Friday, 1 December 2006

RSA Access Control Aims at Protection for Web Portals

RSA, the security division of EMC has stated that the integration of RSA Access Manager software and RSA Adaptive Authentication is enabling two financial institutions to help cost-effectively protect end users and assets within consumer-facing Web portals. RSA Access Manager software is designed to enable each financial institution to leverage policy-driven access controls to provide users with single sign on across authorised services offered within the portal. In addition, the risk-based authentication module of RSA Adaptive Authentication is engineered to help customers assure the identities of portal users, and assess risk during their session, the company said in a statement.

"As Web portals containing protected data are rolled out to large user populations, authenticating users and controlling access becomes a core business requirement," said Ray Wagner, managing vice president at Gartner. "These types of deployments often have a spectrum of authentication requirements for different populations and applications. Deployers are thus interested in integrated solutions that can offer the type of authentication that makes sense in each case."

According to the company, the integrated RSA Access Manager and RSA Adaptive Authentication solution provides the following:

• For consumers accessing the organisation's portal, RSA Adaptive Authentication leverages a range of parameters behind the scenes including device and network forensics, behavioral analysis and the end user's computer itself as a second authentication factor to ascertain positive identification.
• Still behind the scenes, RSA Adaptive Authentication quickly and transparently scores transactions according to the perceived level of risk and automatically invokes additional security measures if needed, all with minimal impact to the customer.
• Once the identity of the user is verified, access to the Web portal is granted. Here, inside the portal, RSA Access Manager enables customers to ensure that users are only able to access their information, and only able to execute authorised transactions based on their permissions and profile in the system.