Managing an Individual OneSpan (VASCO) OTP Token

The VASCO OTP tokens properties page (Devices menu > VASCO OTP tokens > click a token Serial Number) shows information about a OneSpan (previously VASCO) OTP token.

CAUTION:

When configuring external OTP tokens that are allowed for e-prescribing controlled substances, you are required to attest that the OTP token server is FIPS-compliant and that OTP tokens are properly enrolled per DEA EPCS regulations. This action is logged in the Imprivata audit records. FIPS 140-2 Level 1 compliant tokens are required when used to e-prescribe controlled substances. See Configuring External OTP Tokens for more information.

NOTE: OneSpan OTP token users can be enabled for Offline Authentication through their security policies. See Allow Offline Authentication to EAM with VASCO OTP Tokens.

NOTE: The names OneSpan and VASCO may be used interchangeably in Imprivata documentation and in the Imprivata Admin Console interface.

Every OneSpan OTP token must have one of three statuses:

  • Available — Tokens are valid, licensed, and ready for use, but not yet assigned to any user. Available tokens cannot be used to authenticate to Enterprise Access Management.

  • Assigned to a user — Tokens are assigned to an authorized user. These tokens cannot be deleted from Enterprise Access Management until their status is changed to Available or Lost.

  • Lost — Tokens are no longer in the custody of an authorized person, and may be in the possession of an unauthorized person. This is a potential security breach, so tokens with Lost status are disabled. Lost tokens cannot be used to authenticate to Imprivata OneSign.

You can change the status of any token at any time, as described in the following "Assigning" sections.

To assign Available status to a VASCO OTP token:

  1. On the VASCO OTP tokens page, click the serial number of the VASCO OTP token to be assigned. The VASCO OTP token properties page opens.

  2. In the Assignment Status section, select Available.

  3. Click Save.

To assign Lost status to a VASCO OTP Token:

  1. On the VASCO OTP tokens page, click the serial number of the VASCO OTP token to be assigned. The VASCO OTP token properties page opens.

  2. In the Assignment Status section, select Lost.

  3. Click Save.

When a token is no longer in the custody of an authorized person, then it may be in the possession of an unauthorized person. This is a potential security breach, so tokens with Lost status are disabled.

  • NOTE: Providers who are identity proofed by Norton Secure Login cannot be assigned VASCO OTP tokens or use VASCO OTP tokens to e-prescribe controlled substances.

    • To assign an available VASCO OTP token to a user:

    1. On the VASCO OTP tokens page, click the serial number of the VASCO OTP token to be assigned. The VASCO OTP token properties page opens.
    2. In the Assignment Status section, select Assigned to.
    3. Enter the username and domain information of the user.
    4. Click Save.

      5. NOTE: If you assign a second token to a user, the first token is automatically unassigned.

    Some VASCO OTP tokens support a static PIN feature. A static PIN is a personal code of preset length that is used in conjunction with the VASCO OTP token passcode to permit higher security.

    Because the VASCO OTP token passcode is dynamic (so it cannot be memorized) and the user’s PIN is static but (under normal circumstances) is never written down, a VASCO OTP token that comes into the hands of an unauthorized user cannot be used to authenticate to your network. In the same way, an intruder who learns a user’s static PIN cannot access the network without having the physical token as well.

    If the VASCO OTP token supports the VACMAN static PIN feature, then there are three conditions that come pre-configured on the token:

    • User may never change static PIN — Forbidding the user from changing the PIN ensures the PIN is always known to the Administrator.

    • This is more a matter of policy than of usability. There is a separate reset function for use when a user changes the PIN and then forgets it or if a token is reassigned. See Resetting and Changing a Static PIN.

    • These settings are determined by the DPX file contents set by the manufacturer based on parameters chosen by the VASCO OTP token purchaser.

    • User must change PIN immediately and may change later — VASCO OTP tokens on which the user is required to change the PIN ensures the PIN is known only to the user. The Administrator cannot know the PIN after it has been changed.

    • If a user changes the PIN and then forgets it, or if a token is reassigned, see Resetting and Changing a Static PIN.

    • User may change PIN at any time — VASCO OTP tokens on which the user is permitted but never required to change the PIN makes it possible for the PIN to be known to both the user and to the Administrator only until the user changes the PIN. Users are more likely to remember PINs they set themselves.

    • If a user changes the PIN and then forgets it, or if a token is reassigned, see Resetting and Changing a Static PIN.

