Life Insurer Takes New Approach to Two-Factor Authentication

Kansas City Life Insurance Co. needed a two-factor authentication solution for its employees, and it found one. Unfortunately, though, it wasn't the last time the company found itself looking for authentication technology.

Founded in 1895, Kansas City Life Insurance sells individual life, annuity, and group insurance policies. The bulk of the company’s 500-person staff works at the company's Kansas City headquarters, while a smattering of employees are stationed in various regional offices servicing more than 1,400 agents which serve its 500,000 customers.

As the Internet boom hit its peak at the turn of the millennium, the life insurance provider decided to move away from its old proprietary environment to an open, enterprise-class IP network. For security purposes, the firm needed to limit access to its network, restricting the bulk of its employees to local email and company intranet connections.

The tricky part was how to provide secure remote connections. “We knew that by going to IP we were opening up our network to the whole world, so there was a lot of risk involved in the change,” said Keith Beatty, systems engineer at Kansas City Life Insurance.

To ensure remote access security, the company deployed a virtual private network from F5. And to make doubly sure of the remote connections, the insurance firm also purchased a second factor of authentication: smart cards from RSA, now a division of EMC. The cards were bought in the summer of 2003 and easily integrated with the VPN, adding an extra level of protection for the enterprise network.

But the happy tale slowly turned sour. Gradually, the cards began to expire and needed to be replaced. “We could not simply replace the batteries, because the cards were sealed,” Beatty explained. “It seemed silly to buy a new one when the ones we had were still functional.”

Another problem was pricing granularity in the RSA product line. Kansas City Life Insurance found that each time it deployed a new technology that touched the smart cards -- such as Microsoft’s Active Directory -- it was forced to pay RSA another licensing fee. “We felt the company was nickel and diming us,” stated Beatty.

Then there was the problem of the Apple Macintoshes, which were becoming increasingly popular with some individuals in the insurance company's marketing department. The RSA SecurID system did not mesh well with the Macs.

With many of the cards set to expire, Kansas City Life decided to examine its options in the spring of 2007. The evaluation quickly evolved into a battle between RSA and Cryptocard. The latter’s purchase price of $3,300 was slightly higher than RSA’s alternative. But Cryptocard’s products were Apple friendly, the cards never have to be replaced, and its licensing policy is all-inclusive.

The insurance firm weighed a number of factors in its decision. For one thing, Cryptocard’s CryptoShield lets IT departments customize each card security setting, such as password characteristics. One of the company's employees had used the CryptosShield products in a previous job without any problems.

RSA, on the other hand, had the better management system. Its management tools are richer, offer more reporting features, and run more efficiently than those from Cryptocard. In the end, however, Cryptocard won the evaluation and RSA lost its Kansas City Life Insurance’s business.

After tinkering with Cryptocard evaluation unit for a few weeks, the insurance company swapped out its smart card authentication system in the summer of 2007. Minimal user training was required, because the RSA system continually generates a password, while Cryptocard only does so on demand. The deployment took a few weeks.

Having now gone through two deployments, Kansas City Life Insurance's IT staff now feels that it now has a system that will last, and that will meet its long-term security needs as well as its near-term requirements.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.