How to evaluate different solutions for security tokens?

Question

According to my own experience, most companies selling security tokens for authentication like RSA, Verisign or Aladdin share little information about the internals of their products like algorithms and backend infrastructure. How can I compare those companies and their products to each other? How can I make an educated decision, which product fits my requirements and provides the best security?

Answer 1

How can I compare those companies and their products to each other?

It's quite difficult. You are not going to be able to do a variable to variable comparison. In cases like this I sugges you go for second order effects. Who are their customers and how closely do their authentication needs match yours? How do the companies who offer tokens deal with issues technical and non technical?

How can I make an educated decision, which product fits my requirements and provides the best security?

Depending on how forthcoming their sale team is will to be it may be difficult. Try to understand the risks you are mitigating with multi-factor authentication and the consequences of failure. See of the companies offer insurance in the case of failure and what form that insurance would take. Will they help you detect a breach? What about containment and remediation? Where do they stand on user training? Will they help keep you aprised of relevent threats? If you cant get at the specifics of the technology try to understand the larger benefits and drawbacks. Technology only implements security policy, make sure that their technology will implement the policy you desire.

Answer 2

You can compare the properties they do publish, but I agree with you that it's a hard problem. Especially after RSA was hacked last year (http://it.slashdot.org/story/11/03/17/2321226/rsas-servers-hacked) and they said it wouldn't influence the security of their tokens, but when after that Lockheed Martin was hacked (http://www.dailytech.com/Reports+Hackers+Use+Stolen+RSA+Information+to+Hack+Lockheed+Martin/article21757.htm) it turned out that information stolen at the RSA hack had been used to compromise the tokens used by Lockeed.

There are some open implementation of such tokens however, like Yubikey (http://yubico.com/yubikey). You can evaluate more of their implementation, all the software is open source. Moreover, you can build your own authentication infrastructure using their devices.