Microsoft, RSA Team on Windows User Authentication

Specifically, Microsoft said it will use RSA's SecurID technology to offer an alternative to traditional password-based access control. SecurID uses authentication tokens in addition to a personal identification number (PIN).

The keychain-size tokens generate new, random digital passwords every 60 seconds that only work when the PIN number is also provided by the user.

Two Heads

This so-called two-factor authentication eliminates the need to constantly change user passwords and reduces the risk that unauthorized users will access a network. Unlike other options, however -- such as biometrics or other smart-card solutions -- the RSA option does not require that additional hardware be added to the network.

Art Coviello, RSA's CEO, called the solution a "smart, simple alternative to static passwords" that will help enterprises avoid "expensive and damaging security breaches."

"Customers have told us they want strong, integrated authentication technology," Microsoft security chief Michael Nash said.

Slow Going

The security industry has long tried to encourage enterprises to adopt more vigorous forms of identification and access control. Employees often choose easy-to-remember -- and therefore easy to decipher -- passwords, and passwords used for long periods of time can be stolen by hackers simply by tracking a user's keystrokes.

Despite the shortcomings of traditional passwords, hardware-based solutions such as smart-card readers have been slow to catch on, in part because of their added expense and in part because there is no single standard that would make smart cards universal, Gartner (NYSE: IT) research director Mark Nicolett told the E-Commerce Times.

"Card or token readers are still viewed as too costly and too risky an option by most enterprises," Nicolett said.

While the RSA solution cannot do as much as a smart card, which can contain a host of information about a user, including limitations on how he or she can use certain information, it may catch on because of its ease of implementation. "Anything that doesn't require ripping up the network or adding hardware that may or may not be the standard in five years is going to get a long look," Nicolett added.

Window to the World

Not surprisingly, making Microsoft deployments more secure is a key theme at the RSA confab. IDC analyst Allan Carey said while the improvement over passwords addresses only one of the many types of security concerns surrounding Windows installations, it may signal to Windows customers that Microsoft is serious about making it secure on all fronts.

"Anything Microsoft can be seen doing to make its products safer is going to be a positive in the minds of customers," especially those who may be considering alternatives such as Linux, Carey told the E-Commerce Times.

Also on Tuesday, Sun Microsystems (Nasdaq: JAVA) announced plans to roll out an identity-management solution for Windows and other Microsoft environments.

Sun said its Identity Manager, based on technology it acquired from Waveset Lighthouse, will enable centralized management of user identities across all different applications used in an enterprise.

Gates on Security

Both announcements came just ahead of a much-anticipated keynote speech by Microsoft chairman Bill Gates at the RSA conference. Gates used that keynote to highlight the various fronts on which Microsoft is working on the security problem, citing a laundry list of industry partnerships and technology efforts.

Gates also demonstrated a number of security features that Microsoft is including in its Windows XP service pack, including the built-in firewall and enhancements built into the Internet Explorer browser.