and everyday business users.Entrust IdentityGuard (OI00070-106) Ovum (Published 02/2012)This report is a licensed product and is not to be photocopiedPage 1

Mobile device authentication reduces the need for hardware-based tokens and addsextra resilience when tokens are lost or software alternatives are required. OoB authentication, which confirms the legitimacy of transactions, is a valuable toolfor detecting and preventing fraud. Risk-based authentication links the required levels of authentication to individualactivities. Although PKI and certificate-based services are supported, a complete managedservice option for IdentityGuard will not be available until later in 2012.Ovum recommends Threats to information systems continue to grow. At the same time, systems andnetworks become more open as businesses collaborate with external partners,provide access to users from a variety of locations, and make use of an increasingrange of smart mobile devices to gain entry. All these issues highlight the importanceof identity management and its core role to allow or block user access. The key element that drives secure access to corporate systems is identity. Identity isthe foundation of secure access, but to be effective its authentication approachesmust fit the risk requirements of business systems. Users require different levels of authentication. Many need read-only access to lowlevel business information, a few work with highly sensitive data, and most fallsomewhere in between. Business organizations need identity-management facilitiesthat are secure enough to support a range of users and flexible enough to deal withusers as their access requirements evolve and change.Value propositionEntrust has built its reputation by providing an identity-based software security platform that offersa broad range of software and hardware authentication facilities including support for federatedidentities and self-service administration. Release 10.1 of IdentityGuard extends this approach bymaking it easier for employees to use their mobile devices as a core source of authentication andinformation access. The approach adds convenience because users can gain access to businesssystems using a device that they carry with them. It offers convergence and enterprise-gradecredentials because mobile technology with its near-field communication (NFC) and Bluetoothtechnology can be used to combine PACs (physical access control) and LACs (logical accesscontrol) authentication using a single credential.Entrust IdentityGuard (OI00070-106) Ovum (Published 02/2012)This report is a licensed product and is not to be photocopiedPage 2

The target audience for Entrust is industry-wide, and because its authentication options range fromvery light to highly secure, there will be a range of identity-based facilities that meet the needs andbudgets of most organizations.The effective management of identity is one of the most important elements of an enterprisesecurity strategy. However, the IAM sector has a reputation for delivering complex and expensivesolutions. Enterprise-level take-up continues to be restricted because of these issues. Where IAMproducts are used, they are usually deployed to deal with a particular business risk or address atrading requirement such as providing secure online access for employees or customers.The ways in which users now access corporate systems are changing. New mobile devicespresent both a security challenge relating to how access is controlled and an opportunity to replaceexpensive hardware-based tokens. For example, financial services organizations have deployedcard readers for online customers to improve security when logging on and as a secondarymethod of confirming certain transactions. Today, different approaches using mobile devices,application-based software, and grid technology provide cost-effective alternatives.It is advantageous to make better and more extensive use of constantly available devices such asmobile phones, tablets, and iPads. These devices are in everyday use and can be used to supportthe authentication and user access requirements of businesses and their users.Entrust IdentityGuard (OI00070-106) Ovum (Published 02/2012)This report is a licensed product and is not to be photocopiedPage 3

SOLUTION ANALYSISFunctionalityThe Entrust IdentityGuard platform was built with versatility in mind. At a very early stage Entrustrecognized there would never be a one-size-fits-all approach to authentication. The companyoffers a very broad range of authenticators that cover high-end through to more basicrequirements. Coverage includes a range of hardware and software-based one-time tokens andsmartcards, risk-based authentication, IP geo-location, certificate-based authentication, use of gridcards and software grids, and user-response approaches.Some older authentication methods are now beginning to look outdated. The use of mobiledevices provides a software and application-based authentication alternative. The availability ofmobile OoB transaction verification is good way of defeating man-in-the-browser threats, withavailable geo-location checks also adding an extra layer of protection.Most business and systems users either own or are provided with a company mobile device.Employees want to use the latest devices for personal use and to access business systems.Businesses benefit from the combined use of these devices if security concerns about device useand access control are dealt with.Entrust IdentityGuard addresses mobile device issues by providing device-management andaccess-control facilities.Figure 1: IdentityGuard - authentication platformOVUMSource: EntrustEntrust IdentityGuard (OI00070-106) Ovum (Published 02/2012)This report is a licensed product and is not to be photocopiedPage 4

