CHANTILLY, Va.-Employees at Justice FCU here used to suffer from authentication angst - they had to remember about 20 different passwords, each 15 characters long, to log in to various credit union systems and applications, according to Rifat Ikram, VP-electronic delivery and support services at Justice.
"It was an entirely unrealistic approach," he said. "People ended up writing down the passwords and keep them in their desk drawers, which killed the security purpose."
Today, the 140 Justice employees need only their fingertips to log in; the $342-million CU replaced the "anxiety" of remembering and resetting passwords with the "ease and security" of single sign-on and access management tools, including biometric fingerpad readers, Ikram said.
"Every time IT implements a solution, we get negative feedback, but this is one project that employees are really happy about," he added. "Once the employee swipes their finger and is authenticated, they can just click-through to any authorized system - which is just beautiful. This technology makes the end-user's life so simple - they can really focus on providing good member service without the anxiety of forgetting their passwords."
The OneSign single sign-on and access management solution, deployed at Justice and at more than 30 other CUs, is provided by Lexington, Mass.-based Imprivata. OneSign grants the employee access to multiple systems using just one of any number of authentication options, including pre-existing biometric tools or a single password.
Verity CU in Seattle opted to authenticate its 115 employees using OneSign's single-password approach, said Jon Wu, system engineer at the $300-million CU. In doing so, Verity eliminated about 15 different, 12-character passwords per employee.
"Employees log in to Imprivata with a password, and after that, all their passwords for each application are automatically populated," Wu said. "We're seeing a $7,500 annual savings on password resets. And if you factor in the time spent remembering passwords and logging in to separate applications, as well as waiting times for members, you can't put a price on it."
Ikram agreed: "within a year, at a credit union our size, you can recover your cost just in the number of times an application was not available because a user forgot their password."
To add another layer of security, OneSign is integrated with the building security system at Justice, Ikram said. That prevents anyone from attempting to log in to an employee's applications if the employee is not in the building.
Even though each Verity employee now only needs to remember a single enterprise password, sometimes even one password is too much to remember, said Wu. In those cases, OneSign's self-service channel allows employees to reset their own enterprise password, after completing a challenge-response authentication.
OneSign, which both Verity and Justice started using about one year ago, can also automatically change all of a user's passwords every 90 days, according to the CU's password policies, Ikram said.
Security is heightened because OneSign encrypts all passwords, said Wu. "Before Imprivata, some of the applications required users to enter passwords in clear text. The applications just didn't have security in mind. Imprivata took a huge rock off of our back."
Log-in data is securely communicated to the OneSign server using the 128-bit Advanced Encryption Standard (AES), plus Elliptic Curve Cryptography (ECC), said David Ting, Imprivata CTO.
Verity installed OneSign for seven major applications in less than three days, Wu continued. "Deployment was amazingly fast. Our employees are telling us this is the best product implemented by the IT department in the past five years."
MORE@CUJOURNAL.COM
Read more about employee authentication at cujournal.com and type the following headlines into the search function:
City CU Adds Biometric Fingerprint System For Building Access
GEICO FCU Adds Biometric On-Site Security
When Data Destruction Is Good
For info on this story:
www.jfcu.org
www.veritycu.com
www.imprivata.com
