Story image

Sydney authentication provider to work with US National Cybersecurity Center of Excellence

23 Aug 2017

Sydney-based cybersecurity firm TokenOne is now the first Australian company to be selected for a consortium project for the US National Cybersecurity Center of Excellence (NCCoE), alongside enterprise heavyweights such as RSA and CA Technologies.

The Multifactor Authentication (MFA) for e-Commerce project will put transaction security in the spotlight, particularly for those in retail and e-commerce industries in the US. The aim is to steer discussion away from passwords and to alternatives such as multifactor authentication.

Callsign, CA Technologies, Rivetz, RSA, Splunk, TokenOne, and Yubico are all collaborators in the project. The consortium will also produce standards-based solutions and recommendations for those in retail and ecommerce as to how to conduct secure business.

“Consumers, retailers, payment processors, banks, and card issuers are all impacted by fraud. Part of e-commerce fraud reduction includes an increased level of assurance in purchaser or user identity,” comments NCCoE’s Sarah Kinling.

“Retailers recognize that customers could be put off by the complexity that multifactor authentication mechanisms may add to the purchasing checkout and post transaction processes,” Kinling continues.

The project will consider multifactor authentication in terms of risk calculations, transaction details, web session monitoring and device identification, which can all determine that fraud may be happening.

“Multiple forms of multifactor authenticators, such as FIDO, out-of-band, and one-time-password devices will be considered to provide retailers and their customers a diverse set of implementation options. All products incorporated into the reference design will be standards-based commercially available and open source products,” Kinling explains.

TokenOne’s technology allows businesses, customers and individuals to access services through a unique PIN that is visible to nobody else, including the service that is being accessed. No algorithms are involved.

Users can verify their real-world credentials and identity, use their device as a token and then create a secret PIN. This authentication method works with more than 2500 supported sires and services, including Google Apps, Zendesk, Cisco, AWS, Adobe Document Cloud, Salesforce and Marketo.

 “TokenOne is a 'Zero Knowledge Password Proof'. The TokenOne user knows their PIN but never enters it, or reveals it to anyone, not even to the service the user is accessing,” a statement says on the company’s website.

TokenOne plans to expand worldwide and says the NCCoE project is a huge milestone.

The company also offers a partner program for value added resellers, referral partners, system integrators and ISVs and distributors.

The program provides dedicated channel support, accelerated time to market training and certification, increased ongoing revenues and a dedicated partner portal.

TokenOne is backed by investors such as Singtel Innov8. Retired FBI assistant director Charles Archer sits on the company’s advisory board.

GitHub launches fund to sponsor open source developers
In addition to GitHub Sponsors, GitHub is launching the GitHub Sponsors, GitHub will match all contributions up to $5,000 during a developer’s first year in GitHub Sponsors.
Check Point announces integration with Microsoft Azure
The integration of Check Point’s advanced policy enforcement capabilities with Microsoft AIP’s file classification and protection features enables enterprises to keep their business data and IP secure, irrespective of how it is shared. 
Why AI will be procurement’s greatest ally
"AI can help identify emerging suppliers, technologies and products in specific categories."
Are AI assistants teaching girls to be servants?
Have you ever interacted with a virtual assistant that has a female-based voice or look, and wondered whether there are implicitly harmful gender biases built into its code?
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
Data#3 to exclusively provide MS licences to WA Government
The technology services provider has won two contracts with the Western Australia Government, becoming its sole Microsoft licence provider.
Why cash is no longer king in Australia
Australia is leading the way in APAC for granting credit on B2B transactions.