Canadian Police Force Uses Two-Factor Authentication Solution For Added Network Security
- By Chen Arbel
- Apr 17, 2009
Regulatory compliance is one of the driving forces behind many security integration decisions, forcing companies to consider solutions otherwise deemed unnecessary. Often, this results in organizations choosing the most basic product that meets the requirements with the least impact on processes and technology infrastructure. However, some organizations are choosing to integrate security technology that does more than merely comply with regulations -- leading to enhanced business processes, cost cutting and increased efficiency.
York Regional Police made the decision to use the Canadian Police Information Centre requirement for two-factor authentication as a springboard for launching a complete security umbrella centered on strong authentication. Serving nearly 1 million citizens just north of Toronto, Ontario, YRP has deployed 2,000 Aladdin eToken USB-based smart card devices to its officers and civilian employees, enabling them to access any YRP computer and update the CPIC database. Officers simply plug the eToken into a USB port, enter their password and are able to access information critical to public safety.
“Various other agencies have gone about meeting the mandate in other ways, only using two-factor authentication to access the CPIC system,” said Nick Mohamed, assistant manager of IT at York Regional Police. “The instigator for this project was the CPIC mandate, but we saw this as an opportunity to protect the computer at the desktop level since it’s not only the CPIC that we need to protect, all the information is on the desktop as well.”
When choosing a two-factor authentication solution, YRP wanted a solid, reliable solution so that there was never a chance of employees being locked out of the system and unable to access information. “If employees couldn’t access the system that would be catastrophic,” Mohammed said. The YRP team spent six months conducting rigorous testing of different authentication solutions to find the one that would easily integrate into the existing system, including non-Windows-based computers, comply with CPIC regulations, as well as offer additional deployment options for remote and temporary users.
The Aladdin eToken suite of authentication devices offered YRP the flexibility to choose from smart card-based USB tokens that enable robust PKI authentication, to simple one-time-password tokens, all of which are easily managed using the Aladdin Token Management System. TMS is a central and fully configurable management platform that allows YRP to centrally control all authentication devices. It also provides full lifecycle management including deployment, provisioning and ongoing maintenance, as well as support for officers who loose their eToken devices.
Since beginning the project in 2007, YRP has integrated eToken into every facet of its security infrastructure. Each employee at YRP has an eToken device which is used to access their YRP computer from the initial login so that every action is protected and verified. “Two-factor authentication is one of the pillars of our security system,” Mohamed said. “It is the most critical component, providing added security to protect data.”
Officers arrive at work, plug in their eToken and, instead of using Windows Login, they use the Aladdin login to access their computer and the network. When anyone removes their token, the computer goes into automatic logout.
“You come to work with your coffee, your eToken and your gun,” Mohamed said. “You can’t forget any of those at home.”
YRP has implemented several layers of two-factor authentication security so that along with employees in the office required to use tokens, remote and temporary users have their own means of securely accessing the system. Remote employees use eToken to unlock their laptops and VPN for access to network applications, including e-mail. External partners who need to access to YRP’s network are able to use eToken PASS one-time-password tokens to login.
eToken has provided YRP not only the means to comply with the federal mandate, but also enhance the security of its own operations. Because employees are required to use eToken to login to the system, they are not able to share usernames and passwords, ensuring that only validated individuals are accessing each account. Using TMS, Mohammed and his team are able to monitor user activity to verify that all employees are correctly using eToken, and make sure that all users are in compliance with the CPIC mandate.
“We use TMS to view user activities and correlate that with other auditing tools,” Mohammed said. “We knew there was a possibility that people were sharing passwords, but once we moved to eToken they couldn’t do that anymore. Now they need the physical token to access the network.”
For Mohammed, the main benefit of using two-factor authentication is the added security it brings to the network and data, ensuring that critical information stays securely out of the hands of cybercriminals and unauthorized persons. While some view police organizations to be conservative and late adopters of new technology, Mohammed has found YRP to be progressively searching for new ways to do a better job of protecting its citizens. As a public service organization, YRP prides itself on not only enforcing the physical security of the community, but the security and privacy of citizens’ information.
“There is a certain level of satisfaction to knowing that we are policing a more secure environment,” Mohamed said. “We are entrusted with the protection of public data and we take that seriously. YRP is really looking to technology to help us move forward and do the job. We are actively pursuing using technology to fight the world of crime.”