    These settings have different security values, so it is important to understand which configurations best suit your users.

    There is an additional tool for the Administrator, as described in the following section.

    If a user changes the static PIN and then forgets it, or if a token is reassigned, you can reset the PIN to nothing at all, a string value of zero length. Not all VASCO OTP tokens support the static PIN feature.

  • When the PIN has been reset in this manner, the Administrator can assign a new PIN by entering and confirming it in the Change Static PIN fields.

    • Changing a Static PIN

    To change the static PIN:

    1. Open the token record and scroll down to the Static PIN section.
    2. Enter the new PIN in the New PIN: field. Confirm the new PIN in the Confirm PIN: field. There is no need to enter the old PIN.

      3. NOTE: Do not click the Reset PIN button.

    3. Click Change PIN.

    Users Changing the Static PIN

    Users can change a PIN in the Imprivata ID token login screen in the PIN + Passcode field: enter the old PIN, the passcode, and the new PIN in the following format, with no spaces: OldPINpasscodeNewPINNewPIN

    If the old PIN was reset (now is of zero length), then enter only: PasscodeNewPINNewPIN

    Virtual tokens are useful when an authorized user forgets or loses a VASCO OTP token and needs access to the network.

    NOTE: Not all VASCO OTP tokens support the Virtual Token feature. The Virtual Token feature comes programmed into the token; you cannot assign the Virtual Token feature from Enterprise Access Management.

    To create a one-time password:

    1. Open the token record and scroll down to the Virtual Token section.
    2. Click Generate to create a new one-time password. The One-Time Password appears to the right of the button. The one-time password can be used just like the passcode generated by the VASCO OTP token.

      3. NOTE: Do NOT test the new one-time password in the Test One-Time Password field. The Test One-Time Password field is for troubleshooting tokens.

    At the bottom of the VASCO OTP token record is a token-sensitive set of other operations. Not all of these operations will display; their availability depends upon whether the token supports them:

    When you reassign a token to another user, it is a good idea to test the token first. You cam test the token by using it to authenticate against the Test One-Time Password field. There are two types of one-time password functions, depending on the type of token you are testing:

    The token type is listed on the token information section of the token record.

    Testing a Response-Only VASCO OTP Token

    It is a good practice to test a VASCO OTP token before assigning it to a user. To test a response-only VASCO OTP token:

    1. Open the token record for the VASCO OTP token to be tested.

    2. In the Test One-Time Password field, enter the token PIN and a passcode generated by the token.

    3. Click Test. A message indicating that the test was successful is displayed.

    Testing a Challenge-Response VASCO OTP Token

    It is a good practice to test a VASCO OTP token before assigning it to a user.

    To test a challenge-response VASCO OTP token:

    1. Open the token record for the VASCO OTP token to be tested.

    2. In the Test One-Time Password line, click Generate Challenge Code. A challenge code is displayed.

    3. Using the VASCO OTP token keypad, enter the challenge code into the VASCO OTP token. The VASCO OTP token generates a one-time password.

    4. Enter the one-time password from the VASCO OTP token in the test field.

    5. Click Test.

    Each VASCO OTP token maintains an internal error counter designed to disable it if it has been misused. Sometimes a VASCO OTP token can become disabled through ordinary usage under extraordinary circumstances when the error count gets too high.

    • To reset a disabled VASCO OTP token, push the Reset Token button. The error counters are immediately reset to zero.
    • If resetting the token error counters does not make the token serviceable again, then assign the user a new token.

    Resetting the token error counters has no effect on the static PIN. To reset the token static PIN, see Resetting and Changing a Static PIN.

    If a user locks a VASCO OTP token by repeatedly entering the wrong PIN into the token, you can generate a PIN that the user can use to unlock it. This operation can be handled over the telephone.

    To unlock a locked VASCO OTP token:

    1. The token says LOCK and shows a passcode. Enter the passcode in the Unlock Token field.
    2. Click Generate Unlock PIN. A new PIN is displayed.
    3. Enter the new unlock PIN in the token. This unlocks the VASCO OTP token for normal use. The VASCO OTP token returns to normal functionality.

    You can generate a report that shows VASCO OTP token activity for this token for a period of time that you set before running the report.

    Click View Token Report at the top right of the VASCO OTP tokens properties page; you are brought to an Add New Report page where you can name the report (if you plan to save it), and specify a date range.

    See Using Reporting Tools.