RSA SecurID Authentication Manager

The Power Behind RSA Two-Factor Authentication:

As the need for positive user identification and protection of valuable corporate information has increased, so has the need for an authentication solution that is a strategic, mission-critical component of an organization’s network security infrastructure. RSA® Authentication Manager, the premier enterprise-class authentication solution and the power behind the RSA SecurID® product, provides this mission-critical component by scaling to support millions of users and protecting multiple applications and resources across numerous physical sites.

• Powers strong authentication for millions of RSA SecurID® end-users worldwide
• Supports millions of users and hundreds of simultaneous authentications
• Offers high performance and scalability with database replication
• Provides centralized, easy and cost-effective administration
• Delivers robust logging and reporting capability
• Interoperates with more than 300 networking products and applications out of the box

RSA Authentication Manager software is the management component of the RSA SecurID solution. It is used to verify authentication requests and centrally administer authentication policies for enterprise networks. RSA Authentication Manager software is also interoperable with more network, remote access, VPN, Internet, wireless and application solutions than any other system available today.

Features such as database replication and load balancing, automated LDAP import and synchronization, web-based QuickAdmin and high-availability platform support make RSA Authentication Manager the ideal solution for any size network that requires a robust authentication server.

Solving Key Business Challenges:

RSA Authentication Manager 7.1 challenges the concept of what authentication can do for your organization.

It enables new business models, protects the organization against the unexpected and improves performance and scalability to achieve a return on investment. A few examples:

Enabling New Business Models
Organizations are looking for ways to do more and achieve more with their IT infrastructure. On the one hand, business drivers place importance on increasing revenue, lowering costs, ensuring compliance and creating a competitive advantage for the business. This often means extending out critical applications to partners, vendors, suppliers and customers to access. On the other hand, placing sensitive company applications and data into the hands of these users can also introduces other potential challenges, such as how do you know the users on the remote end are who they say they are? There needs to be a cost effective way to assure the identities without placing too much of a burden on these users.

• How Authentication Manager 7.1 accomplishes this: The On-demand Authenticator provides a zero-footprint form factor that delivers a One Time Password (OTP) via Short Message Service (SMS) or e-mail. This means there is no token to manage at the end point which eases administration, and it offers convenient delivery options to commonly accepted methods like the cell phones or e-mail. The On-demand Authenticator provides a zero-footprint form factor that delivers a One Time Password (OTP) via Short Message Service (SMS) or e-mail. This means there is no token to manage at the end point which eases administration, and it offers convenient delivery options to commonly accepted methods like the cell phones or e-mail.

Assuring User Identities During a Business Disruption
Maintaining a consistent strong authentication policy during all types of business outages is a goal for many organizations. But when disaster strikes and some users find themselves without an authentication method, very often it's the security policy that suffers. This is because when a business disruption occurs, many organizations lower security policies to give remote users access without enforcing strong authentication. This can open up the organization to fraud and unintended use. But is there an authentication method that allows for scalability and flexibility to rapidly on-board users during a company shutdown? And one that supports users who have not already been issued an authentication method?

• How Authentication Manager 7.1 accomplished this: A new Business Continuity Option (BCO) license enables flexible deployment scenarios for large numbers of tokenless users. During a business disruption, a BCO can be activated, temporarily "unlocking" a number of On-demand Authenticators. Users who are deployed to work remotely during such an emergency can authenticate using commonly accepted devices such as cell phones and e-mail. No physical authenticators are deployed and no lowering of the security policy is required.

Developing a Return on Your Investment
It's not very often that a set of management tools can be a compelling reason to select a security application, but Authentication Manager 7.1 delivers the right interface and applications that make it easier to administer and create more streamlined deployments versus competitive solutions. Given the time and cost savings, compelling ROI scenarios can be generated. For example, would your organization benefit from having a self-service interface where end users could manage their own tokens?

• How Authentication Manager 7.1 accomplishes this: The included RSA Credential Manager provides a 24/7 self service console for users to manage all aspects of their token lifecycles. For example, a user can perform a PIN reset, report a lost token, activate a token, gain emergency access and more, all from an easy-to-use web interface. This can dramatically reduce the number of calls and trouble tickets into the IT generated for token-related events.

What's New in RSA Authentication Manager 7.1:

The enhancements to Authentication Manager 7.1 are aligned around three core areas:

• Extended Authentication Methods
  Additional methods of authentication provide flexible work applications and speed deployments of credentials to users.
• Business Continuity Options
  Protects user identities in the event of a business disruption.
• Enhanced Operational Efficiencies
  A suite of tools that increase operational efficiencies, streamline deployments and lower overall on-going management costs.

Extended Authentication Methods
Along with support for the traditional hardware, software and partner authenticators, RSA Authentication Manager 7.1 introduces an end-user authenticator that creates opportunities for flexible deployments and lowers management costs.

