Review: RSA SecurID 3.0

The RSA SecurID appliance running the RSA Authentication Manager software 3.0 provides centralised authentication while administrating and managing policies for the enterprise.

After loading numerous software applications, each with its own operating system and add-on dependencies, we were excited to see an appliance - an appliance we expected to be up and running in short order. The deployment took longer than expected and we hit a couple of snags, with errors in the installation documentation. There is also quite a bit of configuration for an appliance, but once it was complete and rebooted, we were able to use the web-based management interface for all of our additional work. The manager has multiple privilege and administrative levels.

RSA Authentication Manager software does log all transactions and user activity, making it a nice auditing and accounting tool. Although the auditing capabilities are substantial, the reporting is not so intuitive. There are report templates we found that can be powerful but require tailoring.

LDAP and Microsoft AD integration are available but require substantial programming to link to the directory source.

On the end-user side, the solution does provide for a vast array of token options, including a full range of hardware, software and virtual tokens. The RSA time-synchronous technology changes the user's password every 60 seconds. A knowledge-based authentication option is available in the event of a lost token. The end user can deploy two-factor authentication in a zero footprint scenario, thus making up for the added work in the server configuration and management description. Users can also (if allowed) access a self-service console and perform such tasks as account request, PIN reset, enabling tokens and receiving emergency access. Agents for web-based applications and VPN-style connections are also available; however we did not test these in this review.

It comes with three-year, next-business-day advanced hardware replacement and phone support. Upgraded options are available.

With power comes complexity. If you have the staff and the time, this is a very nice solution.

For: Integrates with everything, very flexible, powerful. Against: Ease of use for enterprise deployment, cost. Verdict: Strong product offering, harder to manage and customise - but, with the effort, can do it all.