Story image

Sydney authentication provider to work with US National Cybersecurity Center of Excellence

23 Aug 2017

Sydney-based cybersecurity firm TokenOne is now the first Australian company to be selected for a consortium project for the US National Cybersecurity Center of Excellence (NCCoE), alongside enterprise heavyweights such as RSA and CA Technologies.

The Multifactor Authentication (MFA) for e-Commerce project will put transaction security in the spotlight, particularly for those in retail and e-commerce industries in the US. The aim is to steer discussion away from passwords and to alternatives such as multifactor authentication.

Callsign, CA Technologies, Rivetz, RSA, Splunk, TokenOne, and Yubico are all collaborators in the project. The consortium will also produce standards-based solutions and recommendations for those in retail and ecommerce as to how to conduct secure business.

“Consumers, retailers, payment processors, banks, and card issuers are all impacted by fraud. Part of e-commerce fraud reduction includes an increased level of assurance in purchaser or user identity,” comments NCCoE’s Sarah Kinling.

“Retailers recognize that customers could be put off by the complexity that multifactor authentication mechanisms may add to the purchasing checkout and post transaction processes,” Kinling continues.

The project will consider multifactor authentication in terms of risk calculations, transaction details, web session monitoring and device identification, which can all determine that fraud may be happening.

“Multiple forms of multifactor authenticators, such as FIDO, out-of-band, and one-time-password devices will be considered to provide retailers and their customers a diverse set of implementation options. All products incorporated into the reference design will be standards-based commercially available and open source products,” Kinling explains.

TokenOne’s technology allows businesses, customers and individuals to access services through a unique PIN that is visible to nobody else, including the service that is being accessed. No algorithms are involved.

Users can verify their real-world credentials and identity, use their device as a token and then create a secret PIN. This authentication method works with more than 2500 supported sires and services, including Google Apps, Zendesk, Cisco, AWS, Adobe Document Cloud, Salesforce and Marketo.

 “TokenOne is a 'Zero Knowledge Password Proof'. The TokenOne user knows their PIN but never enters it, or reveals it to anyone, not even to the service the user is accessing,” a statement says on the company’s website.

TokenOne plans to expand worldwide and says the NCCoE project is a huge milestone.

The company also offers a partner program for value added resellers, referral partners, system integrators and ISVs and distributors.

The program provides dedicated channel support, accelerated time to market training and certification, increased ongoing revenues and a dedicated partner portal.

TokenOne is backed by investors such as Singtel Innov8. Retired FBI assistant director Charles Archer sits on the company’s advisory board.

Avi Networks: Using visibility to build trust
Visibility, also referred to as observability, is a core tenet of modern application architectures for basic operation, not just for security.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.