Webinar Recording

Managing the Password Chaos

Name: Managing the Password Chaos
Uploaded: 2015-02-13T12:00:00+01:00
Duration: 53 min 57 s
Description: More than 10 years ago, Bill Gates predicted the death of the password. A decade later, reality shows that passwords are still the most common authentication method. Security and costs of passwords are critical factors for enterprises and organizations.

Director Product Management Identity and Access Management

Atos IT Solutions and Services GmbH

Posted on Feb 13, 2015

Presentation, KuppingerCole

Presentation, Atos

Lead Sponsor

Video Description

More than 10 years ago, Bill Gates predicted the death of the password. A decade later, reality shows that passwords are still the most common authentication method. Security and costs of passwords are critical factors for enterprises and organizations.

Show Transcript

Good afternoon, ladies and gentlemen, welcome to our Ko Cole webinar. Managing the password chaos. This webinar is supported by ATO. The speakers today are me. My name is Matthias Reinhard. I am senior Analyst at Ko Cole, and the second part ol director of product management IAM at will join us before we start some housekeeping. And of course, some general information about as an Analyst company, we are providing enter enterprise it research advisory services, decision support, and networking for it. Professionals.

We do this through our research services, where we provide several types of documents, including our leadership compass documents, comparing market segments, advisory notes, looking at various topics, vendor reports, executive use, et cetera. We do this through our advisory services where we provide advisory to end user organizations and vendors, and through our events like webinars or seminar seminars with the main event, being the EIC, the European identity and cloud conference, the next EIC will be held in Munich from the fifth to the 8th of May this year.

And we think it is a must tent event. You shouldn't miss the EIC 2015 with its large number of speakers and sessions in the areas of digital identity, cloud management and GRC. Please consider having a look at our agenda for this upcoming event URL, the guidelines for this webinar, you are muted centrally, so you don't have to take care of this. You don't have to mute or UN meet yourself. We control this feature.

We are recording this webinar and with the recording at the slide, exploring online on our website tomorrow, there will be a Q and a session at the end of the webinar, but you can enter your questions during the presentations at any time using the questions or problem, depending on the language version of your software panel on the right side of the go tore software, please do so so that we can start the Q and a session right away with a good set of your questions. The agenda consists of three parts.

The first part will be my Analyst view and introduction into security, user convenience, and cost efficiency and password management. Then Uber from autos will take over and talk about integrated password management solutions for increased security and reduced costs. And the third part will be the Q and a session as already mentioned. So now let's start with our first part and my part, and that started with the meanwhile no longer provocative claim that passwords are dead.

And if we ask this question, our passwords dead, as it has been proposed almost 10 years ago, then we, of course, first of all, all ask Google. And if we ask Google passwords are dead, then we get the, the appropriate results. And the most amazing thing is, is 122 million results for this set of words. I did this a few weeks ago when I prepared for this webinar. I tried this today again, and it's 20 million more. So there must be a reason for that. And one reason might be a recent reports that we have about hacks and password Heights.

And you all have seen these, this reports about these companies listed here. And the good question, or the interesting thing is the, the sheer number of accounts or, or information that is actually out there in the wild. So if you look at the Sony hack with allegedly 1 million accounts with plain text passwords available for download in the wild, the Gmail password has with 5 million accounts, lots of publicity, but only 100 accounts. As far as I could find out with the iCloud celebrity pictures, HED, the Russian possible highest.

I put it in, in, in quotes with allegedly one, 2 billion username, password combinations. The target hack is also quite, quite familiar to all of us. And if you want to buy some credit card information, it's actually by now sold in large box, less than $10 each for one set of valid credit card or banking card information.

So yeah, the market has evolved at that point. If passwords are there, what are the alternatives? So passwords are just one alternative of authentication and these alternatives are usually grouped into three categories, three types. First of all, the, the one that is what, you know, this is the knowledge type of authentication mechanisms. This is the usual password or the pin that, you know, from your, from your banking card, the, the pros for this is, are obvious it's low cost. And there's not much to do from that from the infrastructure point of view.

But the, the contrast side is of course, all the general password issues that we come across later. The second type is possession.

