© Copyright Entrust, Inc. 2010

What are the Challenges of Securing Identities online?

© Copyright Entrust, Inc. 2010

2

Entrust is a World Leader in Identity Management and Security Software

• Founded in 1994, publicly-listed in 1998 (NASDAQ: ENTU)

• Best-in-class technology, service and support – industry pioneer

• Over 2000 customers in 50 countries – global reach

• Geographic presence: U.S., Canada, UK, China, Germany, India and Japan

• 411 employees and 110+ patents

• 2008 Revenue: ~$100.0 million

© Copyright Entrust, Inc. 2010

3

11.8

13.5

13.9

14.4

15.3

14.7

14.2

14.5

19.7

15.9

14.4

14.6

24.8

17.0

14.6

14.6

31.0

17.8

14.7

14.7

-

10.0

20.0

30.0

40.0

50.0

60.0

70.0

80.0

Tra

nsa

ctio

ns

(Bil

lio

ns)

2006 2007 2008 2009 2010

Online Call Center Branch ATM

Online Service Uptake Critical

US Banking Delivery Transactions by Channel (2006-10p)

May 31, 2008

© Copyright Entrust, Inc. 2010

Online Service Uptake Critical

Cost per Transaction (US $)

May 31, 2008

$4.05

$3.35

$2.30

$1.40

$0.40 $0.25 $0.20

$-

$1.00

$2.00

$3.00

$4.00

$5.00

Branch Platform Back Office Call Center Agent Branch Teller ATM IVR PC Banking

© Copyright Entrust, Inc. 2010

We Provide Identity-Based Security for:

Consumers Enterprises

Citizens Web Sites

Online banking users, e-commerce

site customers

Travelers, and those accessing

government services, in

person or online

Web servers (external and internal), email servers and code being distributed online

Business and government employees, contractors, first responders, and devices

5

Consumer Authentication

© Copyright Entrust, Inc. 2010

Consumer Auth Problems

Man in the Middle Attacker

Man in the Browser

Malware

Ongoing attacks against FI’s

Corporate accounts being targeted

Malware growing fast, hard to detect with Anti-Virus

End-users often resist strong auth

Source: Anti-Phishing Working Group, July/09

7

© Copyright Entrust, Inc. 2010Man in the Middle Attacker

Man in the Browser

Malware

Consumer Authentication: Entrust Solution

Flexible range of authenticators

Across spectrum of security / usability

Zero-touch fraud detection to spot unusual activity and stop malware

8

Username & PasswordMutual AuthenticationIP GeolocationDevice FingerprintKnowledge-Based AuthenticationGrid Card / eGridOne-Time Password TokensOut of Band Auth via SMS or EmailDigital CertificatesSmart Cards

Enterprise Authentication

© Copyright Entrust, Inc. 2010

Enterprise Identities: Problems

Protect access to intellectual property and customer data

Work from anywhere

Stay out of employees’ way

Audit access to resources

Reduce transaction costs by moving online

EmployeesPartners

Contractors

OtherBusinesses

10Mobile Devices

Other internalServers & Devices

# ofIDs

2000 2010

© Copyright Entrust, Inc. 2010

Enterprise Identities: Entrust’s Solution

Broad range of authentication credentials

For users, servers, devices

Enables encryption and digital signature with strong identity

EmployeesPartners

Contractors

OtherBusinesses

Mobile Devices 11

Other internalServers & Devices

Web Site Authentication

© Copyright Entrust, Inc. 2010

Web site authentication: Problems

Phishing attacks and other fraud often involve counterfeit websites

Users cannot easily detect fake sites

Numerous servers for IT staff to keep track of, ensuring no certificate expiries

Expense of certs for numerous servers

Customers,Employees

Mobile Users

13

Web servers,Exchange,Applications

© Copyright Entrust, Inc. 2010

Web site authentication: Entrust Solution

SSL certificates for web sites, MS Exchange, code signing, Adobe PDF

Stringent verification to prevent brand theft

Helps user verify they are at correct site

Enables browser to provide some automated protection

Powerful certificate management tools

Customers

Mobile Users

14

EntrustVerification

© Copyright Entrust, Inc. 2010 15

© Copyright Entrust, Inc. 2010

Identity-Based Security: a Layered Approach

People, Servers, Devices, Applications

Credential issuance, audit,

lifecycle management

Credential use, step-up, ongoingtransaction analysis, and forensics

16

© Copyright Entrust, Inc. 2010

Entrust IdentityGuard

• Single open platform, centralized policy management• User self administration• Deploy based on Risk, Usability, Cost

