How a German Federal Institute
secured its workforce
A German Federal Institute, which forms part of a collection of federal agencies consulting the German national government, recognised the need to evolve its workforce authentication. The organisation had identified its password-based approach as a low security solution that was delivering a poor user experience for its employees. A strong multi-factor authentication solution was required.
The deployment in numbers
German Federal Agency: strong passwordless authentication with MyID and CRYPTAS
Passwords remain one of the weakest points in any organisation's security, and for a German federal institute advising the national government, that weakness carried real risk. Its employees signed in to government systems with usernames and passwords, an approach the agency itself judged low on security and poor on everyday experience. Wanting to strengthen how staff access sensitive systems, the agency set out to move to strong two-factor authentication built on the cryptographic security of public key infrastructure (PKI), using smart cards as a familiar, proven form factor.
The requirements were specific: an on-premise system that fitted the agency's existing Windows Server network and Microsoft PKI, integrated with Active Directory, let employees self-serve when a card was blocked, and was installed on-site by a German-speaking team with no reliance on cloud services. This case study shows how MyID® credential management software from Intercede, delivered with partner CRYPTAS and TicTok smart cards, met those requirements and gave the agency a simpler, stronger way for its people to log in.
With login and passwords still in use, the agency recognised that there was a need to step up the organisation's security
The agency recognised that there was a need to provide a better system for its IT teams and employees.
Strong two-factor authentication using PKI
as proven technology that is simple to use and familiar to employees, smart cards was the chosen form factor for the 2FA to be based on.
On-premise deployment
the federal agency was looking for an on-premise solution that would sit within their existing Windows Server network and enable their IT teams to issue digital identities to their employees' smart cards and set user policies.
Microsoft integration
a software solution that would integrate with the internal Microsoft PKI certificate authority (CA) was essential, as was integration with Microsoft Active Directory.
Self-service
scope for employees to self-serve when reactivating a blocked smart card or setting a new smart card up for use.
Delivered on-premise by CRYPTAS
CRYPTAS Deutschland GmbH was chosen to deliver the strong two-factor authentication solution, combining TicTok smart cards with Intercede’s MyID for issuing and managing digital identities.
On-premise install
MyID was installed on-premise by CRYPTAS to the existing Windows Server 2019, providing a fully functional CMS without requirements for permanent internet connectivity.
IT-Grundschutz compliant
complied to within the agency's IT network using Microsoft AppLocker service.
Active Directory integration
administration of all computers and user accounts takes place in a Windows domain. The configuration of MyID ensures AD information is usable within the credential management system, accessed via LDAPS.
Self-service for employees
agency employees can reactivate their smart card should it become blocked, update existing smart cards, and only see features within MyID they are able to use.
Stronger login, lighter IT load
The agency moved its workforce from passwords to smart card and PIN two-factor authentication, delivered on-premise by CRYPTAS on the agency’s existing Windows Server, with employees now able to self-serve blocked or new cards.
Improved usability
Employees no longer have extensive passwords to remember and update and are able to login simply with their TicTok smart card and a PIN.
Future-proofed identity solution
The proven integration between MyID and TicTok smart cards ensures the federal agency has a solution that can grow in line with their requirements. The additional flexibility of MyID to issue and manage credentials to virtual smart card technology, USB security keys, and mobile devices means that the agency has a futureproof identity management solution.
Easy deployment
The expertise and experience of the CRYPTAS team ensured the deployment was simple and without hidden complexities and costs. The end-to-end approach offered by CRYPTAS kept things simple and ensured everything from hardware, software, installation and support was managed in line with the agency’s requirements, timescales and budget.
Smooth integration
The flexibility of MyID to integrate with the agency’s existing IT infrastructure, together with onsite installation by CRYPTAS, ensured a smooth transition to the new deployment.
The platform behind the deployment
Intercede is a cybersecurity software company and the digital identity experts. For over 25 years, Intercede has helped government agencies, defence programmes, financial institutions and enterprises deploy phishing-resistant digital identities at scale.
The MyID product family, MyID CMS, MyID MFA and MyID PSM, manages millions of credentials across more than 20 countries. Vendor-neutral architecture means MyID integrates with virtually any certificate authority, hardware security module or smart card manufacturer, without organisations replacing existing infrastructure.