Something that you have, this could be a smart card certificate on the smart card could be a Analyst from your financial service provider, or it could be a time based onetime password that, you know, from, from the internet with authenticator app on your mobile phone or the good old security key that, you know, from authenticating via from remote sites, the pros for procession based authentication is of course that these items of information are things and that these are unique. And usually there are no copies.

The, the downside of course is management and device costs and such devices might be stolen or even shared, which is in, especially that within a corporate environment, third type is biometrics. This is what you are. Of course you have a finger about the finger belongs to you. So it's what you are. It's a fingerprint, it's a retina scan or your voice that can be recognized by algorithms.

This information of of course, has the pro side that it's unique and it's difficult to share steel, but you also might have seen the, the way of, of, of cheating the, the touch ID mechanism of iPhones with almost common household items. Of course, this is an expensive authentication mechanism.

And the, the, the most important thing it's it's does not have the appropriate acceptance, at least in widespread manner, another authentication method, which could be compared or could replace the password. The user in password authentication is what is coined as bring your own identity Yi, which I don't go into much detail just to mention Federation and social login. We actually just transferred the problem over to another trusted organization and say, Hey, we trust them. And we allow to find access to users relying on this identity information across organization.

Notice both from the business usage when it's called Federation, where we have access to resources between which is shared between business partners. But we also know it from social logging on the internet, where users avoid the full registration process and little user effort to, to gain access to a special type of resources. And the organization offering this information gets access to basic personal information. And the screenshot is actually taken from the clip, a call webpage, where you can get information by a social login or by two factor authentication based on, on this authentication.

If we look at the status quo, we have to divide between the corporate corporate authentication and the log on the internet. Usually we think of corporate environments and enterprises being much more secure, and it's true. We see some deployment of hardware, tokens like smart cards or NFC devices for authentication. We see some alternative approaches, a GE adaptive authentication, depending on which way you access the resources on the corporation. But to be honest, user password are still prevailing.

This might be true for legacy systems where there is no integration or administrative accounts, the route account, the admin account, and also the fallback solutions to log in when everything else is no longer working, then user username. Password is still there and does work. But to be honest, again, often it is still the standard authentication. We have lots of username, password assistance out there in, in the enterprise, on the internet, it's quite the same or even more. We have user name, password authentication as the standard means of authentication.

Sometimes augmented by bring your own identity, which is social login. You know, this from Spotify or other services, when it says or login with Facebook or Google plus or Twitter, sometimes user in password is completely replaced by social login. But this is not that often the case. And the good thing is that, which is arising is that we have optional two factor authentication, which means we have an additional authentication mechanism on top of the user user and password mechanism.

For example, a text message sent to your mobile phone and mail sent to your mail account, or a one time keys sent to your authenticator application. And this is a good thing for payments PayPal or file storage Dropbox, or all the services that are behind the Microsoft live account, including office 365. The bad thing is optional in that case because many people do not activate activate this option. Two factor authentication, good question, easy answers. Why are passwords still being used? First of all, we start on the left upper corner cost efficient solution.

And this is true because there is no additional hardware required. There's no additional logistics. Everybody knows how to research a password or to recover a password. Although this actually is not true, I think will tell us more about appropriate mechanisms, password research, recovery passwords, and user passwords are a scalable solution. We can easily scale up to many users and many authorization operations, and we can recreate the next big thing on the internet. We can scale this to internet scale. We said this before, there is no acceptance currently for alternative technologies.

Apart from some teams who are looking into this more secure technology often to factor authentication is considered to be clumsy. And there are those general doubts towards biometrics with this subsidized, with, with a sentence, I can change my password, but I cannot change my finger on my retina. And if this is stolen, then I'm actually lost at that point. And from the user point of view, there are no new new processes to learn. We are all educated to know what a username and a password is.

We know what is their registration pro process is we know password reset, and we know what security questions are. Also. I put them in calls as well because security, sometimes it's something that is different from security questions, password issues. I want to go into that thing quickly. It's the user side of managing passwords. We all have usually many passwords on many systems, no matter if it's corporate systems or if it's systems on, on an internet service.

And this usually an often leads to weak passwords, as long as there's no policy that that changes this week, passwords are short passwords, simple passwords or guessable passwords, and even standard passwords. The CA the fact that there are some, some massive amounts of, of real real life passwords out there in the world has met some people to analyze the structure of passwords. And it's not a surprise how many standard passwords like password or CD.