Username & Password

Grid

VersatileAuthenticationPlatform

ScratchPad Digital

Certificates

OTP Tokens

Smartcards &USB Tokens

Mutual Auth

IP-Geolocation

Machine/Device Auth

Mobile

Knowledge-Based

© Copyright Entrust, Inc. 2010

IP Geolocation

• Authentication based on users physical location

• Register common access points & record logon profiles

• Leverage IP black/white lists & OFIN data

© Copyright Entrust, Inc. 2010

Machine Authentication

• Captures machine parameters

• No user interaction

• With or without cookies

IP: 216.191.253.108 Browser: IE 7.0Screen Depth: 1024….…

© Copyright Entrust, Inc. 2010

Digital Certificates

• X.509 certificate support• Existing certificates or

leverage Entrust Managed Service Offering

• Standard SSL client or application signature-based authentication

• Stored in software, on smart cards, or USB tokens

© Copyright Entrust, Inc. 2010

21

Multiple Identities, one device

Mix of Soft token only and Transaction Notification

Independent activation and control

Customizable branding per identity

Mobile Authentication & Transaction Notification

© Copyright Entrust, Inc. 2010

22

OATH compliant

Time-based soft token

30 second time window

Brandable interface

IDG Mobile – Soft Token

© Copyright Entrust, Inc. 2010

23

IDG Mobile - with Transaction Notification

OATH Time-based Soft Token

Transaction details confirmed out of band on mobile device

No data entry

OATH signature of transaction contents

User confirms transaction or acts on suspect details

© Copyright Entrust, Inc. 2010

Soft Token Mobile Authentication• Single or multiple one-time

passcodes to mobile device– SMS, email, voice

• Authenticate while out of cell range

• Out-of-band transaction detail confirmation and authentication OTP

• Automatic refresh of OTPs

© Copyright Entrust, Inc. 2010

Knowledge Authentication

• Configurable number of questions

• User defined or imported

• Define number of correct answers

• Randomly presented

© Copyright Entrust, Inc. 2010

• Each grid card unique

• Inexpensive to produce and deploy

• Innovative eGrid in graphic or PDF format

• Easy to use and support

C 2 3

Grid Authentication

© Copyright Entrust, Inc. 2010

Mini Tokens

Mini OT• Time-Synchronous

• OATH Compliant

Mini AT• Time & Event-Synchronous

• Standards Based Algorithm

© Copyright Entrust, Inc. 2010

Pocket Tokens

• Time & Event-Synchronous

• Pin unlock, Response, Challenge + Response

• Standards Based Algorithm

© Copyright Entrust, Inc. 2010

DisplayCard Tokens

• Credit card format

• OATH based OTP generation

• Multi-functional card including optional on-board chip (PKI and/or EMV chip)

29

© Copyright Entrust, Inc. 2010

Mutual Authentication

• End user validation of site

• Personalized for user• Increased user

confidenceSerial Number Replay

Extended Validation Certificates

Image & Message Replay

© Copyright Entrust, Inc. 2010

Policy & User Management

Web based Administration

© Copyright Entrust, Inc. 2010

Reporting

• Web based reporting• User and

authentication tracking and analysis

© Copyright Entrust, Inc. 2010 33

Integrating IdentityGuard

Remote Access Applications

Microsoft Windows Servers

End User

Web Authentication Applications

Enterprise Applications

& Data

Repository

© Copyright Entrust, Inc. 2010 34

2nd Factor Authentication

Authentication Platform

Online Application

Initial Logon

User Name?Password?

User Name?Password?

2nd Factor Authentication

2nd Factor Challenge

© Copyright Entrust, Inc. 2010 35

Application: Remote Access

End User

Remote Access Applications

• Integrates with leading remote access solutions

• Leverages industry standards to streamline deployment

• Supports MS RAS, IP-SEC, & 802.1x clients

© Copyright Entrust, Inc. 2010 36

36

Application: Enterprise Desktops & Servers

End User

• Integrated 2nd factor authentication

• Easy to use & deploy

• Leverages common security infrastructure

Any user

****

1 6 3

Enterprise Servers

Microsoft WindowsDesktops

Administrators

© Copyright Entrust, Inc. 2010 37

Application: Extranet Access

End User

Web Authentication Applications

• Range of authenticators

• Inexpensive to deploy

• Easy to use and support

© Copyright Entrust, Inc. 2010 38

Easily Extends across Enterprise Applications

• Extranet (incl. MS OWA & leading Web SSO vendors)• Microsoft Windows Desktops • Remote Access: Leading IP-SEC & SSL VPNs, RAS, 802.1x, Citrix

AnyUser

******

© Copyright Entrust, Inc. 2010 39

IdentityGuard 2nd Factor Protection

Remote Access

Enterprise ServersMicrosoft Desktops

Extranet Access

© Copyright Entrust, Inc. 2010 40

Integrating IdentityGuard

Remote Access Applications

Microsoft Windows Servers

End User

Web Authentication Applications

Enterprise Applications

& Data

Repository

© Copyright Entrust, Inc. 2010 41

Integrated with Leading Technology Partners

Applications

Application / Infrastructure

Remote Access

Platform

© Copyright Entrust, Inc. 2010 42

SSL VPN: Juniper

© Copyright Entrust, Inc. 2010 43

Web Application Integration

Customer Environment

Existing Authentication/

Sign-on Application

SSL

SOAP

• WSDL Interface for J2EE & .NET applicactions

• Included Java bindings• Included ISAPI filter for IIS/ISA

© Copyright Entrust, Inc. 2010 44

Microsoft Desktop & Server Integration

Existing Active Directory

Enterprise Applications &

Network Resources

• Small Client for Windows desktops (GINA Chain)

• Existing AD Deployment (single or multi-domain)

• Configurable support for MS RAS, IP-SEC, and 802.1x clients built-in

© Copyright Entrust, Inc. 2010 45

Remote Access Integration

Existing Remote Access Gateway(IP-SEC or SSL)

Radius

Directory UN/PW auth with Active

Directory or LDAP

• IP-SEC or SSL Gateways• Configuration-only integration!

© Copyright Entrust, Inc. 2010 46

Remote Access Authentication Flow

VPN Client or

Web Browser

Remote Access Gateway

1.User enters authentication credentials

2. User credentials sent to IdentityGuard

4. IdentityGuard challenge requested & presented

5. IdentityGuard response sent to IG server

6. IdentityGuard server returns accept/reject to VPN Client

Repository

7.Success allows user entry

3. User credentials validated against directory

© Copyright Entrust, Inc. 2010 47

Repository Integration

• Leverages existing user entries

• Adds attributes to object classes for LDAP or independent table for RBDMS

• Read and Write operations required for some authentication options

DirectoryDatabase

JNDI

SSL

Thank you!