Endpoint multi-factor authentication

Barricade access to a hacker’s point of contact

With an estimated 70 percent of breaches starting at endpoints, it's high time that admins take action to prevent these intrusions by leveraging multi-factor authentication (MFA). Endpoint MFA ensures users prove their identity through additional authentication methods like biometrics during workstation, server, VPN and OWA logins. Implementing Endpoint MFA mitigates the risks of exposing sensitive data, even in cases where passwords are compromised due to inadequate password hygiene.

Redefining endpoint security with MFA

ADSelfService Plus offers Endpoint MFA to help organizations secure multiple points of access to organization's sensitive resources. ADSelfService Plus' Endpoint MFA secures access to:

• Windows, macOS, and Linux machines.
• Top VPN providers like Fortinet, Cisco AnyConnect, Pulse, and more.
• Endpoints supporting RADIUS authentication such as Citrix Gateway, VMWare Horizon, and Microsoft Remote Desktop Gateway (RDP).
• Outlook Web access (OWA) logins.

Moreover, ADSelfService Plus offers offline MFA for Windows machines which ensures the security of offline remote workers during machine logons.

Complete endpoint protection: ADSelfService Plus' Endpoint MFA in action

With Endpoint MFA in place, users are first authenticated through Active Directory (AD) domain credentials, and next through authentication techniques such as one-time passwords (OTPs) sent via SMS or email, or Yubico OTP configured in ADSelfService Plus. So, even if hackers leverage compromised user credentials, their attack attempts can be thwarted through MFA.

According to the SANS Software Security Institute, organizations are hesitant to employ MFA because of:

• The misconception that MFA always requires external hardware devices.
• Concerns that MFA might affect user productivity.

ADSelfService Plus dispels both these misconceptions by providing 17 authentication techniques that don't always require external hardware devices (e.g. AD-based security questions) or affect user productivity (e.g. biometrics). However, it stands to reason that different sets of users are comfortable with different authentication techniques. Asking users who are only familiar with OTPs to use hardware tokens will generate a lot of complaints. Also, some users have more privileges than others; protecting these privileged accounts with additional authentication techniques makes more sense than implementing the same number of authentication factors for all users across the organization.

ADSelfService Plus allows admins to utilize different approaches to different sets of users to limit user disruptions. For example, with ADSelfService Plus, admins have the option to enforce OTPs, tokens, or security questions for one set of users (say, users inside the LAN network); and configure more stringent authentication techniques like fingerprint or FaceID authentication for another set of users (say, C-level executives or remote employees).

Supported authentication techniques

Simplify administration

ADSelfService Plus provides features to help admins:

• Enable MFA based on OUs and groups
  Enforce endpoint MFA and use different sets of authentication techniques for different users based on domain, OU, and group memberships.
• Ensure 100 percent enrollment
  Automate user enrollment by importing users' domain information through CSV files or force enrollment using login scripts.
• Get detailed reports
  Gain comprehensive insights on user activities such as identity verification failures and login attempts, and also find users with weak passwords.
• Simplify authentication
  Use authentication techniques like fingerprint authentication, push notification authentication, YubiKey, and QR code-based authentication to help users prove their identity with minimal effort.

Benefits of multi-factor authentication