1, 2, 3, 4 are still out there. And I use this real like passwords. Usually people don't change passwords if they don't have to, if they have to change the password, it, it always goes down to different password policies and password cycles, and probably different password principles arranging from mainframe to, to SAP systems or the usual windows password.

And if you have many password policies and many passwords, this often leads people to reusing their passwords across systems, which is a very bad thing to do because once a password is compromised and out there in the world, it can be easily guessed that this is also used for other services as well, password management issues, which is the part two of this sequel, or is the sequel to that is the service side or the service side. We have seen many things inappropriate for year 2015 in the news recently, no, or in appropriate password management in place is a, is a bad thing to do.

If there are no appropriate password checks for password making composition or password history, this is a problem. And so weak passwords can get through the process, no regular password updates. It all imposed from the server side is a bad thing to do or weak password research mechanisms. I think you all have seen two simple security questions in, in, in the, out there in the world as well.

Anybody can guess what was the first, what's my first chat, if you normally by person and what I've said before, system specific policies and restrictions with nothing or little in common may lead to, to different password management processes, which lead to weak passwords as a sum. And we've seen basic technology errors, general security issues, allowing unauthorized access to authentication information like passwords.

If you can intrude into a system and you have access to the passwords in the system is which is something that has happened in the, in the recent days, that this is a real problem, password storage with no or weak encryption. How can passwords like in the, so pictures, heist can get out there in the, in the wild, in, in clear text when they're not stored in clear text and there have been, and with the iCloud issue, there was a food force password attack possible in one system.

And these are together basic technology errors that have to be avoided and have to be completely eradicated within mature password management systems. How can we mitigate this both from the user side and the server side, or actually, this is a question that's been answered for years, the infrastructure has to be appropriate. So the password management has to be put into a usual secure identity management system, you know, will tell us about this later on.

And the complete infrastructure has to be put into a secured and monitored server environment so that there is no chance of hacking into the system. And there must be some, some real time security intelligence to identify intrus, to be at a modern status and modern touch level for all the involved components. It's a secured and monitor environment. And all the rest actually is something that is up to password management. You have to have well defined reg registration processes for users entering the service.

No matter if it's on the internet with self registration, or if it is within an enterprise where people get initial information to register themselves, we have to have well defined password policies. Again, regular password changes, password length rules, and composition rules with the length rules. In my opinion, being the much more important because complicated passwords of length, five characters even easily to hack.

So the length is very important for passwords as well, and password history rules to make sure that people don't read you passwords too often, we have to have password reset processes, and we have to make sure that all these processes are easy to use for the user user. Convenience is a prerequisite for having a good password management process in place. And only then if password, if assistance is needed, then it must be available. For example, with a help desk, all these processes as described, do mitigate many of the described issues set on the, on the slides before.

So to sum it up requirements for password management, we have different use cases for corporate users, partners, customers, and for users on the internet. Actually, this is missing on the slide. We need a high level of user convenience, which means ease of use and performance. A very important factor is cost efficiency. The better the, the less the, the, the help desk is involved, the better it is for, for cost efficiency. The more automation is in place. The better this is for cost efficiency. And maybe we will talk about that later as well.

Password management as a service might be interesting for those enterprises, which do not have many password change requests due to low number of users or for due to increased level of efficiency in general. The good thing about password management as a result is of course, an increased level of security.

If we enforce the, the password policies, if we secure the password reset and recovery, we have secure password in general, if we have additional authentication mechanisms during, for example, password reset, like two factor authentication with a text message sent to your, to your mobile phone, this of course increases the level of security during the password maintenance. And if we have a service which is monitored and, and, and supervised, we also can detect password hacking attempts or hacking attempts into the infrastructure in general.

One thing that should be thought of as well with software or services as yeah, or password management as a service in general, is that we can think of password management clearly as a definable set of processes, which is self-contained and complete.

And this is a great candidate for outsourcing it to, to a service or for, to putting it into the cloud as a managed service or a hosted service, be it at a vendor site, or on premise, you can decide whether you make your password management process yourself with full control overall processes, especially when it's a nonstandard process, but this requires real high level of state of the expertise and agility in your team. And it requires continuous maintenance, maybe overnight, maybe at talk.

