Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 1 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

Fact Sheet

RSA SecurID Tokens

Topics in this Fact Sheet What is an RSA SecurID Token? Is a SecurID token the same as a virtual private network (VPN)? What computer systems need a SecurID token? Can I use my SecurID token with any computer application? Can I use my SecurID token with more than one application? Who provides SecurID tokens? How do I get a SecurID token? Software Token Prerequisites How do I use my SecurID token? My SecurID token is expiring soon ~ what do I do? I don’t need my SecurID token anymore ~ what do I do with it? Tool Tips for Soft Tokens How to log into AHS Identity & Access Management (AHS IAM) remotely

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 2 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

What is an RSA SecurID Token? RSA is a company that provides security solutions for digital risk. SecurID tokens provide a user-specific code to be used with a user’s unique access credentials. Together, they comprise two-factor authentication: the secure login of an individual user to a system.

The SecurID token can be a hardware device that looks similar to this or a software

application that runs on your smartphone with an icon similar to this .

Back to top

Is a SecurID token the same as a virtual private network (VPN)? No. If you work on an AHS computer and need to set up remote access through a Virtual Private Network (VPN), refer to the AHS Remote Access (VPN) Insite page https://insite.albertahealthservices.ca/it/page5585.aspx and follow their access request processes.

Back to top

What computer systems need a SecurID token? Clinical applications that AHS provides remote access to require two-factor authentication with a SecurID token. Example: Alberta Netcare Portal (ANP). The AHS Identity & Access Management (AHS IAM) system also requires a SecurID token when accessed outside an AHS facility.

Back to top

Can I use my SecurID token with any computer application? No. SecurID tokens issued by AHS Information Technology are only useful with computer applications that AHS provides access to.

Back to top

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 3 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

Can I use my SecurID token with more than one application? Yes, you can use your SecurID token with more than one application. You do not need a separate token for each application you use. Example: Let’s say you already have remote access to Alberta Netcare Portal and you want remote access to Epic (Connect Care). When you are filling out your AHS IAM application for Epic (Connect Care) access, ask for remote access, indicate you already have a token and provide the requested details. This is how AHS IAM connects your Epic (Connect Care) access account to your SecurID token account so they work together. Going forward you can use the same SecurID token to access both Alberta Netcare Portal and Epic (Connect Care) when you are working outside an AHS site.

Back to top

Who provides SecurID tokens? AHS Information Technology (IT), Remote Access team provides both hard and software SecurID tokens. They provide them to staff of Alberta Health Services, AHS Affiliates, as well as Physicians, Pharmacists, Chiropractors and many other end-users who access AHS clinical and business applications.

Back to top

How do I get a SecurID token? There is more than one way to get a SecurID token. You can request a SecurID token in the AHS Identity & Access Management (AHS IAM) application: https://iam.ahs.ca Follow the Remote User Network Access (RUNA) process. For support, the RUNA User Guide is posted on the AHS IAM Support Page. You can also request remote access with almost any application that AHS IAM provides access to. For example, if you want remote access to Alberta Netcare Portal, login to AHS IAM, follow the Alberta Netcare access process and select the remote access checkbox. For support, the ANP User Guide is posted on the AHS IAM Support Page.

Back to top

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 4 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

Software Token Prerequisites The following are the prerequisites for requesting a software token. Your device must be supported

• Apple (iOS) Devices – iPhone / iPad or iPod Touch • Android Devices – this is an operating system across many manufacturers of different

smart phones. For example Samsung, Sony, and Google. Your device must meet minimum technical specifications / requirements.

These are specified on the RSA SecurID website: http://canada.emc.com/security/rsa-securid/rsa-securid-software-tokens.htm#!offerings_for_mobile_devices. In general, the device must be able to run the latest version of the respective RSA Software Token application.

User Requirements • There cannot be any organizational / departmental restrictions regarding the use of mobile

devices. • You must have received the appropriate approval to have remote access with a SecurID

token. • Your must have a valid email address that can be accessed on the device. • You must have the ability / access to install the software token application on the device. • During the activation process you must have an internet connection and access to a

separate device to access the activation website (e.g. a computer). Security Requirements

• One token per user; each user must choose between using a hardware token or software token. You can have your software token installed on more than on device.

• The device (smartphone) the software token is installed on must be password / PIN-protected and be regularly maintained with the latest security patches.

• Only install the RSA SecurID App from a trusted source (the official application store or marketplace) and keep the software updated.

• Never share the token information (e.g. PIN, passcode) with anyone.

Back to top

How do I use my SecurID token? When you are issued either type of SecurID token you will be required to create a 4 digit personal identification number (PIN). The token generates a number that changes every 60 seconds. Use your PIN and the digits displayed at the time of login to authenticate your identity. LAUNCH the desired application as you usually do.

