Headline
CVE-2021-42791: Veridium Eliminates Passwords with VeridiumAD for Enterprises Using Microsoft Active Directory
An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper access control. A user can trigger push notifications for any other user. The text contained in the push notification can also be modified. If a user who receives the notification accepts it, then the user who triggered the notification can obtain the accepting user’s login certificate.
New Solution Enhances Enterprise Security and Ease of Employee Login While Reducing Password Reset Costs by More Than 50 Percent
RSA CONFERENCE – SAN FRANCISCO, CA – February 13, 2017 – Veridium, a leader in biometrics-based authentication software, announced today at the RSA Conference the launch of VeridiumID, an enterprise-ready solution that adds biometric authentication and identity assurance to Microsoft Active Directory environments. VeridiumID allows companies to eliminate traditional passwords for employees, making the login process simpler, more secure, and cheaper by reducing the time and resources spent to constantly reset stolen or forgotten passwords.
VeridiumID is a flexible and customizable software solution that integrates with existing enterprise infrastructure without any additional hardware, allowing organizations to replace passwords altogether or to enable biometrics as a second factor, replacing the need for hard and soft tokens. Replacing passwords with biometrics allows organizations to verify the identity claimed by any user, keeping enterprise data safe and secure. Biometric authentication can reduce password resets, help desk requests, and support calls by up to 50 percent, according to Gartner.
“We all know that passwords are a flawed enterprise security solution – but what doesn’t get talked about often enough is how inconvenient and expensive they are to companies,” said James Stickland, CEO of Veridium. “VeridiumID provides a seamless experience for end users while upgrading enterprise security to eliminate the inherent risks associated with passwords. The combination of convenience and security allows for better protection of corporate assets and systems on premise or remotely.”
The costs of forgotten passwords can be steep for organizations: According to research by Mandylion Labs, the average enterprise spends $180,000 annually on password resets per 1,000 employees and loses over 1,000 hours a year on those resets. With more than 90 percent of Fortune 1000 companies using Active Directory, the impact of a password-free solution is significant.
VeridiumID supports a variety of deployment scenarios, including local computer login, virtual desktops using Citrix StoreFront, and remote access through Citrix Netscaler or to any client VPN configured to use RADIUS to authenticate remote users against the database.
- Microsoft Windows Login: The software integrates with Microsoft Windows to directly authenticate employees through Active Directory, using biometrics from their phone or from the camera on their computers before granting them access.
- Virtual Desktops: VeridiumID integrates with Citrix Storefront, configured to use biometrics as the second-factor authenticator instead of hard or soft tokens.
- Remote Access Login: When logging into a company’s virtual private network, VeridiumID can be configured to use the RADIUS protocol with biometrics as the second factor in a 2FA setup.
- Biometrics as a Primary Factor: VeridiumID supports biometrics as the primary factor for logging in through any configuration, eliminating the need for two-factor authentication.
VeridiumID supports multiple biometrics for customization for security needs or user preference and is deployable as software. The solution also enables offline authentication.
Since the company’s rebrand in September 2016, heralding a new corporate strategy, Veridium has brought on a new CEO, fintech industry executive James Stickland, and partnered with Dutch mobile-only bank bunq to deploy its VeridiumID technology. In addition to VeridiumID, the company is also announcing today that IT software veteran John Spencer, former CTO of Citrix Systems, is joining Veridium as its chief product officer, leading the development of Veridium’s biometric authentication product roadmap.
Veridium will be demoing the new VeridiumID solution, alongside other solutions and use cases – including its proprietary 4 Fingers TouchlessID biometric solution – onsite at RSA 2017 in the Marriott Early Stage Expo #ESE – 35. For more information on VeridiumID, on Veridium, and the impact of widespread biometric adoption, please visit: https://veridiumid.com/
**About Veridium
**Veridium is a leading provider of end-to-end biometric authentication designed to safeguard enterprises’ most critical assets. Powered by an unmatched legacy of biometrics R&D, Veridium solutions help organizations to increase security, reduce fraud, and cut the costs associated with passwords and traditional multi factor authentication solutions. Veridium has offices in the U.S., U.K., Netherlands, and Romania. For additional information, please visit www.veridiumID.com.