If the security flaws is, is, is identified and has to be solved immediately, you can buy this as software best practices implemented in software, which is a good thing to do, to, to, to use the knowledge which is provided by a vendor, which is put into software. And then you have the support and the software updates from the vendor as well through usual support processes. But of course you have a, a degree of dependency on the vendor of your choice for the solution, at least for the time.

And a good, a good new thing to think of is password management as a service where you get all the general benefits of a managed service, for example, something that you couldn't provide yourself, something like 24 7 service, which you can use from your service provider, you will have immediately patched systems, because this is something that is key for the service provider in general. And maybe you can get to services that would be not feasible for you to provide yourself for cost purposes.

For example, something like shared technologies like voice recognition or software based onetime password, which is quite some infrastructure to provide for yourselves, which is a good thing to use when you're using it in a package as a service, as a short conclusion for my part. And then I will hand over to because passwords are of course, conceptually flawed, and we all know that, but many issues can be mitigated or avoided passwords are surely not there yet. And they are not likely to die in the near future.

They might lose importance with other concepts being augmenting them and replacing them as we've said before, two factor authentication, or probably also the other authentication mechanisms, but they will always remain an important component in almost any security architecture and if it's for fallback purposes. So to sum it up and to hand over to RUO passwords require a robust and secure password management process to be in place. And this is something that RUO will talk now for the next part of this session.

Thank you very much material for your introduction on authentication and passwords in particular. So, as we all know that now the password is not that, and, and we'll still live for, for many more years. The problem is, and the challenges to mitigate the usage of passwords and enterprises and organizations. So what do enterprises and organizations suffer from when they're using passwords in many cases? So there are too many passwords, mostly used.

There are weak passwords used because of weak password policies and many customers, many end users forget the passwords, for example, when they return after vacation. So therefore we need to do to mitigate the usage of, of the passwords and enterprises and organizations. And in this part, in the second part of this webinar, I will especially talk about product technology for password management, which is embedded in an identity management solution and also on deployment and delivery options.

As Matthias mentioned, there's not only the on premise option for password management solution, but there are also managed services or, or even cloud services that can be used nowadays. So just to catch up what Matthias has said, what are the ingredients you need to manage the password chaos, and to come to a robust and secure password management solution. On one hand, you need a infrastructure which consists of a safe and secure and monitored the server environment. And second, you need an identity management solution where all your users are managed.

All the access rates are managed and you keep control on the user life cycle. And also this should include a password management solution. So therefore password management solution, which is embedded in your identity management solution is most appropriate. And there are a couple of ingredients and, and also factors in the password management solution that make the password management deployment, then success.

Of course, you need to have a registration process quick and easy registration process so that newer end users can register to take part in password management and then even password reset solutions. You need strong password policies to manage the password history, complexity, and, and blanks criteria. You need a very convenient reset process, which every user can do on his own without the need for assistance. And this must be easy to use, but of course, in some cases, some people will not have access to the, to the password reset solution to the self-service reset solutions.

So as a fall back, you need still some service desk in the background where people can call and get assistance. If they don't manage to reset their password on their own Atos is an identity and access management vendor, which provides a full suit, full suite of identity and access management products and password management and enterprise SSO.

Our integrated components of our IM portfolio, as it is highlighted here, you can see that password management is embedded in the identity management solution consisting of user management role management provisioning, which is also seamlessly integrated with identity access governance and has a foundation of on a meta directory solution that is also able to manage all the entitlements of the users and enterprise singers and on can complement the identity management and password management solution to get even more convenience in filling in password screens and renewing passwords automatically.

What are the essential parts of a, of a password management solution, which is embedded in an identity management solution? First of all, of course, the self-service password reset, which allows users to reset, forgotten passwords for, to even unlock accounts using alternative credentials. Then they registration process, which is supported by a user enrollment process so that users can select and answer for example, security questions. As alternative credentials, as a fallback solution, assisted password research is needed.

