RSA Authentication Manager 7.1 Administrator's Guide - IT Services ...

RSA Authentication Manager 7.1 Administrator’s Guide
Tokens Configured to Not Require PINs
Authentication Manager supports authentication with tokens that are configured so
that they do not require a PIN. To authenticate, instead of entering the PIN followed
by the tokencode, the user enters only the tokencode displayed on the token.
Note: Tokens that do not require PINs are not as secure as tokens that require PINs.
RSA recommends that you configure all tokens to require a PIN.
Authenticating with just a tokencode is useful in situations such as:
• When a token is stored on a smart card and must be unlocked by the user with a
PIN
• When a software token is on a desktop and must be unlocked with a password
In these situations, the resource is protected by two-factor authentication without the
user having to enter two different PINs.
When assigning a token, you can configure both hardware and software tokens so that
they do not require PINs. For instructions, see the Security Console Help topic
“Authenticate without an RSA SecurID PIN.”
Distributing Hardware Tokens to Users
Because hardware tokens are physical devices, you must deliver them to users before
they can be used to authenticate.
If your organization has a single location, the fastest and most secure method is to
have users pick up tokens at a central location.
If your organization has multiple locations, consider having administrative personnel
at each site distribute the tokens. Alternatively, have your administrative staff travel to
different locations at pre-announced times. The advantages of this method are the
assurance that the hardware tokens are delivered to the right users and that they work
when users receive them.
Another distribution method is to mail tokens to users. Mailing hardware tokens
through interoffice mail, post, or overnight express, for example, might be more
practical for your organization. However, this usually involves more up-front work,
such as developing a process for generating mailing labels, and verifying that users
receive their tokens, to ensure success.
RSA recommends that you only mail disabled tokens, which can be enabled after
receipt by the correct user. Send information about how to enable tokens separately
from the actual tokens or make it accessible only from a secure location. You may also
want to consider grouping users so mailing can be accomplished in a controlled
manner.
Ultimately, you may decide to use a combination of these delivery methods. For
example, if you must distribute enabled tokens to assigned users, be sure to use secure
channels, such as having them delivered in person by trusted staff members.
80 3: Protecting Network Resources with RSA SecurID