Computerworld - Employees at Post & Schell PC, a law firm in Philadelphia, need smart cards to do just about everything, from entering company facilities and using elevators to securing two-factor authentication so they can access IT applications. The firm recently started using smart cards as part of a move to bolster network and physical defenses when it relocated to a new facility.
"The big ROI we are providing our firm, our attorneys and our clients is greater security," says Lou Mazzio, Post & Schell's chief technology officer.
Like Mazzio, other users who have deployed smart cards say that the technology helps improve security, reduce password administration and support costs, and enable single sign-on to multiple applications.
But the upfront cost of a smart card infrastructure, as well as interoperability problems and the hassles involved in integrating the technology with existing infrastructures, has resulted in far slower deployment of the technology in corporate America than many had once predicted.
"The corporate market has been a tough nut to crack," says Thierry Burgess, executive vice president of sales at Oberthur Card Systems USA, the U.S. arm of one of the largest smart card vendors in the world.
Like public-key infrastructure (PKI), smart card technology is taking many years to gain widespread acceptance in private commercial enterprises, says Trent Henry, an analyst at Burton Group in Midvale, Utah. But expect to see greater adoption over the next few years, he adds.
Smart cards allow companies to store passwords, personal identification numbers and other digital credentials that let users log onto corporate networks or access facilities such as buildings and parking lots.
In Post & Schell's case, user authentication information is stored on smart cards for network access using RSA Security Inc.'s Smart Badging system. Bedford, Mass.-based RSA is also helping the firm embed user credential information on the same cards. That information is needed for physical access to Post & Schell facilities.
More Features, More Savings
The two-factor authentication enabled by such cards allows for better network and physical security, says Charles Fletcher, CIO and provost at Delaware State University in Dover. Smart cards can also help reduce some of the traditional costs associated with password resets and management because the passwords are embedded directly on the cards, he says.
Generally, the cost benefits increase as more access functions are integrated on a card, Fletcher says.
Students and employees at the university have been using smart cards since last summer to log into Windows and Web-based applications, access dorm rooms and library facilities, and pay for meals in the cafeteria. In the future, the university plans to use the smart card infrastructure, which is based on HiPath SIcurity Card technology and the HiPath MetaDirectory software suite from Siemens AG in Munich, to enable access to e-commerce and payment applications, Fletcher says.
From a physical standpoint, the embedded read/write intelligence in such cards allows access to be quickly granted, revoked or modified from a central location, says Neville Pattison, director of smart card technologies at Paris-based Axalto, which was recently spun off as an independent company from oil field services giant Schlumberger Ltd.
Schlumberger is rolling out Axalto's DexaBadge smart card technology to its 80,000 employees worldwide. The cards are being used to digitally encrypt e-mail and sign electronic documents. Schlumberger is also using the cards to enable log-in to Windows applications and virtual private network services, Pattison says.
"The smart card is the little agent of trust in the hands of an employee," Pattison says. "On behalf of the issuer, it performs security-related operations and various other operations knowing the right cardholder is present."
However, several factors have contributed to the slow adoption of smart cards in corporations, Burton Group's Henry says.
Cost is a big one. The price tag for deploying the hardware, readers, middleware and software for a smart card system can be daunting. Midsize companies can easily expect to spend $200,000 to $300,000 to get started, and even pilots cost about $70,000, says Chris Meaney, director of secure networks at Siemens. On average, companies can expect to pay $20 to $30 per user, excluding the cost of the readers, card management and PKI software, according to Burton Group.
As a result, smart cards are unlikely to make a whole lot of sense for companies with fewer than 2,000 employees, Meaney says.
Companies also need to have a PKI in place to use the encryption, electronic signing and nonrepudiation functions that are enabled by smart cards, says Henry. "There definitely is some serious cost-benefit analysis that needs to be done before companies start deploying smart cards," he says.
Technology interoperability is another big challenge, says Mary Dixon, director of the U.S. Department of Defense's Common Access Card program office, which is rolling out more than 4 million smart cards to Pentagon personnel.
Smart card infrastructures require a high degree of interoperability and synchronization among the cards, readers, access-control panels and identity directories, and that interoperability is still not fully there, Dixon says. The cards themselves come with varying memory sizes, processing capacities, scalability, operational proximity ranges and application support. And applications that are enabled to work with one vendor's smart card technologies may not always seamlessly work with another vendor's products.
Because of the size and scope of its project, the DOD decided to contract out its work to multiple technology vendors to minimize the risk of technology lock-in, Dixon says. But to ensure that smart cards, middleware and readers from multiple vendors integrated seamlessly, the DOD worked with the National Institute of Standards and Technology to develop an interoperability specification that participating vendors had to adhere to.
However, because of integration issues, "if I was going to do a small implementation of a few thousand cards, I would be inclined to go with a single vendor's card and use it as much as I could," Dixon says.
Integration Challenges
Until recently, users have also needed to do considerable integration work to tie smart card management systems into PKI networks, says Oberthur Card's Burgess.
Companies also need to have a centralized directory infrastructure in place, says Meaney. And they need to have a good process for communicating changes in the core human resources database, which is often the source of identity information, he says. That information is needed to provision, revoke or modify cards when employees are hired, move to new departments or leave the company.
The recent trend toward so-called smart tokens that can plug into standard Universal Serial Bus ports on computers could also divert attention away from traditional smart cards. Herndon, Va.-based Exostar LLC, an online trading exchange created by companies such as The Boeing Co., Raytheon Co. and Lockheed Martin Corp., is using smart tokens from Aladdin Knowledge Systems Ltd. in Chicago. The tokens allow Exostar to store digital certificates and automatically fill in log-on fields, passwords and Web site shortcuts, as well as encrypt and decrypt files and e-mails, without requiring an investment in a special card reader, says Jeff Nigriny, Exostar's chief security officer.
But there are some factors coming together that could finally begin to spur broader corporate adoption, says Herb Mehlhorn, senior product manager for RSA's smart card business.
New-generation smart card technologies based on a set of Java standards promise more interoperability and functionality, Mehlhorn says.
Massive smart card deployments by federal agencies such as the Defense Department and the Department of Transportation have begun pushing technology costs lower, he says. And companies are coming under increasing regulatory and legal pressure to demonstrate due diligence when it comes to user authentication.
The embedded PKI certificate server support in Microsoft Corp.'s Windows Server 2003 could also begin to make it easier for users to snap smart cards into PKI networks, Henry says.
"I don't think there's anyone that refutes the likelihood that smart cards will be in every wallet 10 years from now," says Pete Lindstrom, an analyst at Spire Security LLC in Malvern, Pa. "It's how we get there that's going to be interesting."
Free Insider Guide