We are administrators or service desk stuff can reset, forgotten passwords on behalf of the users or unlock accounts. If they, for example, repeatedly entered the wrong password and the account was locked automatically by the underlying application, and also very important, you need to be notified in case of password expiration. For example, when the password is about to expire in one week, you'll get an email that reminds you to change your password in advance before it expires.

And before the account gets locked, additional components in the passport management solution could be password synchronization. For example, if you want to drive different applications with the same passport for, for each user account. So that allows you to synchronize the password changes that you do in, in one system to target applications. In real time. Materials also mentioned the fact that typically root accounts are only secured by passwords in many cases, even for example, if maybe a two-factor authentication is already rolled out in, in the, in the enterprise.

So with Derek's identity, we also have privileged account password management, which allows to manage and control access to passwords for shared privileged accounts. For example, if you have a group of administrators that are responsible to maintain the operating systems and to do regular monitoring and regular maintenance tasks, so they can query the system and ask for, for a root account passport. And once the root account passport is disclosed, it gets automatically reset to an unknown value maybe after one hour after it was disclosed.

So this gives additional security for very privileged or high privileged account so that the, the passport is unknown to all the people most of the time. Then, for example, if you do password synchronization, if you have a password synchronization solution in place, it's best that you also have a password listener. For example, for windows, for example, when the user changes the desktop passport, we can catch the password in, in clear text and synchronize it in real time through the, to the supported target systems and target applications to manage the, the password policies.

We have web user interfaces that allow you to manage and enforce the rules for complexity, exploration, and history of passwords. So for example, you can define that only 10 passwords that 10 passwords, well, then the new password needs to be different than the last 10 passwords then have been used, for example, and especially in, in different cases where for example, managed services and cloud services are used audit and reporting capabilities are very important because they can also be used for billing purposes.

If the service is delivered as on, on demand as a pay per use service, and this can be complimented with an enterprise singles and on solution, this is the EDN singles and on enterprise singles and on solution, which allows you to automate and enter, which allows you to automate, entering and renewing application passwords.

And this is not only restricted to enterprise applications, but it can also be used for example, for internet services, for example, where you have very many passwords that are not controlled in, in your own enterprise, let's see how that looks like in, in a couple of screenshots.

So the, the self-service capability is available for password reset in two flavors, there is a windows client, which is installed on every notebook on every desktop where users can reset, forgotten passwords by using alternative authentication methods, like using smart card and pin or security questions to be answered. This can be accessed and used before log to windows. So there's no needs that you go to your neighbor colleague and ask him to help you with the password reset.

So there's an option in the login screen, which you can click by control arts, delete finger ex finger exercises, and you get an immediate feedback on the success and failure of the password reset. So the password reset client it's needs to be deployed on, on a user's workstation or notebook, and can be provided with different language support and different options for deployment.

In addition to the self-service password reset client for windows, we have a web based service for self-service, for example, where you can also change the passwords reset, forgotten passwords, but it's also used for enrollment for registration of users, that they are part of the password management and password reset solution. So here you can manage your alternative credentials, for example, by selecting security questions and answering, provide answers to this security questions.

And you can also monitor the password change status if it's pending, succeeded or failed for each of the accounts that you have selected, where you want to reset the password. The same web center user interface for password management is used by the service desk stuff. Service desk employees can reset the user passports on request. They can validate the users when, for example, the users call by telephone. They can see their personal attributes.

They can verify the answers that the users give them over the phone to the security questions they can verify if these answers match the, the store answer in, in the user's profile. And they also can create and, and maintain the password policies for the, for the different target systems. And of course can create reports on password changes resets also for billing purposes here, you can see some screenshots for the monitoring and, and reporting part. For example, when you enter a new password, you will get immediate information about if it's reset was successful or not.

And here the service desk part is also able to create password management history reports, for example, how many users have rejected their password during the last 30 days or so, and with the enterprise things and on the EDN enterprise singles and on automats any type of password request window entering the password into this window, and also renewing the password in the case that the password has been expired and needs to be, for example, have renewed every 60 days where every 90 days, in addition to the product technology for passport management and for enterprise singers, and on, there are a couple of delivery options that ATO provides.

Of course you can deploy passport management solution on premise as, as a typical installation in your enterprise, it data centers, but you can also use the password management solution as a managed services operated on a, on a dedicated server environment where you can even use in future the password management solution from the cloud, from the ATO data center cloud centers, which is a shared service, which is open then to various customers.

