An on-site system that controls who can sign in to your network and applications, with multi-factor login and single sign-on.
It’s an on-site appliance or VM that connects to Active Directory or LDAP. It provides RADIUS, SAML single sign-on, certificates, and multi-factor login, and tells FortiGate who’s logged in.
Accountability depends on identity. Individual accounts mean staff and, where used, inmates can be tied to their network activity. Firewall logs then show a name rather than only a device address.
- Ties network activity to individual accounts.
- Adds multi-factor login for staff.
- Shuts off access in one place when someone leaves.
- Identity to firewall: sign-ins are passed to FortiGate, so policies and logs use user and group names, including separate groups for inmate programs.
- RADIUS and SAML bring MFA to VPNs, Wi-Fi and web apps.
- User identity feeds firewall policies.
- Certificate management for 802.1X device authentication.
- Stays on-site when required.
| Control | Priority | How this helps |
|---|---|---|
| IA-2Identification and Authentication (Organizational Users) | P1 | Delivers multi-factor authentication for privileged and non-privileged accounts. |
| IA-5Authenticator Management | P1 | Manages authenticators. |
| AC-2Account Management | P1 | Centralizes accounts. |
| AC-7Unsuccessful Logon Attempts | P3* | Lockout rules can be set to the CJIS limit of 5 failed attempts in 15 minutes, administrator release. |
Based on CJIS Security Policy v6.1. This product can support these controls but can’t satisfy them alone. How to read this table