RSA SecurID^® Access Prime

Is there a way for RSA self-service agent to pin the TLS certificate for the Prime portal. ... View more

The RSA Professional Services Team has made a number of enhancements and feature additions to the RSA SecurID Access Prime (formerly AM Prime) software package, continuing to expand the ecosystem to provide additional efficiencies and value to RSA customers that result in greater ROI on their new or existing RSA SecurID Access deployment.  Below we outline significant updates thus far in 2020, highlighting the business value that these updates afford.   Prime Self-Service Portal UI Refresh The default Prime SSP login screen (Figure 1) and dashboard home page (Figure 2) have been updated with new icons and buttons to provide for a cleaner, more modern UI look-and-feel.  Under the hood, numerous changes have been implemented to re-organize and streamline SSP UI elements allowing for organizations to more easily apply their own branding and desired look-and-feel through CSS.   Old New Figure 1. Comparison of Old and New SSP Login Screen Old New Figure 2. Comparison of Old and New SSP Dashboard Home Screen   A new "Prime Style & Customization Guide" now available on RSA Link provides details on how to implement changes to the Prime SSP interface as well as a number of assets that can be utilized "as-is" or leveraged by your organization as input for generating your own images, icons, and notices.  View the guide [here].   Prime Quick Setup Tool Starting in 2018 timeframe, RSA Professional Services developed the PrimeKit installation framework to improve consistency and supportability of Prime deployments.  To complement PrimeKit, a new tool has been created, Prime Quick Setup (PQS), that vastly simplifies initial Prime set up configuration as well as operational configuration updates (e.g., AMIS service account password changes, RSA Cloud integration).  PQS accelerates initial PrimeKit deployment, reducing set up time from hours to minutes, for quicker rollouts and customer Time-to-Value with Prime and RSA SecurID Access. It also simplifies ongoing Prime core config changes to minimize administrative tasks.   Guided Enrollment for RSA SecurID Software Tokens A discrete "guided enrollment" workflow endpoint has been added for RSA SecurID software tokens, similar to existing Prime functionality for RSA Authenticate guided enrollment.  This allows users that are being onboarded with RSA SecurID software tokens to be placed directly into a step-by-step closed loop process that provisions the token, allows the user to set their PIN, and activate the token.    Prime invitations, triggered via HDAP or programmatically, can be leveraged to enable direct user access into the specific workflow.  The Windows 10 Prime Credential Provider can be used as an additional option to further streamline end-user access into the workflow.    See the demo video to the right for an example of the guided enrollment process, as initiated by an HDAP invitation to the user. Figure 3. Guided Software Token Enrollment Demo   Expiry Notification Service Support for Token Auto Extend The Expiry Notification Service (ENS) utility within Prime allows for automated notification and alerting on certain token lifecycle events, and in some cases initiation of operational shutdown of an authenticator or account (for example, due to inactivity).  The ENS utility has been enhanced to support auto-extension of RSA SecurID software tokens based on the capabilities introduced in AM 8.2 SP1.  Use of the ENS utility can automate the token renewal/extension process, lessening the associated administrative burden which can often be significant and time consuming for organizations with large-scale token deployments.  Note that the software tokens must have been issued previously under AM 8.2 SP1 or later in order to leverage this feature.   Unified Authentication Activity Monitoring in Help Desk Admin Portal The Prime Help Desk Admin Portal provides a "single-pane of glass" for End-User Support personnel to look up, view, and troubleshoot end-users across all assigned RSA authenticators, whether originating from Authentication Manager or the RSA Cloud Authentication Service.  HDAP now offers a unified view into user authentication activity for real-time troubleshooting as well as historical events, whether a SecurID authentication via AM or an MFA authentication via RSA Cloud Authentication Service.  Easier and more efficient End-User Support servicing reduces issue resolution times thereby allowing End-Users to get on their way quicker.   HDAP Feature Adds for RSA Cloud Authentication Service Support New features have been added to HDAP to further extend support for RSA Cloud Authentication Service option in the areas of user enrollment and emergency access.   To provide additional assistance during device enrollment scenarios, help desk personnel can now manually generate a device registration code for an end-user. This device registration code can be used to securely enroll a new/replacement device when users may not have access to the Prime Self-Service Portal.   To support users who have misplaced or damaged a registered device, help desk personnel can now generate a cloud-native emergency access tokencode that can be used to authenticate to resources protected by the Cloud Authentication Service. This emergency access tokencode can be configured to expire within 1 to 7 days based on the desired configuration. Additionally, a help desk user can manually disable an emergency access tokencode for a given user should the original device be located or replaced.   PrimeKit Performance Improvements The Prime AMIS software has been further optimized, resulting in performance improvements that can significantly enhance AMIS transaction throughput, particularly under high-load conditions.  This leads to more consistent transaction times and better overall system stability.  Because AMIS is foundational to the Prime portal applications, better response times can be realized within Prime SSP workflows thus providing for an improved end-user experience.   Other Items of Note A number of other general improvements, updates and fixes are contained in the latest PrimeKit release.  These include refresh of the underlying technology stack (e.g., AdoptOpenJDK, HTTP/2, Tomcat, OpenSSL, Apache Portable Runtime (APR)).  Customers on versions of Prime software deployed prior to 2018 are highly encouraged to have RSA Professional Services evaluate their existing Prime deployment for upgrade to PrimeKit and optimization of their configuration.   Contact your RSA Sales Representative if you are interested to learn more about the RSA SecurID Access Prime package and recent updates. ... View more

