Entrust IdentityGuard for Enterprise

Growing threats from data theft, ransomware, and other cybercrime make effective authentication a critical control within identity and access management (IAM). IAM spans the full lifecycle of vetting individuals, issuing credentials, authenticating and authorizing access, and monitoring activity; among these, authentication needs particular attention because weak methods still dominate. Authentication commonly relies on “something you know,” “something you have,” and “something you are,” while mutual authentication adds confidence for users that the system itself is genuine, often leveraging PKI and X.509 certificates. As users and transactions become more mobile, single static authentication approaches—especially usernames and passwords—provide only low assurance and are easily compromised, driving demand for multi-factor and adaptive authentication that adjusts controls based on contextual risk (e.g., location, time, device).

Entrust Datacard’s IdentityGuard for Enterprise is positioned as a consolidated authentication platform spanning physical, logical, cloud, and mobile environments. It supports certificate-based authentication, smartcards and mobile smart credentials, biometrics, OTP tokens (including QR/challenge-response variants), grid cards, TAN lists, knowledge-based questions, out-of-band methods (SMS/email/voice and push with “Confirm/Deny/Concern”), and mutual authentication options such as image/message replay and EV SSL indicators. Adaptive capabilities include device and IP geo-location registration, device profiling, device reputation scoring against a repository exceeding 2 billion devices, and a risk analytics engine evaluating up to 50 risk data points with configurable weighting and behavioural profiling, plus integration with external fraud/analytics and cyber threat intelligence sources.

Strengths include broad authenticator coverage, lifecycle credential management from a single administrative point, federation/WAM integration (e.g., SAML, RADIUS, Kerberos), and SIEM export via syslog. Challenges include no built-in directory, lack of inbuilt user and entity behaviour analytics, limited out-of-the-box service request management integration, and some solutions being tailored heavily toward banking/finance. Support for FIDO authentication is planned.

• Authentication methods are grouped into something you know, something you have, and something you are.
• Mutual authentication can use an exchange of a random number encrypted with public and private keys and is inherent with PKI and X.509 certificates.
• Many modern mobile devices include a Trusted Execution Environment (TEE) that can store encryption keys securely.
• NIST SP800-63B defines levels of assurance provided by different forms of authentication.
• Identity federation for partner/supplier access is achieved using standards such as SAML 2.0 and ADFS.
• OAuth is an open standard for access delegation that allows users to grant access without revealing passwords.
• Entrust Datacard was founded in 1969 and is headquartered in Minneapolis, Minnesota, USA.
• Entrust was acquired by the Datacard Group in 2014 and continues under the Entrust Datacard brand.
• The device reputation capability matches encrypted device profiles against a repository of over 2 billion devices.
• The risk analytics engine can evaluate up to 50 different risk-related data points.

• “One critical area that needs to be addressed is that of how individuals and devices are identified; this is known as authentication.”
• “Mutual authentication extends the authentication process to provide confidence to the user that the system they are attempting to access is genuine to avoid their credentials being revealed to fraudulent or spoofed sites.”
• “MFA (Multi-Factor Authentication) increases assurance combining two or more methods.”
• “Adaptive authentication takes account of additional factors based on the risk of the particular transaction to add a further level of assurance.”
• “In today’s world where users are highly mobile and transactions are conducted on the move from a variety of locations, it is no longer appropriate to use a single authentication method based on a fixed view of risk.”
• “User names and passwords provide only the lowest level of assurance in the identity of the user.”
• “Providing individuals with multiple different authentication methods and devices for use under different circumstances can increase assurance but poses management and usability challenges.”
• “Entrust IdentityGuard offers a wide of authenticators from a single software platform.”
• “Entrust IdentityGuard provides a well-rounded adaptive authentication feature set.”
• “Its support for a wide range of authentication mechanisms, an advanced risk engine, and the inclusion of cyber threat intelligence put IdentityGuard on the short list for organizations looking for adaptive authentication capabilities.”