• On-demand Authenticator
  The On-demand authenticator delivers tokencodes to users via Short Message Service (SMS) or e-mail, and requires no physical token to be assigned or software to be installed on a laptop of smart phone. On-Demand authenticators do not have expiration dates.
• Built-in management support for global messaging vendor Clickatell
  To send out large numbers of SMS messages to users, a relationship with an SMS aggregator must be established so messages can be routed to a carrier gateway. RSA has built in to the management console and interface to use with Clickatell, a worldwide mobile messaging company with access to over 600 networks in almost 200 countries.
• Dynamic Seed Provisioning
  Cryptographic Token Key Initiation Protocol is a client-server protocol that enables more rapid deployment of software tokens. Using CT-KIP, both the client and the server can generate a unique identifier - a seed file - that can then be used to authenticate the user to the server. No seed file needs to be sent over the network to the remote user.

Business Continuity Options
A Business Continuity Option makes even easier to leverage SecurID® into organizational planning for an unanticipated business disruptions.

• Business Continuity Option License
  A Business Continuity Option (BCO) allows a customer to temporarily expand a server license for a period of time to meet the in-flux or large numbers of remote access users, such during a business disruption when everyone must work from home. A BCO license term is 3 years. Once purchased and added to the license page, the feature can be self initiated for up to six times during the license term. Each initiation is good for 60 days.
  
  The Business Continuity Option expands the server license and makes available a pre-defined number of On-demand authenticators to be used to support mobile employees. Example, a customer purchases a 1,000 seat BCO license. Deployment is done on the fly with the Self Service module found in Credential Manager so users can on-board without overwhelming the IT help desk with requests.

Enhanced Operational Efficiencies
RSA Authentication Manager 7.1 includes a suite of requested features that make the solution easier to manage, lowers total cost of ownership and leverages existing IT resources.

• Native LDAP Support
  Authentication Manager delivers true native LDAP support for direct integration with Sun One and Microsoft Active Directory. No synchronization. Multiple identity sources can serve as the data stores.
• Web-Based Management
  The administration interface is browser-based and is zero-footprint, meaning no client software is required to be installed on the admin PCs. RSA Authentication Manager 7.1 can be remotely administered from any PC with a browser and Internet connection.
• Delegated Multi-Level Administration
  Multi-level delegated administration enables granular administrative access control down to a user/group & policy level. This maximizes administration resource investment and delivers increased security as it ensures that fewer individuals hold the "keys to the kingdom."
• Clustering of Servers
  Clustering enables the grouping of server nodes together to appear as one. This is an easy, inexpensive way to increase scalability and performance. It also increases resiliency by providing additional fail-over ensuring maximum up-time. Available on Enterprise Server License Only.
• Microsoft Management Console (MMC) Plug-in
  For customers already using MMC as their primary management utility, this plug-in provides consistency and added ease of use. Through MMC, admins can perform a variety of basic user and token management, such as assigning or disabling a token to a user or performing a PIN rest.
• RADIUS Server
  The included RADIUS server lowers costs over having to implement a third-party solution and is fully embedded into the management console so setup and on-going management is made easy.
• RSA Credential Manager
  The replacement to RSA Deployment Manager (Web Express), RSA Credential Manager is tightly coupled with the management interface of RSA Authentication Manager, requires no separate install, and delivers a range of functionality, including: Self Service - A configurable Self Service console is available for end users to request a variety of services, including issuing On-demand tokencodes for emergency access. Workflow Provisioning - Admins can create processes by which requestors are approved and credentials are issued.

Features and Benefits:

High Performance and Availability - RSA® Authentication Manager software is built upon an enterprise-class, multiprocessor architecture capable of handling millions of users and up to hundreds of simultaneous authentications. RSA Authentication Manager software is deployed in more than 21,000 authentication installations worldwide in banking, government, manufacturing, high technology, healthcare and more.

Configuration Flexibility - Designed to match the requirements of customers of all sizes, RSA Authentication Manager is available in two versions, Base Edition and Enterprise Edition. The Base Edition provides for a master server and one replica to ensure maximum availability. The Enterprise Edition supports up to ten replicas in each of up to six realms, offering increased performance and high system availability that lets organizations plan efficient, economical, global network topologies.

Database Replication and Load Balancing - The database replication feature of RSA Authentication Manager enables flexible network configuration, load balancing and, ultimately, higher performance and simplified, lower-cost management.

With database replication, security administrators are able to increase performance by configuring multiple replicas and distributing authentication requests across multiple servers. Authentication requests are routed to the fastest-performing server, resulting in more efficient performance.

RSA® Authentication Agent software provides automatic load balancing by detecting replica server response times and routing authentication requests accordingly. In addition, organizations can define their own load-balancing sequence by defining a pick list in the RSA Authentication Manager configuration file. RADIUS users can do the same using RADIUS hunt groups.

The primary/replica configuration of RSA Authentication Manager software enables users to authenticate to multiple servers.

