SafeWord® for Check Point Product Bulletin

SafeWord for Check Point follows Microsoft's best practices in the Active Directory schema

Download the product bulletin - 90 KB, 2 pages

SafeWord® for Check Point adds strong authentication to your Check Point VPNs, positively identifying users who access your applications and resources through Check Point. SafeWord for Check Point delivers security through one-time passcode-generating hardware tokens. Only the SafeWord server knows which passcode will allow the user to gain access. This eliminates threats from outsiders stealing, copying, or reusing passwords.

In addition to being OPSEC-certified and featuring tight integration with the Check Point user management interface, SafeWord for Check Point can be managed directly from Microsoft Active Directory, allowing administrators to easily manage tokens and users.

Schema extension recommendations
Some network administrators and IT staff members have expressed reluctance to install applications that extend the Active Directory schema, as evidenced in several online discussion groups. While the Microsoft knowledge base suggests using caution when making changes to the Active Directory schema, Microsoft expressly decrees that extending the AD schema is, in fact, encouraged to extend the Active Directory definition (when done following Microsoft recommendations).

Microsoft recommends only using schema extensions that follow recommended "best practices." SafeWord for Check Point follows the Microsoft best practices list. The list, found at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnactdir/html/adschemaext.asp, includes the following guidelines for extending the schema.

Best practices include:

• The schema is neither a database nor a file system. Don't treat it as such.
• Place references in the directory that point to other data stores instead of using the directory for something for which it was not designed.
• Only define globally interesting, relatively static information in the schema.
• Objects defined in the schema should not be created very often or modified frequently.
• Objects should have a long life.
• Use twice the maximum replication frequency when determining longevity or frequency.
• Test the application in a private forest and with other applications before deploying.
• The schema upgrade must be separate from the application installation.