And the same service is used by the customers, but the data is completely separated and secured, and it just provides two end user options for password reset. This is the windows password reset client, and it's the web center web based user in the phase for enrollment and password reset. Let's come to a case study that we have done with our, with one of our largest customers here, which using, which is using the password management solution as a, as a managed services customer.

So the initial situation with that large multinational enterprise voice, that there are about 300,000 ad accounts to be managed. They had a 90 day password aging period and their major authentication method is smart card and pin based.

And well, before we introduced the password management solution as a managed services, they had only the service this to reset the passwords for the end users they had about at the maximum 7,000 service desk calls per month to reset the password. And in average, it took about 25 minutes to handle password resets for the end user. In some cases, in the worst cases, it took even more than a day.

And the process was quite complicated because the person had to go to a, to a neighbor and to send an encrypted email so that the neighbor could verify that you are really the person that you claimed to be. And then you got the password on a secure channel, for example, on the telephone. And you had then to, to enter the password. And of course, once you had ended the password, you still had to change the password. Cause the password was of course known by the service desk people. So this took in the average 25 minutes per possible reset. And of course this time was quite unproductive.

After we have rolled out the solution, we came to the solution with password reset, client installed on the laptops and, and desktops for the users. Right now we have about 200,000 clients rolled out in, in about 11 ad domains, about four thousand four thousand five hundred resets per month are now handled through the password self-service password reset tools and the downtime for the end users during the password reset was reduced to less than five minutes.

And in most of the cases, it's only one minute that the user needs to reset the ad password, for example, and the costs were reduced by approximately 50% by per reset. And of course this is a significant quality improvement.

Also, the process is now much easier. It only consists of four steps until the password until the password is reset and the user can log again. So together we rolled out the solution beginning in November, 2013, and there were about three months of piloting the solution where only a few people had the chance to do self-service password reset. And in March, 2014, the large scale rollout started in, in various geographies of the multinational enterprise.

And within five months until the August, 2014, we had about a reduction of 75% of the service desk caused due to the usage of the self-service passport research tool. And of course the customer were quite excited. The end users of the customer were quite excited because it only took them about one minute to be able to log in again. And of course they really appreciated the password solution and yeah, of course wanted that the rollout is as complete as possible so that all the 300 ad accounts are equipped and all the end users are equipped with the password reset tool.

So let's summary let's, let's summarize what we have learned today regarding passport management and integration with the identity management solution, password management solution helps to raise the productivity. So the users can immediately reset, forgotten, or expired passport synchronization helps to minimize the number of passwords that users need to remember. And using the self-service password reset client improves the user experience very much. It's very convenient and it's only it reduces the downtime only to one minute or even less.

Also the, the management costs can be reduced very drastically as we saw in the case study at, by about 50% because the number of service desk costs could be reduced. The handling of password reset is, is quite easy and then much faster also for the service desk using web center web user interface. And we have a seamless integration of password management with the enterprise identity and access management solution. And if you use this as a managed service solution or, or as a cloud solution, you can also have a paper use model.

So depending on the number of you would be built, and also the compliance and security was raised and increased by being able to enforce strong and consistent password policies across all the applications and by the ability to provide reporting and auditability traceable, auditability, and increased security for privileged accounts as well. So to end up with that, an integrated password management solution from ITOs helps managing the password chaos. So for example, if you start from a chaotic picture like this, you will end up in a more streamlined and more structured picture.

You will end up in a secure and cost efficient password management solution when you deploy the, the Atos password management solution together with the identity and EDN enterprise as so. And the question will be, will it ever, will there ever be a world without passwords?

Probably, probably not during the next 10 years, but hopefully in the long term future, we will see that situation. Thank you very much. This was my part. And I returned back to the moderator. Yeah. Thank you very much, Ru thank you for this great insight into your current portfolio of the products that you use for implementing and deploying password management processes with your customers.

Again, I want to ask the, the participants to add their questions for this Q and which we are now approaching through the questions panel on the right side of the go to software to start with the first question from, from your point of view and from your experience Rudolph, do you see as a result from the, the recent news or the recent year or so with lots of, of attention being in the press on password management that people are approaching you for, for providing solutions, is there a higher attention to, towards, towards password management? Yes, absolutely.

