Identity theft is a significant problem for consumers and businesses alike, but it is stimulating an authentic profit opportunity for VARs. Here are some facts you may not know yet:

• Blue chip companies from Shell and Chevron to Procter & Gamble, Pfizer, Caterpillar, Microsoft and a host of others added smart card-technology to employee badges to secure information system access and achieve other digital security benefits.

• By next year every U.S. federal government employee and contractor employee badge will include smart card technology for digital security.

• The same factors that drove these large organizations to strong authentication are problems for all size organizations -- insider fraud, data breaches, remote employee access, protecting intellectual property, reducing paperwork with digital signatures, and government regulations.

• Whereas these giants expended significant resources to implement these programs just a few years ago, today VARs can bring these solutions to any size organization.

Some refer to this trend as "two-factor authentication," something you have (a smart card or a token) and something you know (such as a PIN). Others call it strong authentication. Speaking more generally, however, it refers to the desire on the part of enterprises to introduce some sort of digital security device -- a one-time password (OTP) token or smart card technology -- into the organization's information security mix.

Driving this trend is the increasing awareness of the risks presented to organizations by using passwords for IT security. After all, if someone can capture your user name and password today, whether through shoulder surfing or something more elaborate like a keyboard logging program, nothing stops them from having the same access privileges you have.

The idea behind strong authentication is to also require employees to have some type of personal security device they must present in order to log in.
The movement to replace passwords has no less of a champion than Microsoft Founder and Chairman Bill Gates. In his keynote presentation at RSA Conference 2007, he urged information decision-makers to accelerate the transition from weak passwords to smart cards in order to realize the vision of secure anywhere, anytime computing.

Gates explained that smart cards provide a way to carry certificates with you and securely use them anywhere. Microsoft has focused on making certificates and smart cards simple to manage and use for identity, including good handling for revocations and exceptions such as "when somebody forgets their smart card." Gates said with their new capabilities in place, this "really is the milestone where enterprises should start the migration from passwords to smart cards."
This new and largely untapped opportunity for VARs who want to position themselves strongly inside their clients in an area that creates opportunities for recurring revenues and strong differentiation.

On the supply side, two important changes have taken place to open up this opportunity to VARs. First, IT infrastructure leaders like Microsoft, Sun Microsystems, Citrix, Adobe and many others today provide built-in support to use smart cards and certificates for applications such as desktop login, network access, single sign-on, digital signature and email encryption.

The second change is the maturing of the solution sets, making end-to-end authentication systems readily available in a form suitable for widespread channel distribution. In addition to the devices themselves -- OTP tokens, USB smart card tokens, and smart card employee badges -- total solutions are available that include authentication servers, personal security devices, printing and issuing systems and client software.
Armed with the new pre-integrated solutions, VARs will now play a critical role in bringing that change about, offering their clients strong authentication solutions that even two years ago would have been out of reach for the average enterprise.