Security has created an authentication gap 18 September, 2005 By Chris Talbot

PromoPipeline Exclusive Channel Promotions Find Out How You Can Make Money Today! ENROLL FREE! >> Factory Direct Should Not be Cheaper William Vanderbilt - Innovative Learning Channels Cloud Ecosystem II: A Candid Conversation with Oracle Beth Vanni - Amazon Consulting Cloud Ecosystem: A Candid Conversation with Rackspace Hosting Beth Vanni - Amazon Consulting Channel Manager Compensation William Vanderbilt - Innovative Learning Channels Financial Expertise William Vanderbilt - Innovative Learning Channels

According to Rod Stuhlmuller, director of product marketing at Arcot Systems, while weak authentication systems like username/password combinations are the most affordable solutions and one of the least intrusive types of authentication solutions, they're just that -- weak. Organizations are left with a choice -- spend little and get a weak solution or spend a lot and get a strong authentication solution that is also likely be more intrusive and not usable in all areas of the enterprise, he said.

This has created an authentication gap, Stulhmuller said. It's a gap that Arcot has been trying to fill. He said that many companies choose to go with the simpler, weaker username/password authentication because it's functional across the enterprise and relatively inexpensive. While tokens offer better security, they cost more and are more inflexible.

"It can't support, for instance, digital signature," he said. Smartcards offer a better user experience than tokens, but they require special hardware and can be quite costly, he added.

Stuhlmuller said Arcot has a solution that appears to be as simple as a username/password solution but has a much higher level of security for authentication. It also doesn't interfere with end-users' experiences. The way it works is that the first time an end-user logs on using Arcot's solution, several personal questions are asked for authentication purposes. Then the end-user creates a username and password. Unknown to the user, Arcot then places a very small file on the computer for further authentication. When an end-user tries to sign on to whatever system it might be (for instance, an online banking service), Arcot's solution checks for the file. If it's not found, then it goes through an authentication process (which can include asking the personal questions when the account was first set up) to make sure that the person trying to use the username and password is the correct person.

Arcot has been selling its solution directly to financial institutions, e-commerce businesses and pharmaceutical companies, but according to Doc Vaidhyanathan, vice president of product management at Arcot Systems, there are also a lot of opportunities for ISVs, systems integrators and vendor partners.

Arcot has taken a multi-pronged channel approach, said Keith Goldstein, vice president of channels at Arcot Systems. It is working with specific ISVs that use Arcot to provide authentication capabilities as part of their own solutions. Arcot has also formed technology relationships with VPN vendors, as well as other security vendors with hardware-based solutions that are looking for the roaming capabilities that Arcot's solution offers. However, one of the biggest areas of growth is around the opportunities that systems integrators have access to, Goldstein said.

For the most part, Arcot is working with bigger ISV, systems integrator and vendor partners, he added.