Local Authorities must secure remote access with dual-factor authentication to keep access to Government Extranet...

With the deadline for compliance with the Code of Connection CoCo fast approaching, Signify is warning local authorities that they risk losing online connection to central Government departments if their employees working remotely are not secured with dual or two-factor authentication.

After 31 March 2009, most local authorities need to have made the necessary changes to their networks and security to comply with CoCo. If they haven t, they will no longer be allowed to connect to the Government Connect Secure Extranet GCSx - a secure private Wide-Area Network WAN that enables communication between local authorities and Government departments such as Work and Pensions and Children Schools and Families.
A key element of CoCo is that users working remotely must replace simple password protection with secure two-factor authentication. Two-factor authentication requires remote users to present two different factors or proof of identity something you know and something you have. These factors are usually a secret PIN something you know and a tangible object like a token, USB device, or mobile device such as a phone or BlackBerry something you have .
But because two-factor authentication systems can be complex and time-consuming to deploy, Signify is offering local authorities a two-factor authentication hosted service to beat the deadline. A hosted service is attractive because it is quick and easy to set up, has low overheads and total cost of ownership, as well as being reliable and secure with flexibility to grow as requirements change, says Dave Abraham, CEO at Signify. For authorities that have not yet adopted two-factor authentication to comply with CoCo, it can be set up and running within days.

Southwark Borough Council is one local authority that uses Signify s hosted service to secure remote access to sensitive information and provide more flexible working, speed up bureaucratic processes and paperwork and reduce office space.

Signify provides Southwark staff with a small RSA SecurID token usually carried on a key ring - that produces a new unique one-time passcode OTP every 60 seconds. By using this, along with their known user name and secret PIN, Southwark staff can safely gain immediate access to the information they need.

Using Signify s managed service means that they handle everything from dispatching devices and rights administration to handling lost tokens or forgotten passwords, says Richard Heap, Business Partnership Manager, Southwark Borough Council. It s simply a no-hassle solution and Signify s Identity Management Centre IMC web portal also allows us to enforce security policy, add or remove users and provides full reporting and auditing information.

Southwark demonstrates how simple it can be for local authorities deploy two-factor authentication and comply with CoCo, as well as the great potential of secure remote access for public authorities, says Dave Abraham. Other Signify local authority clients include The London Borough of Tower Hamlets, Huntingdonshire District Council and Lincoln City Council.