Hitachi ID Password Manager Features
| FEATURE: Password Synchronization | |
| Description | Benefit |
|
Hitachi ID Password Manager (formerly P-Synch) makes it easy for users to maintain just one or two passwords across all of their login accounts. Two processes support this objective:
|
Users with a single password to remember have fewer password problems and tend not to write down their passwords. Password synchronization typically eliminates about 80% of password problems. |
| FEATURE: Self-Service Password Reset | |
| Description | Benefit |
|
Users can authenticate to Password Manager with something other than a password: hardware tokens, biometrics, smart cards, PKI certificates or challenge/response profiles. Once authenticated, users can reset their own passwords and clear any intruder lockout flags. |
Allows users who experience password problems to resolve them rather than calling the help desk. Self-service password reset typically diverts about 65% of password problems away from the help desk. |
| FEATURE: Assisted Password Reset | |
| Description | Benefit |
|
Support analysts can sign into Password Manager, look up a user profile, authenticate the caller, reset multiple passwords and clear intruder lockout flags. Password Manager automatically creates call tracking tickets and sends notification of the password reset to the user. |
Handling the entire password-problem support call with a single user interface significantly shortens call resolution time, to about 1 minute. |
| FEATURE: Password Policy Engine | |
| Description | Benefit |
|
Password Manager enforces stringent requirements over the composition of all new passwords. There are over 50 built-in password rules, plus extensibility through a pattern matching engine and a plugin system. |
A global password policy is easier for users to understand and reduces password problems. All new passwords are subjected to strict rules, rather than enforcing a different, weaker subset of the rules on each platform. A consistent policy makes it possible to synchronize passwords (see benefits of password synchronization above). |
| FEATURE: Automatic Account Discovery | |
| Description | Benefit |
|
Password Manager extracts a full list of user IDs from every managed system, nightly. Users who appear on authoritative systems automatically get Password Manager profiles. Accounts on systems where login IDs are consistent with the authoritative systems are automatically attached to user profiles. The user ID inventory is used to support self-service registration of non-standard login IDs. |
Automatic discovery eliminates the need for manual / redundant administration of Password Manager users. Automatic correlation reduces or eliminates the need for user registration. |
| FEATURE: Self-Service Registration | |
| Description | Benefit |
|
Users are automatically prompted by e-mail to register with Password Manager. Prompting e-mails contain a URL where users sign in with a network OS login ID and password and fill in the blanks to supply their own challenge/response data and non-standard login IDs. |
Required user profile data, such as authentication challenge/response and profiles of non-standard login IDs, can be readily collected from very large user populations in a short time period, with little or no professional services or manual administration expense. Data collected by Password Manager registration programs is reliable, as it leverages existing strong authentication. |
| FEATURE: Assistance for Locked Out Users | |
| Description | Benefit |
|
Users who forget their primary password and cannot sign into their own workstation can gain access to Password Manager using a variety of mechanisms, including their telephone, a secure kiosk account, a GINA service and a Vista/Windows 7 Credential Provider. |
Some IT analysts have estimated that 40% or more of password problems fielded by a typical help desk are due to users who cannot sign into their PCs. It follows that much of the value of a password management system depends on enabling these users to help themselves. |
| FEATURE: Incident Management Integration | |
| Description | Benefit |
|
Over 100 events in Password Manager can trigger automatic creation, update or closure of a help desk ticket. These include sign-on success and failure, user profile lookup and update, password reset success and failure, password synchronization attempts, success and failure, intruder lockouts, etc. |
Automatic call tracking integration eliminates redundant data entry at the help desk, aggregates audit and reporting data into a single, existing system and triggers action items to respond to system problems or security incidents. |
| FEATURE: E-mail Integration | |
| Description | Benefit |
|
The same events that can trigger call tracking integration can also trigger e-mails to be sent to users, administrators, security officers and more. In deployments requiring registration, e-mail can also prompt and remind users to register. |
User education and registration leverage the existing mail infrastructure. Users are notified of actions taken against their accounts and either confirm that the actions are legitimate, or trigger a security incident if changes are suspicious. |
| FEATURE: Open Authentication Infrastructure | |
| Description | Benefit |
|
Users can be authenticated to Password Manager with any of:
|
Flexible authentication supports: Ease of use -- users will generally agree to password authentication for routine password changes, but resist less convenient challenge/response authentication unless it is clearly required. Use of the most secure authenticator possible in every circumstance. Leveraging existing infrastructure, such as hardware tokens. |
| FEATURE: Broad Platform Support | |
| Description | Benefit |
|
Password Manager has built-in support for 100+ types of systems, including operating systems, directories, e-mail systems, ERP applications, databases and more. It can also be readily integrated with custom and vertical market applications, with little or no custom programming. |
|
| FEATURE: Complex Integrations | |
| Description | Benefit |
|
Password Manager supports integrations with "complex" systems, including key recovery for full disk encryption software, updating cached passwords on Windows, password resets initiated for mobile users over temporary VPN connections and integration with single signon products to ensure smooth operation after a password change. |
|