Self-service Password Reset

PistolStar, Inc. dba PortalGuard PO Box 1226 Amherst, NH 03031 USA

Phone: 603.547.1200 Fax: 617.674.2727 E-mail: [email protected] Website: www.portalguard.com

© 2012, PistolStar, Inc. dba PortalGuard All Rights Reserved.

Centralized Self-service Password Reset:

From the Web and Windows Desktop

v.3.2-007

Self-service Password Reset Layer

© 2012, PistolStar, Inc. dba PortalGuard All rights reserved. Page 1

Tech Brief — Centralized Self-service Password Reset

PortalGuard Centralized Self-service Password Reset: From the Web and Windows Desktop

Table of Contents

Summary ................................................................................................. 2

The Basics ............................................................................................... 2

PortalGuard Centralized Self-service Password Reset ............................ 2

Features .................................................................................................. 3

Benefits ................................................................................................... 4

How it Works ........................................................................................... 4 Enrollment .................................................................................... 4 Self-service Password Reset ....................................................... 7

Configuration ........................................................................................... 9

Deployment ........................................................................................... 10

IIS Install ................................................................................................ 11

System Requirements ........................................................................... 11

Supporting Videos ................................................................................. 12

Platform Layers ..................................................................................... 12



Summary For companies of all sizes, the task of supporting users can prove to be taxing on the IT staff, especially the Help Desk and Administrators. Most studies show the cost of pass-word resets can range from $25 to $75 per incident and make up around 30 percent or more of Help Desk calls. This provides ample reason and demand for password reset and recovery tools which empower the user. By allowing users to self-service their own ac-count and password management needs, organizations can effectively offer 24/7 access and maintain productivity. Shopping for a tool such as this can be challenging, so the first step is to understand your requirements by documenting your user access scenarios. For example, how will roaming users change their password remotely or how will a forgotten password be recovered on a laptop with an encrypted hard drive. Along with these requirements determining your budget and current Help Desk costs without a solution in place will allow you to forecast your ROI and further narrow down the vendor selection. Another point to consider is the evolution of self-service password reset and whether the vendors you are evaluating are keeping pace. Many tools you’ll find are not compliant with most companies’ current security standards. The problem of forgotten passwords has been around since passwords were first used, but expanding access scenarios and ad-vanced attacks are requiring more advanced solutions. For example, entry point solutions are now expected to go beyond simple password resets to accept multiple scenarios which may include disconnected users, auditing and leveraging devices such as mobile phones. Of course, true success of a self-service password management solution will be measured by the users’ satisfaction and an overall reduction in the frequency of their calls to the Help Desk for support.

The Basics Self-service password reset is the process a user initiates to prove their identity with the end goal of resetting their password. Self-service password recovery is similar, but the end goal is obtaining the current password value without changing it. The user can be authenti-cated using various methods. Most tools use challenge question and answer as an acceptable means of authenticating the user. However, associated security threats including easily guessed answers or infor-mation readily available on their Facebook page raise valid concerns. A secure solution puts additional precautions in place. For example, not allowing the same answer for each question, requiring a minimum answer length, and requiring a larger subset of questions (e.g. 3 out of 6) to be answered. For increased security, two-factor authentication can be added to the password reset and/or recovery to ensure only an authorized user is setting the password.

PortalGuard Centralized Self-service Password Reset PortalGuard’s self-service password reset is flexible and offers a complete solution which has evolved with industry demands. By providing the exact same interface for both Win-dows Desktop and Web-based self-service, the user’s learning curve is minimized and overall user adoption is increased.



The available self-service actions that PortalGuard offers are password reset, password recovery, and account unlock. These actions can also be performed from mobile devices such as iPads and smartphones. PortalGuard integrates seamlessly with Microsoft Active Directory, Novell eDirectory, any LDAP-compliant directories and custom SQL user reposi-tories. PortalGuard also supports users who are offline or disconnected from the network, allow-ing them to perform a password recovery. In this case, the password is divided into mathe-matically-represented “shares” with each share being AES-256 encrypted by a separate challenge answer. All shares are then bulk encrypted with AES-256 using a separate key and stored locally on the user’s machine. When the user attempts to recover their pass-word, they will be asked to prove their identity by correctly answering a certain number of challenge questions. Once decrypted, the user is shown the password in clear text allow-ing them to continue working. For security purposes, if a disconnected user strikes out while attempting to authenticate, the encrypted recovery information is deleted from the local machine, so the user will be forced to reconnect to the network to perform the recov-ery. To authenticate the user during an online self-service action, PortalGuard leverages chal-lenge questions and answers and/or two-factor authentication via a one-time password sent to a mobile phone or email address. Challenge answers are cryptographically hashed and stored on a central server to support roaming users and prevent the need to re-enroll on multiple machines. By providing auditing and reporting around user access, an Admin App for the mobile phone, and user verbal authentication through a Help Desk console, PortalGuard is a comprehensive self-service password reset solution.

