Austria Card: secure authentication for a security specialist - Vasco

DIGIPASS BY VASCO
Austria Card Case Study
Austria Card: secure authentication for a security
specialist
Data security is an issue in every company; however, in some industries it may be more essential than in others. As a competence
center for the development and production of chip cards for electronic payments and identification, Austria Card GmbH uses the
highest security standards. To prevent unauthorized access, Austria Card secured its corporate network with two-factor authentication
using VASCO’s VACMAN authentication software and DIGIPASS devices.
About fifty employees make regular use of the remote access facilities to
access Austria Card’s corporate network. It mainly concerns a mobile workforce,
so called road warriors, who need to access business critical data from hotel
rooms or public hotspots. Additionally, other employees occasionally require
remote access, for instance to access the production planning and the ERPsystem
after hours from the home computer. Similarly, system administrators
require secure access due to the nature of their activities. Furthermore, a
number of suppliers and partners also use remote access to access Austria
Card’s systems for maintenance purposes.
EXISTING SOLUTIONS WERE TOO COMPLEX
The adequate protection of remote access requests has always been a high
priority at Austria Card. However, the existing solution proved to be too complex
and unstable when the number of users increased.
“The solution used certificates which had to be stored on the end-user’s PC,”
explains Thomas Höher, CISO at Austria Card. This was the main reason for
Austria Card to look for a new solution. “The use of certificates was too complex
for our users. Furthermore, client software had to be installed on every PC. As
this software was anchored deep into the system it affected the overall system
in a negative way in certain situations.”
Together with Technovisie, the sister company responsible for IT, the decision
was taken to look for another solution to secure remote access to the network in
a user-friendly way and as a result would be easily accepted by the end-users.
A solution based on two-factor authentication using one-time password best
met the requirements. Through joint development projects, Austria Card already
had some contacts with VASCO. On top of that, the colleagues from Technovisie
who were responsible for the implementation, already successfully employed
and used DIGIPASS.
The simplicity and stability of the solution, as well as the recommendations
from the Belgian colleagues, were deciding factors for choosing the VASCO
authentication solution which would work with the SSL VPN appliance from
Juniper.
ONE-TIME PASSWORDS ARE THE SOLUTION
For secure remote access each employee or partner received a DIGIPASS.
When they log-on the DIGIPASS generates a one-time password which is used
for authentication and which is only valid for about half a minute. VACMAN
Middleware, the authentication server at Austria Card, will check the credentials
and allow or block the access to the Juniper appliance. A policy has been
defined on the Juniper appliance to determine who can access what type of
data and applications.
When logging-on, the VASCO solution ensures that the user really is who he
says he is. VACMAN Middleware is also used as the central user repository
from where user access can quickly be blocked if needed. When this happens,
the end-user will no longer be able to authenticate himself. As a result, all the
permissions to use the network and the applications will become obsolete.
The new remote access solution deployed by Austria Card is very easy to use
for employees. Each time they log-on, they will have to generate a new onetime
password at the push of the button. The solution requires no installation
of software on PCs or laptops and it eliminates the cumbersome handling of
certificates. Since there is no physical connection between the PC and the
DIGIPASS, it is even impossible for hackers to manipulate the DIGIPASS when
the PC has been compromised. Even a password which has been intercepted
by a key logger is useless, considering the password can only be used once.
OUTSTANDING USER ACCEPTANCE
«Our users are happy they no longer have to deal with certificates,» says
Thomas Höher. «The new solution is absolutely reliable and a huge relief for the
employees. It brings us a real security improvement, since the previous solution
was rather a one and half-factor authentication solution than a true two-factor
authentication solution.»
On the server-side, the VASCO solution is also very easy to maintain. The central
authentication platform VACMAN verifies the authentication requests and
provides central user administration. It requires little resources: at Austria Card
VACMAN Middleware runs on virtual Windows 2003 servers using VMware ESX.
VACMAN supports Radius server as well as Novell e-directory already used by
Austria Card. As a result the integration of the authentication solution into the
existing environment went smoothly.
«VACMAN was installed and configured within the hour. The entire
implementation, including the integration with our Novell environment went
Case Study

smoothly,» said Thomas Höher. «And when we needed help, we got it fast and
to-the-point from VASCO.» “But also in daily use the system is easy to manage,”
Thomas adds. «I can explain our remote access solution to an administrator in
about two minutes.»
Since the end of March 2010, the new solution is fully operational. As soon
as the last DIGIPASS was handed out, we started planning the next project.
As a member of the Lykos Group Austria Card is responsible for the planning
of a company-wide project management system which needs to be remotely
accessed by many employees. For this project Austria Card plans to link the
Radius server of the Belgian sister company to its own remote access solution
enabling employees to access both networks with a single authentication device.
Employees from other involved companies in other countries, will be equipped
with a DIGIPASS device to use the central project management system.
About Austria Card
DIGIPASS BY VASCO
Austria Card Case Study
Objective
The replacement of a complex, certificate-based authentication solution with a
secure and user-friendly remote access solution.
Challenge
The new solution should not only be safe and user-friendly, it also had to
support the planned introduction of a multi-site project management system.
The authentication to multiple RADIUS servers should be possible with a single
authentication device.
Solution
Austria Card chose the combination of VASCO’s VACMAN Middleware and
DIGIPASS: a strong two-factor authentication solution using one-time passwords
to secure remote access to the company’s network and resources.
Austria Card GmbH is a member of the Lykos Group and subsidiary of the center for the development and production of chip cards for electronic payments and
identification of the Austrian National Bank (OeNB). For future proof security, the company creates new procedures on topics such as e-payment and digital signature.
The focus on payments and identification strengthens its expertise in the timely implementation of complex projects in an international context. Traditional core
competencies such as card production, personalization and logistics under high security conditions are, in addition to the development of chip-based application
software and operating systems, the pillars of sustainable success.
About VASCO
VASCO is a leading supplier of strong authentication and e-signature solutions and services specializing in Internet Security applications and transactions. VASCO has
positioned itself as global software company for Internet Security and designs, develops, markets and supports patented DIGIPASS ® , DIGIPASS PLUS ® , VACMAN ® ,
IDENTIKEY ® and aXsGUARD ® authentication products. VASCO’s prime markets are the financial sector, enterprise security, e-commerce and e-government.
www.vasco.com
BRUSSELS (Europe)
phone: +32 2 609 97 00
email: info-europe@vasco.com
BOSTON (North America)
phone: +1 508 366 3400
email: info-usa@vasco.com
SYDNEY (Pacific)
phone: +61 2 8061 3700
email: info-australia@vasco.com
VACMAN ® , IDENTIKEY ® , aXsGUARD ® , and DIGIPASS ® are registered trademarks of VASCO Data Security. All trademarks or trade names are the property of their respective owners.
VASCO reserves the right to make changes to specifications at any time and without notice. The information furnished by VASCO in this document is believed to be accurate and reliable.
However, VASCO may not be held liable for its use, nor for infringement of patents or other rights of third parties resulting from its use. © 2010 VASCO. All rights reserved.
SINGAPORE (Asia)
phone: +65 6323 0906
email: info-asia@vasco.com
Case Study