ActivIdentity clicks into Cheshire with two factor authentication for Council remote users

Cheshire County Council sits at the highest tier of elected local government in its region, running key departments such as Children’s Services, Environment, and Community Services. The Council currently employs more than 25,000 staff, including teachers, local government officers, youth workers, nurses and civil engineers. With an increasing proportion of its personnel working from home or in the field, the Council has implemented the 4TRESS AAA Server for Remote Access and ActivIdentity tokens to improve the flexibility of its remote working solution, and support the council directive “to work smarter, not harder”.

Challenge

The Information Communication Technology (ICT) team at Cheshire County Council identified that an SSL VPN solution would improve upon the speed and efficiency of dial-up access, offering remote users greater functionality at a faster connection speed. The challenge that remained was how to secure this new, high speed connection.

This was further complicated by the fact that a large number of external agencies and non-Council workers, such as NHS trusts and housing associations, required access to information within certain areas of the County Council IT network. This meant that the ability to provide managed levels of access for different types of council and non-council network users was critical. The ideal solution, therefore, would help the Council strike a balance between accessibility to its system with the appropriate method of control.

Colin Rowland
ICT Policy & Security Manager,
Cheshire County Council

“We needed a product that offered high security but matched our budgetary requirements. Other systems we evaluated required licences to be purchased every three years on top of an annual payment, which not only increased the cost but the administrative burden of running the tokens.”

Solution

Colin Rowland, ICT policy and security manager at Cheshire County Council, realised that two factor authentication would provide the strongest form of security for remote access. Rowland instigated a research project to investigate costs and functionality of the various authentication systems on the market.

4TRESS AAA Server is a strong, scalable RADIUS and TACACS+ compliant server. Offering full Authentication, Authorization, and Accounting services, 4TRESS AAA Server enables enterprises to secure and manage WLAN and remote network access with two factor authentication. One-time passwords are generated using a patented algorithm based on three variables: time, an event counter and a cryptographic key that is updated for each authentication. This provides a higher level of security than other one time password solutions based on one or two variables only.

Gary Bebbington
Product Manager
Click into Cheshire

“Using the 4TRESS AAA Server product has made the ActivIdentity tokens very straightforward to set up and simple to administer.“

Deployment

The team had a number of concerns before the implementation process, specifically token durability, ease of use, and misplacement; but soon found that the roll out was far less problematic than originally expected.

“Using the 4TRESS AAA Server product has made the ActivIdentity tokens very straightforward to set up and simple to administer,” reports Gary Bebbington, product manager, Click into Cheshire. “There are approximately 450 tokens in use at the moment, with another 150 ready to go when needed.”

What began as the Cheshire Remote Access Gateway quickly developed into a solution which determined the levels of systems access according to the prescribed user: Click into Cheshire.

The Click into Cheshire Anywhere product allows file sharing, intranet access and web mail. Click into Cheshire Advanced also allows access to internal applications and requires a token to connect. Click into Cheshire for Partners is a token-based product designed specifically for external users through which access can be restricted as necessary.

Token users need to sign a policy document to ensure they are adhering to some simple protocols when using the hardware and accessing the Council’s IT network. Additionally, external agents remotely visiting the system (which comprise about 20 per cent of the total token users) need to have a VPN client installed on their laptop to authenticate to the system.

Benefits

By implementing the ActivIdentity 4TRESS AAA Server for remote access in combination with a user token deployment, Cheshire County Council can secure multiple remote access points to its network with a strong proof of identity and ensure sensitive areas of the system are protected. The ActivIdentity tokens can be calibrated to the individual user’s level of access, providing a solution with the flexibility and visibility of control that the Council requires.

Since the deployment of the ActivIdentity 4TRESS AAA server and token solutions, the number of users remotely accessing the Council system has doubled as a result of the speed and security of the ‘advanced solution’ connection.

The improved security of remote access from two factor authentication tools means that the option to work from home becomes more viable for a greater number of employees. This helps the Council to work in line with the latest developments in the law on flexible working without compromising employee productivity or satisfaction.

The County Council needs to keep its commitment to reducing climate change at the forefront of every policy and decision-making process. Staff travel is one significant area in which the Council can make a difference in terms of reducing its carbon footprint, and its environmental performance has considerably benefitted from this increase in home working.

With enhanced confidence in the security of the most sensitive applications, such as financial software or the children’s database, sitting within the network, the Council can grant greater freedom of information exchange across departments and to outside agencies resulting in a more efficient delivery of service to the citizen.