UserLock Anywhere

Multi-Factor Authentication to Secure Remote Working

With UserLock Anywhere, admins can go one step further to protect remote connections without a secure VPN. A micro agent on the remote machine communicates with the on-premise UserLock service via the internet to enforce MFA and access security policies.

Key Features

Multi-Factor Authentication to Secure Remote Working

UserLock can alleviate some of these challenges of MFA enforcement by requiring MFA to be prompted and monitored with the on-premise Active Directory (AD).

Supported by authenticator applications such as Google Authenticator, Microsoft Authenticator and LastPass Authenticator, as well as configurable hardware tokens like YubiKey and Token2.

When enabling MFA, system administrators can prompt authentication requirements determined by connection type, device, and session, as well as the option to set interval stipulations for the frequency that MFA is activated for a user. System administrators can then view the log of MFA events to evaluate successful logins, failed authentications, cancelled attempts, or MFA events where help is needed.

Enforce MFA Authentication to Secure Users without Domain Access
In the absence of a secure network connection, the agent on the remote machine communicates over the Internet with the UserLock service (running on-premise). This way access to the remote computer is still protected with MFA without first requiring a VPN connection.

Management of Access Controls to Secure Remote Working

Acting as a gatekeeper for determining who can and cannot access a system based on detailed contextual factors can help with labor compliance requirements and securing a remote working environment.

UserLock can perform access management control from Windows AD with contextual restrictions based on the origin (location, IP address, or department), time of access, session type (RDP, VPN, IIS), and whether multiple sessions are being attempted at once.

Here are a few common scenarios for using UserLock to control system access:

Controlling employee working hours
If an organization resides in an area where labor compliance requirements limit the hours worked by an employee, UserLock can be used to control login times and session durations as well as document the hours worked.

Securing access after a device is stolen or lost
If it is confirmed that a company-issued device (phone or laptop) was stolen, UserLock can deny access to that device by restricting its IP address to any remote system.

Managing access based on operational shifts
If an organization has clear and defined working shifts, UserLock can be configured to automatically restrict employee access once their shift has ended and allow access to employees just starting their shift.

Denying access to compromised credentials
If it was established that an employee negligently submitted their login credentials to a credentials-harvesting phishing scam, UserLock can deny that users’ access until the credentials compromise has been alleviated.

Enforce Contextual Access Controls to Secure Users without Domain Access
Once again in the absence of a secure network connection, ‘offline domain’ access for remote users can still be managed with these contextual restrictions. UserLock Anywhere will enforce login restrictions to refuse connections and in addition force remote sessions to lock or log off, ensuring that policies relating to working hours, time quotas or operational shifts are still respected.

Monitor User Activity to Secure Remote Working

UserLock centralizes user monitoring with displays of activity information about session status, type, and quantity of sessions. System administrators can also view user information from AD, such as their display name, department/organizational unit, and device information.

Enforcement of Organizational Remote Policies to Secure Remote Working

With some of the access control and monitoring features of UserLock, system administrators can guide end-users, both employees and contractors, to make sure that organizational policies are being followed through activity restrictions and notifications.

Least Privileged Policy
If an organization follows the principle of least privilege where employees should only have access to data and systems pertinent to their job function, UserLock can utilize its reporting and audit features to evaluate the permission rights along with authorized privileges for each user.

Bring Your Own Device (BYOD) Policy
If an organization has rules about sessions or applications that can be accessed through a personal device, UserLock’s access control management features can restrict certain access based on ranges in an IP address.

Incident Response Procedures
If an organization has a formal incident response plan for handling cyber incidents that includes notification of proper personnel and isolating a potential incident as much as possible, UserLock can help streamline these steps by automatically alerting system administrators of suspicious activity and allowing them to immediately block that suspicious user.