Case Study

Premium Security, Less Costs – Carhartt WIP Relies on Entrust Identity as a Service for MFA

Person sitting on a bench in a transit station, looking at a phone with a suitcase beside them

Customer Profile

As a licensee, Work In Progress Textilhandels GmbH designs and distributes textiles in collaboration with the U.S. clothing label Carhartt, which is primarily known in the U.S. for robust workwear. In 1996, Edwin Faeh acquired the license to develop his own collections as Carhartt Work In Progress (WIP) and to distribute them worldwide. Since then, Carhartt WIP has been licensing Carhartt’s collections, designing its own lifestyle and streetwear creations as well as accessories, and distributing them worldwide.

The company is based in Weil am Rhein in the border triangle, close to Switzerland and France. There are branches in Berlin, Düsseldorf and Paris, among other places. Worldwide, 1,500 employees work for Carhartt WIP, with about 400 in Germany alone. In 1997, the first company store was opened in London. Today the brand operates more than 60 company stores worldwide.

Partner
Data-Sec GmbH

Challenge

In Search of a Cost-Effective IAM Solution

One of Carhartt WIP’s primary IT decision criteria is that the company’s international structure be reflected and supported by any proposed technology solution. This is a complex undertaking, which is why Work In Progress relies on the advice of proven external specialists to keep its IT up to date and competitive. In recent years, for example, a new backup system has been installed, the company has moved to a new server environment and the network has been completely overhauled. Most recently, however, the issue of authentication proved to be particularly urgent – especially ensuring the authenticity of user accounts for external services, which at Work In Progress are primarily accessed via SSL VPN, and Citrix.

For more than 10 years, Work In Progress has relied on specialists from Data-Sec, based in Freiburg im Breisgau, Germany, to address its IT security requirements and challenges. So, when ensuring and enabling secure user access became a top priority, DataSec immediately set out to find the right multi-factor authentication (MFA) solution for Work In Progress. MFA requires users to provide two or more proofs of identity for verification before gaining access to a desired resource – making the login process a lot more secure than the previous password-based method. As well, a cloud-based approach that could serve all sites simultaneously was of high importance for Work In Progress.

Together, various software solutions were evaluated and compared. Three of them made it into the final review process. After a thorough four-month analysis, Work In Progress finally decided on the provider that could meet all of the project requirements in a cost-efficient manner as well as enable future use cases: Entrust with its Identity as a Service (IDaaS) solution.

Framed painting of a person in a brown sweatshirt holding a string of pearls, propped against a wooden crate with packing materials nearby

Solution

Entrust Identity as a Service

Entrust Identity as a Service provides best-in-class MFA with support for an unmatched number of authenticators and applications: From desktop login and single sign-on (SSO) to privileged access, it covers a wide range of possible authentication scenarios through a single platform for all user groups – be they employees on-site or remote, partners, contractors, or customers. IDaaS works like a virtual smart card stored on mobile devices – users do not need to carry anything in addition. If desired, the security level can be increased even further through adaptive risk-based authentication and/or the use of digital certificates.

With Entrust Identity as a Service, we can offer our customers one of the industry’s most advanced and versatile IAM solutions – and thus also enhance our own portfolio. After all, multi-factor authentication is still one of the key building blocks in a good security concept.

Andreas Kuttler
Key Account Manager at Data-Sec

Results

Fast Implementation

After deciding on IDaaS, the experts at Data-Sec quickly began with the implementation. A particular challenge: The installation had to take place in the live system with parallel operation. Thanks to careful preparation, everything went off without a hitch – the only surprise (to be overcome) was the necessary changeover of authentication on the firewall from LDAP to Radius, since parallel operation with LDAP and Radius is not possible. The test phase was completed after three months, and the entire project – from the initial request to the final implementation – was completed within half a year.

The new multi-factor authentication for access to Citrix and SSL VPN is now available to all employees regardless of location – mostly in conjunction with software tokens stored on smartphones. Alternatively, grid cards, Google Authenticator, or one-time passwords via SMS or e-mail can be used as authenticators.

The feedback from employees and management regarding the new solution is consistently positive: “The establishment of an increased security level met with great acceptance among our employees, and the changeover to the new solution was simple and understandable for everyone involved. So far, there have been no problems during ongoing operation. We all get on well with the system and are very satisfied with it so far,” explains Djordje Dragic, Head of IT Infrastructure at Work In Progress.

Download the Carhartt WIP Identity Case Study

Download