July 2018 Cloud Authentication Service and Identity Router (IDR) Release
The July release for RSA SecurID Access is now available and contains updates for both the Cloud Authentication Service (CAS) and the Identity Router (IDR). In this release RSA continues to add capabilities to further enhance RSA SecurID Access to be convenient for end users and admin, intelligent to provide powerful authentication and analysis and pervasive, supporting access across a variety of traditional and cloud use cases.
Simplifying the Multi Factor Authentication (MFA) Experience for users of RADIUS-based applications
The July release contains multiple improvements to RADIUS support:
- Eliminating double password prompts: If the RADIUS client (e.g., a VPN) is configured to perform primary (password) authentication, RSA SecurID Access no longer requires the user to enter their password a second (redundant) time. Note that this can also help customers align with the latest PCI guidance for VPN logins. That’s because, under this configuration, RSA SecurID Access prompts for password and MFA in a single screen as PCI DSS 3.2 recommends, and doesn’t act on a second authentication factor sequentially, based on outcome of the primary authentication.
You can find a video highlighting how this works on RSA Link at: https://community.rsa.com/videos/33333
- Eliminating extra steps for push-based MFA: When configured, the extra step of selecting an authentication method at each login is no longer required. After entering User ID and password, a push notification is sent automatically. Note: this Auto-Push capability is not enabled when other forms of authentication are enabled for RADIUS access instead of passwords, for primary authentication .
Fig.1 Auto-push eliminates extra authentication steps
Improved Control and Security of Cloud Authentication Service user status
Over the last few months, we have significantly improved the ability of customer administrators to manage the status of the cloud authentication service users.
Past releases have included the ability to manually enable and disable Cloud Authentication Service users, independent of identity source status, and disable Cloud Authentication Service users when they become disabled in the identity source directory. We have also added a two-step delete process, to help administrators reverse deletion errors. Using the two-step deletion, manually deleted users are marked as Pending Deletion, and an automated purge process permanently removes them after seven days. This gives the administrator the ability to “Un-delete” before the users are permanently purged.
This month, we’ve added a couple key new capabilities to help organizations address the risks associated with orphaned accounts:
- Disable missing users: if the sync process cannot find a user in the Identity Source (out of scope or deleted), that user will be disabled in the Cloud Authentication Service. This improves security: no one can use the Cloud Authentication Service unless they are enabled in the directory. It also supports license management by ensuring that only active Cloud Authentication Service users are enabled for license counting purposes.
- Delete long-disabled users: for improved efficiency, Cloud Authentication Service users who have been disabled for over 90 days, will be marked for deletion automatically. This feature is configurable – it can be turned off, or set to a different time threshold (30 to 180 days). In this way, users who are unlikely to use the Cloud Authentication Service in the near future, will not appear in lists or searches, making it easier to manage the Cloud Authentication Service tenant. It also improves the efficiency of synchronizations.
Fig.2 Configurable auto-delete
Improving visibility: Administrator activity logs
RSA is providing a new log which records the activity of RSA SecurID Access administrators. Examples of this type of activity are (list not exhaustive): unlocking a user, changing an authentication policy, adding a new Identity Source.
Customers can leverage the Log Events API which is a REST-based web services interface that allows audit log events to be retrieved from the Cloud Authentication Service. You can use this REST API to import the audit log events into your security information and event management (SIEM) solution, such as RSA NetWitness.
In this way, RSA provides customers with improved visibility into the activities of these privileged users for forensic security, governance auditing and troubleshooting purposes.
Additional Improvements
A number of miscellaneous security and troubleshooting enhancements were added:
- Support of HTTPS Strict Transport Security (HSTS) forces use of HTTPS secure protocol as server-browser interface for SSO web portal and the Cloud Administration Console. This helps protect transactions and login requests against threats such as protocol downgrade attacks and cookie hijacking.
- Improved visibility of NTP status to aid in troubleshooting
- Improved support for proxy server configurations when downloading adapter updates and IDR package updates.
- Enhanced diagnostics for IDR registration errors
For further details on these improvements, please refer to the Release Notes here:
https://community.rsa.com/docs/DOC-60102
and product documentation here:
https://community.rsa.com/community/products/securid/securid-access
All of these enhancements make RSA SecurID Access an even more convenient and secure solution for your authentication needs.
