How to choose packaged security products?
There is no doubt that it is mainly the CISO who is responsible for defining the criteria and requirements for the security products and solutions, whether they are delivered externally or internally, developed within the organization.
If the products are "packaged" (OTC, Over-the-Counter) it does not mean we should accept things "as they are".
So how to go about this, correctly?
With OTC products, we often don't have many options to influence their security features, but it is always necessary to objectively compare and verify manufacturers' claims.
When selecting such products, beside costs per seat/year/etc. we assess topics such as access control, authorization, secure password storage, data encryption, journaling, etc., depending on what security attributes we are interested in.
The main thing is to compare apples to apples, not apples to oranges. We always ask and verify the same questions for all products under review.
See also ISO/IEC 27036, ISO/IEC TR 6114:2023.
Probably the best way to see what we mean is to provide an example.
Selecting an online service to reset users passwords
| atribute | importance (1-5) | LogonBox Enterprise | ManageEngine ADSelfService Plus, AD360 | N-able Passportal / Blink |
|---|---|---|---|---|
| price (400 users/year/EUR) subscription | 2 | 1760 | 1195 | 5448+3000 |
| price (400 users/EUR) perpetual | 3 | 4400 | 3900 | - |
| enrollment process | yes | no | yes | ? |
| pre-enrollment capabilities | 2 | yes | ||
| automated enrollment | 2 | yes | ||
| manual enrollment | 2 | yes | ||
| enrollment reminders | 1 | yes | ||
| easy and bulletproof enrollment process | 1 | ? | ? | ? |
| reset from the web-browser | 1 | yes | yes | yes |
| reset from mobile app (via QR) | 1 | yes | yes | |
| offline reset (Windows desktop/local logon integration) | 2 | yes | yes? | yes |
| possibility to manage password for local accounts? | ||||
| user directory integration | ||||
| integration with Active Directory | 1 | yes | yes | yes |
| support for multiple directories besides AD (OpenLDAP, Linux, SQL db) | 4 | yes | ||
| enforcing password policy for accounts | 1 | yes | yes | yes |
| account activity including logons (not only changes) | 2 | yes | yes | yes |
| identity verification (authentication) | ||||
| security questions | 4 | yes | ||
| second factor? | 1 | yes | yes | yes |
| DUO | 1 | yes | yes | ? |
| GA | 2 | |||
| Yubi | 3 | yes | ||
| SMS tokens | 2 | yes | ||
| TOTP | 3 | |||
| push | 2 | |||
| QR-code-based | 2 | yes | ||
| MS Auth | 3 | |||
| own 2FA (only) | 4 | |||
| dynamic authentication - require stricter or less strict authentication based on a context | no | yes | ||
| biometric verification prior to initiating a password reset request | no? | yes | ||
| device verification prior to initiation a password reset request | no | yes | ||
| image based authentication | no | no | yes | |
| location of user data (enrollment data, user profile, passwords) | ||||
| credentials are not stored in SSPR | 1 | ? | no | ? (password vault only?) |
| on-premise | 1 | yes | yes | yes |
| cloud | 3 | yes | yes | yes |
| user interface in cloud, all data inside | 1 | yes? | yes | yes |
| sec/admin overview | ||||
| overall activities in SSPR (who did what when) | ||||
| locked accounts, coming passwords expiry, sessions and users, password reset by admin vs by users | 1 | yes | yes | yes |
| automatic alerting | 1 | yes | yes | yes |
| mail notification about any access to end-user and to admins | 1 | yes | yes | yes |
| automation of admin tasks | 1 | yes | yes | yes |
| webhooks - send real-time data from one application to another whenever a given event occurs, in H&P? perhaps sending data to Jira? like a relatively weak password was created...? | ||||
| message templates | 1 | yes | yes | yes |
| added value | ||||
| full site customization (even if in cloud) | 1 | yes | ||
| identity services - SAML support | 1 | yes | ||
| password management for end-users? | 3 | ? | yes | yes |
| desktop integration for Windows 11 only - so that credentials are entered automatically? | 2 | yes | yes | |
| HelpDesk action (verification of the user and the action); or HelpDesk is able to intervene if needed | 1 | |||
| reset possible via mobile phone app (both iOS and Android) | 2 | yes | ||
| when locked out - immediate push notification (phone app) | yes | |||
| SIEM integration | 2 | |||
| AD attribute maintenance | 2 | |||
| password vault | 3 | yes | no | |
| added value - complementary products of the same vendor | ||||
| AD management including GPOs | 2 | no | yes | |
| AD auditing | 2 | no | yes | |
| LogonBox VPN | 5 | yes | - |