Canadian Police Force Uses Two-Factor Authentication Solution For Added Network Security

Regulatory compliance is one of the driving forces behind many security integration decisions, forcing companies to consider solutions otherwise deemed unnecessary. Often, this results in organizations choosing the most basic product that meets the requirements with the least impact on processes and technology infrastructure. However, some organizations are choosing to integrate security technology that does more than merely comply with regulations -- leading to enhanced business processes, cost cutting and increased efficiency.

York Regional Police made the decision to use the Canadian Police Information Centre requirement for two-factor authentication as a springboard for launching a complete security umbrella centered on strong authentication. Serving nearly 1 million citizens just north of Toronto, Ontario, YRP has deployed 2,000 Aladdin eToken USB-based smart card devices to its officers and civilian employees, enabling them to access any YRP computer and update the CPIC database. Officers simply plug the eToken into a USB port, enter their password and are able to access information critical to public safety.

“Various other agencies have gone about meeting the mandate in other ways, only using two-factor authentication to access the CPIC system,” said Nick Mohamed, assistant manager of IT at York Regional Police. “The instigator for this project was the CPIC mandate, but we saw this as an opportunity to protect the computer at the desktop level since it’s not only the CPIC that we need to protect, all the information is on the desktop as well.”

When choosing a two-factor authentication solution, YRP wanted a solid, reliable solution so that there was never a chance of employees being locked out of the system and unable to access information. “If employees couldn’t access the system that would be catastrophic,” Mohammed said. The YRP team spent six months conducting rigorous testing of different authentication solutions to find the one that would easily integrate into the existing system, including non-Windows-based computers, comply with CPIC regulations, as well as offer additional deployment options for remote and temporary users.

The Aladdin eToken suite of authentication devices offered YRP the flexibility to choose from smart card-based USB tokens that enable robust PKI authentication, to simple one-time-password tokens, all of which are easily managed using the Aladdin Token Management System. TMS is a central and fully configurable management platform that allows YRP to centrally control all authentication devices. It also provides full lifecycle management including deployment, provisioning and ongoing maintenance, as well as support for officers who loose their eToken devices.

Since beginning the project in 2007, YRP has integrated eToken into every facet of its security infrastructure. Each employee at YRP has an eToken device which is used to access their YRP computer from the initial login so that every action is protected and verified. “Two-factor authentication is one of the pillars of our security system,” Mohamed said. “It is the most critical component, providing added security to protect data.”

Officers arrive at work, plug in their eToken and, instead of using Windows Login, they use the Aladdin login to access their computer and the network. When anyone removes their token, the computer goes into automatic logout.

“You come to work with your coffee, your eToken and your gun,” Mohamed said. “You can’t forget any of those at home.”

YRP has implemented several layers of two-factor authentication security so that along with employees in the office required to use tokens, remote and temporary users have their own means of securely accessing the system. Remote employees use eToken to unlock their laptops and VPN for access to network applications, including e-mail. External partners who need to access to YRP’s network are able to use eToken PASS one-time-password tokens to login.

eToken has provided YRP not only the means to comply with the federal mandate, but also enhance the security of its own operations. Because employees are required to use eToken to login to the system, they are not able to share usernames and passwords, ensuring that only validated individuals are accessing each account. Using TMS, Mohammed and his team are able to monitor user activity to verify that all employees are correctly using eToken, and make sure that all users are in compliance with the CPIC mandate.

“We use TMS to view user activities and correlate that with other auditing tools,” Mohammed said. “We knew there was a possibility that people were sharing passwords, but once we moved to eToken they couldn’t do that anymore. Now they need the physical token to access the network.”

For Mohammed, the main benefit of using two-factor authentication is the added security it brings to the network and data, ensuring that critical information stays securely out of the hands of cybercriminals and unauthorized persons. While some view police organizations to be conservative and late adopters of new technology, Mohammed has found YRP to be progressively searching for new ways to do a better job of protecting its citizens. As a public service organization, YRP prides itself on not only enforcing the physical security of the community, but the security and privacy of citizens’ information.

“There is a certain level of satisfaction to knowing that we are policing a more secure environment,” Mohamed said. “We are entrusted with the protection of public data and we take that seriously. YRP is really looking to technology to help us move forward and do the job. We are actively pursuing using technology to fight the world of crime.”

Featured

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.