Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/22/2008
08:32 AM
50%
50%

Life Insurer Takes New Approach to Two-Factor Authentication

Cryptocard technology helps Kansas City Life get the handle on a thorny access problem

Kansas City Life Insurance Co. needed a two-factor authentication solution for its employees, and it found one. Unfortunately, though, it wasn't the last time the company found itself looking for authentication technology.

Founded in 1895, Kansas City Life Insurance sells individual life, annuity, and group insurance policies. The bulk of the company’s 500-person staff works at the company's Kansas City headquarters, while a smattering of employees are stationed in various regional offices servicing more than 1,400 agents which serve its 500,000 customers.

As the Internet boom hit its peak at the turn of the millennium, the life insurance provider decided to move away from its old proprietary environment to an open, enterprise-class IP network. For security purposes, the firm needed to limit access to its network, restricting the bulk of its employees to local email and company intranet connections.

The tricky part was how to provide secure remote connections. “We knew that by going to IP we were opening up our network to the whole world, so there was a lot of risk involved in the change,” said Keith Beatty, systems engineer at Kansas City Life Insurance.

To ensure remote access security, the company deployed a virtual private network from F5. And to make doubly sure of the remote connections, the insurance firm also purchased a second factor of authentication: smart cards from RSA, now a division of EMC. The cards were bought in the summer of 2003 and easily integrated with the VPN, adding an extra level of protection for the enterprise network.

But the happy tale slowly turned sour. Gradually, the cards began to expire and needed to be replaced. “We could not simply replace the batteries, because the cards were sealed,” Beatty explained. “It seemed silly to buy a new one when the ones we had were still functional.”

Another problem was pricing granularity in the RSA product line. Kansas City Life Insurance found that each time it deployed a new technology that touched the smart cards -- such as Microsoft’s Active Directory -- it was forced to pay RSA another licensing fee. “We felt the company was nickel and diming us,” stated Beatty.

Then there was the problem of the Apple Macintoshes, which were becoming increasingly popular with some individuals in the insurance company's marketing department. The RSA SecurID system did not mesh well with the Macs.

With many of the cards set to expire, Kansas City Life decided to examine its options in the spring of 2007. The evaluation quickly evolved into a battle between RSA and Cryptocard. The latter’s purchase price of $3,300 was slightly higher than RSA’s alternative. But Cryptocard’s products were Apple friendly, the cards never have to be replaced, and its licensing policy is all-inclusive.

The insurance firm weighed a number of factors in its decision. For one thing, Cryptocard’s CryptoShield lets IT departments customize each card security setting, such as password characteristics. One of the company's employees had used the CryptosShield products in a previous job without any problems.

RSA, on the other hand, had the better management system. Its management tools are richer, offer more reporting features, and run more efficiently than those from Cryptocard. In the end, however, Cryptocard won the evaluation and RSA lost its Kansas City Life Insurance’s business.

After tinkering with Cryptocard evaluation unit for a few weeks, the insurance company swapped out its smart card authentication system in the summer of 2007. Minimal user training was required, because the RSA system continually generates a password, while Cryptocard only does so on demand. The deployment took a few weeks.

Having now gone through two deployments, Kansas City Life Insurance's IT staff now feels that it now has a system that will last, and that will meet its long-term security needs as well as its near-term requirements.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • CryptoCard Inc.
  • F5 Networks Inc. (Nasdaq: FFIV)
  • RSA Security Inc. (Nasdaq: EMC)

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Data Privacy Protections for the Most Vulnerable -- Children
    Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
    Sodinokibi Ransomware: Where Attackers' Money Goes
    Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    7 Threats & Disruptive Forces Changing the Face of Cybersecurity
    This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
    Flash Poll
    2019 Online Malware and Threats
    2019 Online Malware and Threats
    As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-18214
    PUBLISHED: 2019-10-19
    The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
    CVE-2019-18202
    PUBLISHED: 2019-10-19
    Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
    CVE-2019-18209
    PUBLISHED: 2019-10-19
    templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
    CVE-2019-18198
    PUBLISHED: 2019-10-18
    In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
    CVE-2019-18197
    PUBLISHED: 2019-10-18
    In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...