SecureAuth Multifactor Authentication & Identity Protection
SecureAuth IdP provides multiple silent risk checks and evaluates credentials and innovative ways to defeat MFA methods “riskiness” of every access request. This adaptive authentication enables you
to allow access for low risk requests without a MFA step, require MFA for
medium risk and deny or redirect for high risk.
- 25+ authentication methods to suit any use case
- Multiple adaptive preauthentication risk checks
- Step-up authentication only when risk is present
- Unlimited custom authentication workflows
- Self-service tools, including self-enrollment, password resets and account unlocking
- Centralized access control protection.
- Standards-based, non-proprietary architecture easily fits with existing architecture.
- Largest inventory of supported technologies allows easy integration.
- Single sign-on with strong authentication keep users productive
- Increase security without impacting users with pre-authentication risk analysis.
- Easily tailor authentication process to different user types.
- Maintain productivity and reduce help desk calls with user selfservice.
- Improve user convenience and protect against password fatigue.
- Progress secure access with flexibility and multiple authentication methods.
- Optimize, rather than replace, existing security investments.
- Empower users to go Passwordless with high identity confidence.
- Easily deploy enterprise-wide and eliminate disparate security solutions.
- Correlate identity threats/data for more holistic and orchestrated protection.
£1 to £5 per user per month
- Education pricing available
- Free trial available
Cloud Digital Limited
|Software add-on or extension||Yes, but can also be used as a standalone service|
|What software services is the service an extension to||
SecureAuth IdP installs into your environment, tying to your enterprise directories, web servers, and VPNs utilizing the same IDs, profile information and policies you use. There is never a need to remake, duplicate, or migrate your data stores, we leverage what’s already in
place, working with hard tokens too.
|Cloud deployment model||
|System requirements||SecureAuth IdP installs right into your existing environment.|
|Email or online ticketing support||Email or online ticketing|
|Support response times||Varied SLAs can be negotiated. Normal response times are within 48 hours Monday to Friday, 8.30am to 5.30pm.|
|User can manage status and priority of support tickets||No|
|Phone support availability||24 hours, 7 days a week|
|Web chat support||No|
|Onsite support||Yes, at extra cost|
Basic Support for provides the following technical support capabilities:
Support Desk access 7 a.m. to 7 p.m. local time, Monday through Friday.
Address cases opened only by electronic mail or Internet.
Response as follows:
Severity 1: 1 business hour
Severity 2: 4 business hours
Severity 3: 8 business hours
Severity 4: 12 business hours
For cases received outside the 12-hour local-time window, we will respond no later than the next business day.
|Support available to third parties||Yes|
Onboarding and offboarding
|Getting started||We will provide various sources of on-boarding assistance including, remote tutoring, professional service installation and location specific training all supported by excellent online and printed documentation and resources.|
|Other documentation formats||Paper|
|End-of-contract data extraction||We do not hold customer data.|
|End-of-contract process||The application is simply uninstalled and/or deleted.|
Using the service
|Web browser interface||No|
|Application to install||No|
|Designed for use on mobile devices||Yes|
|Differences between the mobile and desktop service||Not applicable|
|What users can and can't do using the API||
The service is set up by Cloud Digital 'as a service'.
The service is deploy applications through the API and run programs automatically subject to existing governance levels.