Centralized, Easy Administration and System Management - RSA Authentication Manager software offers a high level of management flexibility and control. Using RSA Authentication Manager administration and reporting tools, administrators can track user authentication to their network anywhere in the world in real time; update security policy simultaneously across the worldwide network; and develop a global network toplogy that increases network performance.

RSA Authentication Manager software provides management directly from the server console and remotely from a Windows® interface or from a web browser, delivering centralized administration of tokens, users, and servers across your network.

Native LDAP support and QuickAdmin, a web-based help desk utility, make the security administrator’s job easier. LDAP support enables the RSA Authentication Manager software to take advantage of the user and group information in the directory. Automated LDAP to RSA Authentication Manager import and synchronization utilities let administrators bring the data from the directory into the RSA Authentication Manager program and keep the data synchronized. RSA Authentication Manager software supports leading directories such as Microsoft® Active Directory®, Sun® ONE LDAP Directory, and Novell® eDirectoryTM.

QuickAdmin allows the security administrator to modify user and token information without installing an admin client on every desktop. RSA Authentication Manager help desk administrators can use this web interface tool to handle 80% of RSA SecurID calls, usually such as "I forgot my PIN", "I lost my token." QuickAdmin provides a simple, web-based interface to deal with these calls. Administrative scoping allows companies to specify the users that an administrator can view and manage.

The RSA Authentication Manager Enterprise Edition also includes RSA SecurID® Authentication Deployment Manager, an automated token deployment tool that significantly reduces the time and cost to deploy the solution. RSA Authentication Deployment Manager also provides user self-service functionality.

Improved Uptime and Reduced Risk - To support mission-critical sites, RSA Authentication Manager Enterprise Edition software is certified to run on the VERITASTM Cluster Server High Availability platform on Sun® SolarisTM machines. Support for up to ten replicas with the RSA Authentication Manager Enterprise Edition provides additional disaster recovery and fail-over options.

RSA Authentication Manager administration tools make it easy to promote any replica to the status of primary server, thereby quickly and flexibly restoring administrative capability in the case of a system failure.

Compatible with Leading Standards - RSA Authentication Manager software includes an 802.1x-compliant RADIUS server, powered by Funk Steel Belted Radius. The RSA Radius server supports PAP and EAP authentication protocols including POTP, TTLS, PEAP, and EAP15. RSA Authentication Manager software and RSA SecurID Authenticators also support the Advanced Encryption Standard (AES).

Audit and Reporting - Because RSA Authentication Manager software logs all transactions and user activity, administrators can utilize it as an auditing and accounting tool. It includes report templates that can be easily tailored to administrative needs, including activity, exception, incident and usage summaries. For auditing purposes, administrators can define which server events to capture, saving them the time of going through data that they don’t need to review.

Security Features - RSA Authentication Manager software utilizes RSA Security's encryption expertise and technology to provide a strong solution. All key aspects are encrypted, including user PIN, agent and server communications, server database, remote administration and QuickAdmin sessions.

The system also features evasion of attack logic that automatically detects attempted intrusions or use of stolen tokens. This prevents unwelcome network attacks by tracking user authentication between replicated servers and blocks redundant requests in order to prevent replay attacks against servers or agents.

Application Program Interfaces - An administrator toolkit enables RSA Authentication Manager integration into custom applications through C and Tcl routines. API’s enable administrators to extract information from the server logs for reporting and auditing, and a multi-threaded agent API lets administrators build custom RSA® Authentication Agent software.

Turnkey Interoperability - RSA Authentication Manager software is instantly interoperable with more than 300 of the major network infrastructure products on the market, providing your organization with maximum flexibility and investment protection. Through the RSA Secured strategic partner program, leading vendors of remote access products, VPN’s, firewalls, wireless devices and applications have built RSA Authentication Manager compatibility into their products.

RSA® Authentication Manager 6.1 (with Patch 2) Features:

• Powers strong authentication for more than 15 million RSA SecurID® end-users worldwide
• Supports millions of users and hundreds of simultaneous authentications
• Offers high performance and scalability with database replication
• Provides centralized, easy and cost-effective administration
• Interoperates with more than 290 networking products and applications out of the box
• Provides strong authentication for Microsoft® Windows users, both online and offline

System Requirements:

 

Supported Platforms:

RSA Authentication Manager Overview

RSA Authentication Manager 7.1

RSA Authentication Manager
 

* Qualification based on Red Hat Enterprise Linux 4.0 ES/AS Update 7

RSA Authentication Manager 6.1

Authentication Manager Server
 

*Requires RSA Authentication Manager 6.1.1 or later
**Requires RSA Authentication Manager 6.1.2 or later
***RSA Authentication Manager 6.1 was qualified on Red Hat Linux 4.7 ES/AS operating systems

RSA Authentication Manager Remote Admin
 

RSA Authentication Manager QuickAdmin
 

 

Licensing Options for RSA Authentication Manager:

Licensing Options At-a-Glance
 

 

Documentation:

Download the RSA Authentication Manager Datasheet (PDF).