The AHS network will automatically detect if you are inside or outside the network firewall. If you are inside the firewall or are working through a Virtual Private Network [like Netmotion] you will not need to use your SecurID token.

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 5 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

If you are outside the firewall, you will be automatically presented with a different login page. For example, you might see a Citrix login page that looks like this.

If you have a hard token ENTER your user name ENTER your 4-digit Personal Identification Number (PIN) provided when you got your token followed by the 6 digits that appear on your SecurID token – you will be entering 10 digits in total CONFIRM your login If your information is valid, you will be presented with the usual login page for the application you launched. Login to it as usual. If you have a software token On your computer, ENTER your username

On your smart device, TAP the RSA app icon The Enter PIN screen appears

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 6 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

On your smart device, ENTER your 4-digit Personal Identification Number (PIN) provided when you got your token On your smart device, TAP the blue arrow button

The token code screen appears with an 8-digit passcode displayed. This number changes every 60 seconds.

On your computer, ENTER only the 8-digit passcode – 8 digits in total (don’t enter your PIN as well) CONFIRM your login If your information is valid, you will be presented with the usual login page for the application you launched. Login to it as usual.

For more information, see Tool Tips for Soft Tokens

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 7 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

My SecurID token is expiring soon ~ what do I do? Once a hardware or software token has expired it can no longer be used. The AHS IT Remote Access team keeps track of expiry dates and will provide you with a new hardware or software token before the current one expires. If your address has changed, or you’re worried you won’t get a replacement in time, call the AHS IT Service Desk and log a ticket for AHS IT Remote Access. Hardware Token You can discover the expiry date of your hardware SecurID token by looking on the back. A replacement token will be mailed to you automatically. Software Token You can discover the expiry date of your software token by looking in the token code information. See Discover Token Code Information for help finding it.

Back to top

I don’t need my SecurID token anymore ~ what do I do with it? If your hard SecurID token hasn’t expired, please return it in a padded or bubble envelope to protect it during mail processing. Mail that envelope to:

AHS IT Remote Access CN Tower, 18th Floor 10004 - 104 Avenue, NW Edmonton, Alberta T5J 0K1

If your hard SecurID token has or is about to expire, please bring it to your local eco-station if available in your area. If not, dispose of the hard token in the garbage. If you have a soft SecurID token, simply delete / uninstall the app from your Smartphone or device as usual. If you have it on more than one device, delete / uninstall it from all devices.

Back to top

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 8 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

Tool Tips for Soft Tokens The tool tips on the following pages are provided to give you more information about software SecurID tokens. A software SecurID token is an application that runs on your Smartphone, or device e.g. iPad. You can have it installed on more than one device. These tool tips explain common functions only. Additional help is available within the software token application or by contacting your local AHS IT Service Desk.

Generate a passcode

TAP the RSA app icon The Enter PIN screen appears

TAP ? for help text (not shown) ENTER your 4-digit PIN TAP the blue arrow button

The Token code screen appears with an 8-digit passcode displayed. This number changes every 60 seconds.

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 9 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

To advance to the next passcode TAP >

A different 8-digit passcode will display To copy and paste the passcode to an application on your device TAP PASTE the code into the target application’s Passcode field

See a list of soft tokens and settings At the Token code screen

TAP

The My Tokens screen appears TAP ? for help text (not shown) TAP

A menu displays. EXECUTE an action or CANCEL

TAP Edit to delete a token

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 10 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

TAP + to Scan QR Code or Enter LInk TAP Done to return to the Enter PIN screen

Discover soft token Information

At the Token code screen, TAP

The Information screen for that token appears with application and token information displayed, including: Version, Serial Number, Expiration Date, etc.

TAP ? for help text (not shown) TAP Done to return to the Enter PIN screen

Back to top

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 11 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

How to log into AHS IAM Remotely ENTER the AHS IAM URL into your internet web browser https://iam.ahs.ca

The AHS Citrix Gateway login screen appears

ENTER your User name

Tool Tip – this is your AHS Network UserId or your AHS IAM Username ENTER your Passcode

If a hard SecurID token, enter your 4-digit PIN followed by the 6 numbers displayed on the SecurID token into the Passcode field If a soft SecurID token, enter the 8 numbers displayed in the app window

If needed, see Tool Tips for Soft Tokens on the next page

CLICK Logon The AHS IAM Login screen appears

Identity Services AHS Identity & Access Management Fact Sheet – RSA SecurID Tokens

Version June 2020 Page 12 of 12 Screen shot data are fictitious. Also, AHS IAM is updated regularly for performance and usability. If you notice differences between AHS IAM and the screen shots shown, trust AHS IAM. We may not have updated this guide at the same time.

ENTER your Username and Password CLICK Log in

The AHS IAM Home screen appears

Back to top

end