This Arkansas County Is Taking Multi-Factor Authentication Seriously
And its cybersecurity strategy protected $17 million from phishing attacks.
Nearly a year since the U.S. Office of Management and Budget launched its Cybersecurity Sprint and some localities like Washington County, Arkansas, are taking its multi-factor authentication recommendation seriously.
Stealing or guessing usernames and passwords to access sensitive government information, often through privileged users, is easy, so experts suggest requiring personal identity verification cards or other forms of additional authentication to reduce risk.
Washington County began using Crossmatch’s DigitalPersona Altus multi-factor authentication platform in 2008 to prevent users from sharing passwords and accurately autolog network activity.
“As technology progresses, and with the security posture we have today, biometrics have to be one of the things in the future we utilize throughout our lives, not just in our offices,” said county IT Director John Adams in an interview. “Passwords really are worthless in the sense that it just takes a matter of time to access them.”
The county also wanted to protect itself when a user worked remotely or lost a laptop, opting to use fingerprints as biometric identifiers to connect to Outlook Web Access or establish a virtual private network connection to its sandbox.
Initially, phishing attacks prompted the county to do away with usernames and passwords for certain websites dealing with financial transactions—protecting $17 million it had banked. Employees enjoyed not having to memorize passwords, Adams said, instead setting personalized secret questions.
More recently, Washington County completed a two-month, countywide migration of the platform throughout all its offices to more than 600 users that introduced new smart features: contextual authentication and application-specific policies. No longer do biometrics protect just county computers but apps like the assessor software employees use.
“Now more than ever, Altus provides strong, multi-factor authentication designed for the people that use it—and those that manage it,” Crossmatch CEO Richard Agostinelli said in a statement.
In the past, employees lacking proper access to software they needed would borrow passwords from coworkers, a security risk, but no more. And the county help desk’s workload has decreased thanks to a “huge reduction” in password resets, Adams said.
New employees visit the help desk, enroll in the system, create a user account with access controls, scan their fingers, and create their secret questions in under five minutes—enabling near-instant logins using Extron Electronics’ TouchLink biometric readers later.
Washington County government is geographically dispersed across two campuses and three remote locations, and employees can work remotely from home by verifying their identity with a one-time password token—not unlike a smart card.
“I’m now definitely able to distinguish and determine who accessed what from where and when,” Adams said.
Dave Nyczepir is a News Editor at Government Executive’s Route Fifty.
NEXT STORY: Data USA: A fresh look for government data