|API documentation formats||Other|
|API sandbox or test environment||No|
|Independence of resources||If SecureAuth is inoperable the applications are not. Each SecureAuth instance is separate from any other.|
|Service usage metrics||Yes|
|Metrics types||User defined reports are available at a granular level, as well as a suite of existing reports. These cover both spend and usage, as well as Cloud performance.|
|Supplier type||Reseller providing extra features and support|
|Organisation whose services are being resold||Cisco, Cofense, ShieldX,Google, Cronus, SecureAuth, CoreImpact|
|Staff security clearance||Other security clearance|
|Government security clearance||Up to Developed Vetting (DV)|
|Knowledge of data storage and processing locations||Yes|
|Data storage and processing locations||
|User control over data storage and processing locations||Yes|
|Datacentre security standards||Supplier-defined controls|
|Penetration testing frequency||At least once a year|
|Penetration testing approach||‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider|
|Protecting data at rest||Other|
|Other data at rest protection approach||We do not hold data.|
|Data sanitisation process||Yes|
|Data sanitisation type||Deleted data can’t be directly accessed|
|Equipment disposal approach||A third-party destruction service|
Data importing and exporting
|Data export approach||Not applicable. We do not hold data.|
|Data export formats||Other|
|Other data export formats||Not applicable. We do not hold data.|
|Data import formats||Other|
|Other data import formats||Not applicable. We do not hold data.|
|Data protection between buyer and supplier networks||
|Data protection within supplier network||Other|
|Other protection within supplier network||No data held within our network.|
Availability and resilience
|Guaranteed availability||The software is deployed to a user specific virtual environment and save for patches and upgrades will be operational continuously and in any event we work on all products to have a 98% availability.|
|Approach to resilience||N/A|
|Outage reporting||Via a service desk or front desk application users are notified directly to their inbox and additionally can have a scripted notification via a dashboard.|
Identity and authentication
|User authentication needed||Yes|
|User authentication||Username or password|
|Access restrictions in management interfaces and support channels||Cronus has full audit-ability and end-to-end encryption.|
|Access restriction testing frequency||At least every 6 months|
|Management access authentication||Username or password|
Audit information for users
|Access to user activity audit information||You control when users can access audit information|
|How long user audit data is stored for||User-defined|
|Access to supplier activity audit information||You control when users can access audit information|
|How long supplier audit data is stored for||User-defined|
|How long system logs are stored for||User-defined|
Standards and certifications
|ISO/IEC 27001 certification||No|
|ISO 28000:2007 certification||No|
|CSA STAR certification||No|
|Other security certifications||Yes|
|Any other security certifications||
|Named board-level person responsible for service security||Yes|
|Security governance certified||Yes|
|Security governance standards||CSA CCM version 3.0|
|Information security policies and processes||
We operate to an internal security information policy process which adheres to applicable legislation and regulatory requirements. This covers personal, sensitive, critical and business data. Our standards are in excess of those set out in Data Protection Legislation, including GDPR.
Our information head is our operations director who is responsible for company wide governance.
Regular, at least annual audits are carried out.
We do not, however, hold any customer sensitive personal data.
|Configuration and change management standard||Supplier-defined controls|
|Configuration and change management approach||
We follow a 5 step process:
1 Version Control: All changes are recorded, and we maintain full version history.
2 Baseline and release information: Last version released, what it contains, as well as deploy time.
3 Audits & Review: Audit of configuration management and versioning system properly, correctly, consistently.
4 Documented Process: An agreed upon process by all team members to ensure compliance in actual implementation.
5 Build, Integrate and Deploy Scripts: Common, standard scripts that automate the work of building, testing, integrating, deploying, and removing manual errors from the process.
|Vulnerability management type||Supplier-defined controls|
|Vulnerability management approach||
This stage of our vulnerability management contains minimal processes and procedures. Vulnerability scans are done by a third-party vendor.
This stage is in-house. We define a set of procedures for vulnerability scanning which are carried out weekly or monthly.
This stage the information security team has support from the executive management as well as the system administrator.
This stage the specific attributes of a program are quantifiable and metrics are provided to the management team.
This stage, metrics are targeted for improvement which ensures that the program continuously reduces the attack surface.
|Protective monitoring type||Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402|
|Protective monitoring approach||
Comprehensive 24 x 7 monitoring and alerting. We collect log data on the activities of both systems and users, and review and audit it in near real-time. Coupled with intelligent baselining and effective prioritisation, which enables critical alerts to be raised to the right people at the right time.
We decipher the information generated through monitoring, keep security informed around the reason the output was generated.
We provide regular reports and reviews to ensure the service continues to deliver at the expected levels. This means no issues are missed, and alerts can be analysed and understood after the event.
|Incident management type||Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402|
|Incident management approach||
The process follows pre-defined stages:
Incident identification - logged by user or internal operative
Incident logging - user loggin
Escalation, as necessary
Communication with the user community throughout the life of the incident.
Incident management is not expected to perform root cause analysis to identify why an incident occurred as the focus is on doing whatever is necessary to restore the service. This often requires the use of a temporary fix, or workaround.
|Approach to secure software development best practice||Supplier-defined process|
Public sector networks
|Connection to public sector networks||No|
|Price||£1 to £5 per user per month|
|Discount for educational organisations||Yes|
|Free trial available||Yes|
|Description of free trial||This is normally by way of a Proof of Concept where Cloud Digital will deploy an instance of SecureAuth on behalf of the User and demonstrate the capabilities and determine how many users are within the environment.|