Features

General: Provides password reset, recovery and account unlock

Disconnected user support - including lock-out threshold for increased security

Forced user enrollment (optional)

Integrates with Active Directory, Novell eDirectory, any LDAP-compliant directories and custom SQL user repositories

Encrypted hard drive support - perform a password recovery thru PortalGuard on an alternate or mobile device (e.g. Symantec Endpoint Encryption)

Supports multiple authentication methods - challenge questions and answers and two-factor authentication delivered via SMS or Email

Email notifications of password resets to both the user and/or admin

Lock-out thresholds for incorrect responses to authentication attempts

Includes support for mobile browsers

Challenge Questions & Answers: Centralized - challenge information stored on server

Configurable number of mandatory/optional questions

Allows import/pre-population of challenge answers

Prevent repeat answers for multiple challenge questions

Prevent answers from containing words from the question text

Answers can be case sensitive

Configurable minimum length for challenge answers

Administrative:



Help Desk Console - provide interface for Help Desk staff to easily perform account ac-tions

Verbal Authentication - allows Help Desk staff to authenticate a user calling in

Administrator Dashboard - logging and reporting of user access activity

Windows Desktop Support (shown below): Supports Windows versions XP, Vista, Windows 7, Microsoft Terminal Services and Re-

mote Desktop Services

Self-service directly from Ctrl+Alt+Del/Windows Logon screen - removes need to go to an alternate machine/kiosk or login with a guest account, maintained on each machine

Benefits

Increased Usability - users are now empowered to self-service their own needs and maintain productivity

Increased Security - provides two-factor authentication

Centralized Solution - same user interface for both the web and Windows desktop

No Kiosks - perform all self-service actions directly from the user’s machine

Reduced Costs - alleviate password-related Help Desk calls and demands on IT staff

Configurable - to the user, group or application levels

Seamless Integration - use “sidecar” mode to retrofit existing application login screens with the PortalGuard functionality, maintaining the current look and feel you have today

How It Works The following steps show the enrollment and process of resetting a password using Portal-Guard’s self-service functionality. The screenshots provided are showing the process be-ing completed from a web browser. A user can also complete the process from the Win-dows desktop using the same steps and identical interface.

Enrollment Once self-service password reset is made available, the user will be prompted to enroll their challenge questions and answers. PortalGuard provides flexibility around this process by allowing you to configure whether the enrollment will be forced or able to be postponed “x” number of times by the user. This increases the usability for users, giving them options around a process some may find obstructive. NOTE: If other authentication methods are enforced, such as two-factor authentication, then those enrollment actions will also be displayed, as configured by the admin.

Windows XP Desktop Support Windows 7 Desktop Support



Enrollment Process

NOTE: The screenshots below illustrate the use of PortalGuard’s “sidecar” functionality. It allows rapid integration of PortalGuard’s self-service features into existing websites or user processes. Step 1: The user attempts to login to a company’s existing portal as usual. Step 2: In this case, the user has not yet enrolled their challenge information so Portal-Guard automatically displays the enrollment screen in “sidecar” mode. This dialog shows that the administrator has configured the PortalGuard policy to allow the option of skipping enrollment temporarily. Doing so will close the PortalGuard dialog and continue the origi-nal login process. The user can enroll now by clicking “Continue”.



Step 3: The user is prompted to provide answers to the challenge questions. The number of both mandatory and optional questions the user is required to answer is configurable. PortalGuard also increases security by helping the user perform best practices when sup-plying answers, such as not repeating answers or avoiding using words which are included in the question text. Throughout the enrollment process the user is provided with helpful warning notices, such as the number of answers remaining, to ease the frustrations some may feel during this process. Step 4: The process is complete and the user is now enrolled. Clicking the link shown will close the PortalGuard dialog and continue the original login process.