IdentityGuard supports the use of smart mobile credentials for logical and physicalaccess, including the use of near-field communication (NFC) and Bluetooth facilities. Entrust uses NIST-approved personal identity verification (PIV) certificates to dealwith mobile security and control issues. IdentityGuard provides integration with leading MDM (mobile device management)vendors to support strong device identity (certificate-based device identity). IdentityGuard provides support for digital signature and encryption/decryption facilitiesfor secure email services. Certificate on-boarding for authentication and signing email,and S/MIME-based decryption facilities are available. Strong certificate-based authentication is available for users accessing corporatenetworks using mobile devices. Soft tokens are available in form factors that support the generation of one-time passcodes. Software development kit (SDK) facilities that allow organizations to build Entrustmobile capabilities into their own mobile applications are also available.To date few IAM vendors have successfully addressed the need for a common approach tophysical and logical access. Smartcard technology allows the combined approach to become apractical reality. Entrust IdentityGuard allows organizations to integrate the two environments. Ituses secure NFC technology as an alternative to older and less secure HID physical access cardsand can leverage Bluetooth to act as a smartcard reader to provide logical access to computerdevices. Improved return on investment (ROI), reduced running costs, and the provision of a singleintegrated approach and credential are the primary drivers.Risk-based authentication allows different authenticators to be deployed to various user groupsbased on the amount of risk associated with each user, transaction, or particular area of thebusiness. The usability element of the approach also allows more appropriate checks to be made ifaccess requirements vary from the norm.Entrust IdentityGuard Server is the main component of the IdentityGuard system (see Figure 1).Entrust IdentityGuard uses a three-tie architecture approach. It is a J2EE-based solution, and thepresentation layer and business logic layer can co-exist on a single hardware platform. Inoperational use IdentityGuard leverages an existing data repository, such as eDirectory, for datastorage, and communicates with this using either Java Database Connectivity (JDBC) orLightweight Directory Access Protocol (LDAP).Entrust IdentityGuard Server includes the following core applications and interfaces:Entrust IdentityGuard (OI00070-106) Ovum (Published 02/2012)This report is a licensed product and is not to be photocopiedPage 5

Authentication and administration provides web services using the Java platform andC# application programming interfaces (APIs). Administration interface, properties editor, and master user shell. A sample web application that demonstrates service delivery capabilities.The applications and interfaces are used to authenticate and manage users and theirauthentication data.Figure 2: IdentityGuard - integration with an authentication applicationOVUMSource: EntrustGo-to-market strategyEntrust IdentityGuard provides an inclusive approach to working with the types and levels ofauthentication that clients choose to deploy. Its open API architecture supports a wide range ofsoftware and hardware tokens, and integration with leading MDM (mobile device management),IAM, and PKI (public key infrastructure) vendors, including Entrust PKI. This allows the solution tobe used across a broad range of mature and emerging markets, and supports the ability to workwith a wide range of digital certificates.Traditionally the company has targeted the financial services and government sectors where it hasachieved successful results. In addition, Entrust's position as a Certificate Authority (CA) allows itto support strong certificate-based authentication that is relevant to organizations of all sizes.As a provider of mainstream authentication services, the vendors that Entrust regularly competesagainst include CA, Gemalto, HID, RSA, Symantec, and VascoData.Entrust IdentityGuard (OI00070-106) Ovum (Published 02/2012)This report is a licensed product and is not to be photocopiedPage 6