There's a very high attention because of the, the latest data breaches, especially in large and, and medium enterprises because of the auditors that require evidence of yeah. The measures that they take, mitigation actions that the customers take. And of course, especially in, in as artists as a, as a big outsourcer and, and service provider. So also the, the customers that already are using managed services from, from Atos are raising great and big demand for also including password management in, in their service options. Okay. Thank you.

One question from the audience is I just read it out. Do you provide any API to access the shared account management module by third party applications in order to check out credentials, for example, to be used in, in automatic login processes, are there APIs available? I don't think think that there are currently APIs available to the, to the, to the disclosure of, of passwords that are stored inside the identity management solution. Currently the abilities are through the web user interface.

So, but we have not started in implementing rest API for that. Okay. Thank you.

Two, two more, more product specific questions or, or strategy focused questions is the question whether Videon and tier X are together, one suit of, of products, or how is the, the licensing done? What is DS? What is the Videon and how can one create one solution out of these two product names and the solution behind that? So Videon and the Atos direct solutions in the same ownership since a couple of months, because it was acquired fresh company bill, where Weedn is a subsidiary of bill.

So therefore we are now working on a, on a strategic portfolio that we will present to the market within the next two or three months. And of course, right now you can already purchase the products that are tightly integrated because even before EDN and, and Atos came to the same owner, we had various projects where these products were already integrated, especially the enterprise singles and on product from EDN, with the management and director server from, from Atos. Okay. Thank you.

The second question is something that I don't want you to answer during this session, but I think you will be surely available for answering afterwards. And one-on-one, there's the question about what kind of charges can one expect on a paper use perspective for managed services, I think is something that you can answer directly to the, to the attendance.

Yeah, absolutely. Okay, great. What we've seen all the time is a, a corporate usage of this password management. Do you have any experience or are there any difficulties of deploying your password management system also in an internet facing service, like a web community or web mailers or the next big thing? Because this would be a, a perfect match.

I think, Yeah, it would be a perfect match. So certainly, I mean, if you look at the enterprise things and on product, that's certainly right now available without any problems, because any type of, of password window can be automatically filled and yeah. That's could also be extended to, to internet scenarios.

Okay, perfect. And, and the same question the other way around, have you seen social login integrated within the enterprise landscape already? Are there enterprise that you see as your customers, which allow for some purpose, a social login, bring your own identity? Yeah.

Towards how to say to a small extent and for very specific purposes, because of course you do not have the same type of assurance level that you have with the, the employees or, or maybe with the, with the users that are managed by the enterprises, be it suppliers or partners or, or whatever, extended community you support, because so you don't have control on the assurance process. In those cases, we have seen it. It's mostly that you grant access to some non-sensitive areas in your solutions or, or in your, in your web pages, for example, for some custom specific pages for some yeah.

Where you, where you manage your, your profile, where you do some research as, as an end user. So I don't have seen any, any cases where for example, somebody could log in into any enterprise it application using a social login. Okay. Thank you very much. This is what I expected as well, because everything that is enterprise relevant for, for security purposes, I don't think that there is a, usually a good argument for having a social login for that. So as far as I can see, this was the last question that we have to answer. So we are at the end of our session. So I think that's it today.

I would, I would like to thank you RUO for your presentation and perhaps give you the chance for a few final words. RUO Yeah. Thank you very much Matthias. So it was a pleasure to, to have the, the webinar together with you with your very profound introduction to the authentication and, and passwords in, in particular. And I see that the delivery options like managed service and, and cloud service are really taking off and it's quite good enhancement and extension of existing enterprise identity and access management solutions for specific purposes.

Like for example, for password reset solutions to go to a managed service provider or to go to a cloud provider simply for buying that solution. Okay. Thank you. Both of us are available by mail for other questions.

If you, if questions come up afterwards, I would like to thank the attendance for listening to this webinar. We've had the, the slides for the upcoming EIC in the background while we were talking, we hope that we see you soon in some other webinars, or maybe at the EIC in may. Thank you very much and have a nice evening.

Like this?

Don't like this?

Why don't you like this?

Managing the Password Chaos