Self-service Password Reset Process Step 1: The user attempts to login to a company’s existing portal but has forgotten their password. The user then clicks the “Forgot your password?” link.

Step 2: The user selects from “Recovery Actions Available” which self-service action they would like to perform. The user selects the “Reset Forgotten Password” radio button and clicks “Continue”. NOTE: The dialog shows the most common actions, an account unlock and password re-set, but password recovery is also available.



Step 3: The user is then prompted to provide their enrolled answers to the enrolled chal-lenge questions. PortalGuard provides users with helpful warning messages throughout this process. Once the user has supplied the required number of answers they click “Continue”.

Step 4: The user’s identity has been verified and they are able to set a new password. Added usability and security features such as the “Show Password” checkbox and virtual keyboard can be easily enabled or disabled.



Configuration NOTE: All the following settings are policy specific, so you can have different values for different users/group/hierarchies.

Configurable through the PortalGuard Configuration Utility:

Main

Self-service options available to users

Authentication types available for each self-service action

Authentication Types

Challenge Questions and Answers Enrollment - optional, required, disabled Recovery lockout limit Answer complexity including minimum length, case sensitivity, prevent

answer repetition and prevent question words as answers Number of optional questions Number of mandatory questions



Mobile Phone Enrollment - optional, required, disabled Phone number format Delivery format

Email Enrollment - optional, required, disabled Domain blacklist Email display Email format including From, Subject and Body fields

Notifications Type of self-service including account unlock, password reset and re-

covery

Deployment Implementation of the PortalGuard platform is seamless and requires no changes to Active Directory/LDAP schema. A server-side software installation is required on at least one IIS server on the network. Additional client-side software is required for performing self-service from the Windows logon screen.



IIS Installation A MSI is used to install PortalGuard on IIS 6 or 7.x. If installing PortalGuard on IIS 7.x/Windows Server 2008, make sure to have installed the following feature roles prior to launching the MSI: 1. All the Web Server Management Tools role services 2. All the Application Development role services 3. All IIS 6 Management Compatibility role services The MSI is a wizard-based install which will quickly guide you through the installation.

System Requirements This version of PortalGuard supports direct access and authentication to cloud/web-based applications, only. PortalGuard can be installed directly on the following web servers:

IBM WebSphere/WebSphere Portal v5.1 or higher

Microsoft IIS 6.0 or higher

Microsoft Windows SharePoint Services 3.0 or higher

Microsoft Office SharePoint Server 2007 or later The PortalGuard Web server also has the following requirements on Windows operating systems:

.NET 2.0 framework or later must be installed

(64-bit OS only) Microsoft Visual C++ 2005 SP1 Redistributable Package (x64) PortalGuard is fully supported for installation on virtual machines. Furthermore, Portal-Guard can currently be installed on the following platforms:

Microsoft Windows Server 2000

Microsoft Windows Server 2003 (32 or 64-bit)

Microsoft Windows Server 2008 (32 or 64-bit)

Microsoft Windows Server 2008 R2 NOTE: When run in "Sidecar" mode, PortalGuard can provide its functionality on any web server that uses a HTML login page. If you have a platform not listed here, please contact us at [email protected] to see if we have recently added support for your platform.



Supporting Videos

Please view the following videos to watch a demo of PortalGuard’s self-service offerings: Self-service Password Reset, Recovery & Account Unlock (Browser-based) Self-service Password Reset, Recovery & Account Unlock (Windows 7 Desktop) Disconnected Password Recovery Help Desk Console

Platform Layers Beyond self-service password reset, PortalGuard is a flexible authentication platform with multiple layers of available functionality to help you achieve your authentication goals:

Contextual Authentication

Tokenless Two-factor Authentication

Real-time Reports / Alerts

Knowledge-based

Password Management

Single Sign-on

###

http://www.portalguard.com/videos/PG_SelfService_2012.wmv

http://www.portalguard.com/pdfwrap/Win7_PG.htm

http://www.portalguard.com/videos/Offline_Video.wmv

http://www.portalguard.com/videos/Help_Desk_Video.wmv

Self-service Password Reset

Technology

Transcript of Self-service Password Reset