Tech Success: What's the password?

With about 125 of its 600 employees deployed across the United States, computer password problems and lockouts were a major issue for the Treasury Department's Alcohol and Tobacco Tax and Trade Bureau."We don't run a 24-hour-a-day, seven-day-a-week help desk; we're open 7 a.m. to 8 p.m. Eastern Time," said Mike Borland, assistant chief information officer of infrastructure for the bureau, also known as TTB. "If you missed that window, you were basically out of luck until the next day if you locked yourself out of the network."To address this problem, bureau officials turned to Avatier Corp. and its suite of identity and access management tools.The bureau started off with an Avatier Identity Management Server (AIMS) component called Password Station. Essentially, the software allows for self-service password management, said Nelson Cicchitto, Avatier chief executive officer."If a person forgets her password, instead of calling the help desk to have it reset by a human, she can reset it herself automatically and securely," he said.The tool is accessed via a Web browser and relies on a series of questions to verify users' identities when resetting their passwords.When users register, they are asked several questions: What's your favorite food? What's the name of your favorite grade school teacher? Their answers are used for verification.Password Station can reset and synchronize passwords across multiple applications and platforms.For example, it integrates with an AS400 mainframe system, and with Oracle and PeopleSoft applications.The Avatier software resides on a Web server, and a Web client is installed on each client PC, said Kamran Khayami, a TTB network engineer who helped in the installation and systems integration of the tool.Four other AIMS tools focus on other aspects of password administration:*Password Bouncer enforces password policy throughout an organization, preventing users from selecting easily cracked passwords, such as their kids' names.*Account Terminator lets IT staff in one action disable or delete employee accounts across multiple platforms by using an administrative Web browser that also provides a complete audit trail.*Account Creator lets an IT administrator create access accounts across multiple platforms and applications. It also enforces unique naming and password conventions and automates mailbox creation.* Account Requester, still in development, lets a user request access to, for example, the organization's accounting department's data. The tool goes out and finds the manager of that department, and requires approval from that person before granting access."It can also enable workflow processes such as ordering business cards or badges," Cicchitto said.But for TTB, the real test of Avatier's tools was whether they could reduce help desk calls and solve users' problems when the help desk staff was unavailable.In June, Avatier diverted 298 calls to TTB's help desk; 172 of those calls were for password resets, Cicchitto said.Because identity verification through the AIMS tool is regimented more strictly than it might be in a human-to-human phone call, Password Station also makes the network more secure, Cicchitto said."Obviously, passwords are what control access to all your critical applications and data, so the big benefit is that we can control when the password is being reset and by whom," Cicchitto said. "Ultimately, it's controlling who has access to the applications and the data."Avatier also has a phone interface that can be used when users don't have access to a Web browser or the organization's network. Using a personal identification number and prompts on the phone, users can reset their passwords so they can log on later when they have computer access.The tool also has a voice biometrics component that uses a digital voice ID to verify user identity.AIMS runs on Microsoft Windows 2000 and 2003 Web server. It uses Web services to communicate with other platforms such as mainframes or Unix machines. A secure communication layer ensures all the data is encrypted before it's moved."Everything is sent through as Hypertext Markup Language and as an Excel spreadsheet to the administrators, letting them know how many password resets and account lockouts were avoided," Cicchitto said.TTB officials said the installation was straightforward."Customization and getting the phone piece working were probably the only parts we needed Avatier to help us with," Khayami said.For officials at Alcohol and Tobacco Tax and Trade Bureau, installing AIMS has brought daily benefits to the organization."I look at the help desk tickets every day, and they are dramatically reduced," Borland said. "On any given week, probably less than 15 percent of our calls are password reset calls. It's been well accepted, especially in the field. Our field auditors have really embraced this."If you have an innovative solution that you recently installed in a government agency, contact Staff Writer Doug Beizer at dbeizer@postnewsweektech.com.