Demonstration of how the RSA SecurID Access Prime package can be utilized to provide for end-user self-servicing of "Forgotten Password" use case.  Prime supports Microsoft Windows AD password resets with strong authentication built into the workflow.  The RSA SecurID Access Prime framework provides for a number of options that allow the workflow to be tailored to best fit your specific requirements. ... View more

This "2 Minute Prime Video" demonstrates how the RSA SecurID Access Platform can be utilized to onboard a remote user with MFA credentials.  The RSA SecurID Access Prime framework provides a number of options that allow the workflow to be tailored to best fit the desired deployment model. ... View more

Over the past 12 months RSA Professional Services has worked closely with the RSA Product Team and made substantial progress in extending functionalities within RSA SecurID Access Prime (formerly AM Prime) to encompass the RSA Cloud Auth Service and newer MFA methods as well as Authentication Manager and traditional SecurID tokens.  Below we outline these updates and highlight the value that these updates provide.  Prime Self-Service Portal Earlier in 2019, a new SSP badge was added to support  self-service functions related to the RSA Cloud Authentication Service and RSA Authenticate mobile MFA.  Substantial improvements and refinements have also been made for self-service of Windows AD passwords, bringing additional customer value to Prime SSP as a "one-stop shop" for authentication credential self-service -- across traditional RSA hardware and software tokens, on-demand authenticators, modern RSA mobile authenticators, and Windows domain passwords. Let's take a deeper look into the details of these Prime SSP enhancements... (click on image to enlarge) RSA SecurID Authenticate Badge Functionality (click on image to enlarge) Prime SSP supports a guided process for users to enroll their mobile device with the RSA Cloud Authentication Service, whether transitioning from an existing RSA authenticator, onboarding as a net new RSA user, or any scenario in between.  Once enrolled the Authenticate badge, pictured at left, will be visible to the end-user in their SSP dashboard view and the user now has the ability to: Trigger a test authentication to their mobile device. Edit their mobile number for SMS or voice. Un-enroll their mobile device, in the event of mobile device replacement Windows AD Password Self-Service Numerous improvements to AD Password self-service have been made both within the SSP User Interface (UI) and "under-the-hood" with the goal to streamline the end-user experience and to make pertinent details and tasks more readily accessible and obvious to the user. Once authenticated within the portal, the user account is automatically unlocked (optional configuration) User details are surfaced to show AD account status and password expiration date. Test AD Authentication supports "change password at next log on" scenarios. Reset Password workflow allows for change/reset of user AD password. (click on image to enlarge) Added End-User Assistance Features (click on image to enlarge) A new tab has been added to SSP that allows customers to locate their own "How to..." help, troubleshooting, and tutorial information within the portal itself.  The contents of this tab are fully customize-able HTML and can include graphics and videos. Additionally, more mouse-over "tool tips" have also been implemented for various SSP fields and buttons to provide contextual guidance to end-users. Prime Help Desk Admin Portal HDAP now provides customers' front-line Help Desk staff with a "single pane of glass" to view all end-user RSA authenticators and authentication activity across the full RSA SecurID Access platform -- Authentication Manager and the RSA Cloud Authentication Service. HDAP can be leveraged to initiate "one-time use" email invitations for user device enrollment with the RSA Cloud Authentication Service.  (click on image to enlarge) End-User Identity Verification Through MFA HDAP provides help desk personnel with the ability to trigger an RSA Cloud Authentication event to an end-user's device to do a real-time user identity verification and device proof-of-possession check: 1. End-User initiates call to the Help Desk to get further assistance troubleshooting an issue with their access. 2. After looking up and verbally vetting the End-User, the Help Desk Representative triggers an MFA event to the End-User's enrolled mobile device by clicking "Verify Identity" button in HDAP and choosing the authentication method to apply. 3. End-User receives a request to authenticate via the Help Desk-selected method on their enrolled mobile device.  In this case, t he Help Desk Representative elected to challenge based on the  user's fingerprint. 4. Help Desk Representative receives confirmation the End-User authentication was successful and can now continue the call with the confidence of strong identity assurance! Consolidated Viewing of User Authentication Activity (click on image to enlarge) HDAP can display a consolidated user authentication history across both Authentication Manager and the RSA Cloud Authentication Service so that Help Desk personnel can quickly zero-in on the user's activity and issue without having to concern themselves with which type of authenticator the end-user has or which back-end system the authentication request is hitting.  There is an option for the HDAP user to filter by: AM & CAS, AM Only or CAS only. Prime Windows Credential Provider A Windows 10-compatible Credential Provider has been added to the Prime software package to facilitate RSA authenticator onboarding and forgot password/PIN scenarios when the End-User is not on the corporate network to access self-service (Prime SSP, MyPage, or other).  RSA strong authentication is used within these workflows to gain "off-network" access to authorized self-service functions. Used in combination with the new Windows MFA Agent, the Prime tools can provide a compelling piece of the RSA story to take large Enterprise organizations on the journey to password-less authentication. (click on image to enlarge) Other Items of Note The Professional Services team is actively working to make the PrimeKit installation package the official customer distribution for the RSA SecurID Access Prime software package. Contact your RSA Sales Representative if you are interested to learn more about the RSA SecurID Access Prime package and feature updates. ... View more