Managing Your Signify 2 Factor Authentication Token and Account

Before you can log into the SDHS, you will need to create a Signify Account. For this you will need your Signify Welcome Pack and the Welcome Email.

In the Welcome Pack you will find:

 
Your RSA SecurID from Signify token, similar to this:


Or been allocated a Software token, the guide to download and set this up will have been sent by email to you by signify-registrations@nccgroup.com

Who has provided the Signify service for me?

You will shortly receive a Welcome E-mail that will indicate which organisation has requested the Signify service for you.

What is Signify?

Signify is the Secure Authentication Service. We are dedicated to helping you protect your personal digital identity and secure your sensitive on-line information.
Using passwords to prove your identity when accessing on-line systems is not secure. Passwords are easily stolen, meaning your digital identity can be used without your knowledge. You should not rely on passwords to secure business critical systems or data.
SecurID from Signify is a managed, on-line service that delivers Identity Assurance by combining a secret PIN (Personal Identification Number) with a physical device, your unique RSA SecurID token.
When you want to access your Organisation's systems, you must prove you are in possession of both of these factors. This 'two factor' authentication is similar to using the cash machine at your bank, where, to verify your identity, you must present both a card and a PIN.
Signify now gives you the same level of security when working on-line, with complete confidence that no-one can steal your digital identity.

How does SecurID work?

The number on your SecurID token changes every 60 seconds and it is impossible to predict the next number. When you log in to systems protected by Signify, you simply enter your secret PIN followed by the current number on your token to create a unique 'one-time' passcode.
Without your token, no one can pretend to be you. Even if someone finds your token, they cannot log in if they do not know your secret PIN. And if someone eavesdrops on your session and is then able to decrypt your passcode it is useless as a one-time passcode can never be re-used.

What should I do now?

Before you can use your token for the first time, you need to register with Signify. This only takes a few minutes and will confirm to Signify that you have received your token and your Welcome E-mail safely.
At this point, your account will be activated and you can connect securely to your Organisation's systems.
Please first read the Rules of Use detailed at the back of this booklet.

What do I need for registration?

Your service has been pre-configured with a Signify Account ID and Reference Code that have been sent to you in your Welcome E-mail.
Please make sure that you have received:

  • Your Welcome E-mail message containing your

Signify Account ID and Reference Code

  • Your token (in the pack with this guide)

During the registration process, you will need to create a PIN which is secret and memorable to you. You must make sure that you do not reveal your new secret PIN to anyone – please memorise it.

If you have been allocated a Software 2 Factor Authentication Token 

What if I have not received my Welcome E-mail?

If your Welcome E-mail has not arrived, you can visit the Signify Self Service End User Helpdesk (see page 12) and click on the link 'I have not received my Welcome E-mail'.

I have my token and Welcome E-mail, how do I register?

  1. Click on the highlighted web link in your e-mail.

If this link does not work for you, go to https://registration.signify.nccgroup.com/#/login. There you can enter your Account ID and Reference Code which are given in your Welcome E-mail.

  1. You will then be prompted to create your own secret PIN.
  2. Next, you will be asked to log in using your new PIN followed by the 6 digit number currently displaying on your SecureID token (see the example on page 7).
  3. Then follow the on-line prompts to complete your registration. During registration you will be requested to:
    • Check, edit and add to your contact details, which we will need so that we can contact you securely, should you lose your token, forget your PIN, etc. (See notes below about contact details).
    • Create a number of secret Questions and Answers that we will ask you to validate your identity should you lose your token or PIN. There are guidelines on the website on how to set yourself appropriate questions.


Important Note about your contact details: Should you need us to replace your token or PIN, for security reasons we will need to send the replacement by post, e-mail or SMS to one of the addresses or phone numbers that you have previously registered with us. Therefore it is important that you register all of your appropriate postal addresses, e-mail addresses and phone numbers with us so we can deliver the replacement to the most convenient location at the time.

How do I type in my passcode?

You use a new 'one-time' passcode every time you log in. You simply type your secret PIN followed by the number currently displayed on your token. For example:

  • If your PIN is 123xyz and your token is displaying 675231

then in the passcode field you should enter: 123xyz675231

What if the number on my token changes whilst typing?

If you can finish typing your passcode, do so and click the Go button and Signify will accept it if it has been entered correctly.
However, if you have typed only half of the number and cannot remember the remainder, you must start afresh by entering your secret PIN followed by the next number displayed on your token.

What are the horizontal bars on the left of the token display?

These six bars count down the time remaining until the next number change: each bar represents 10 seconds remaining.
Therefore it is best not to start typing the token code when there is only a single bar left, but to wait a few seconds for the new number to appear and then type at your leisure.

I've registered fine – what next?

You will find yourself at your personal My IMC page: take a few minutes to check all the useful information about your Signify service.
You are ready to connect securely to your Organisation's systems (see below). Please now attach your Signify token to your key ring and read the Rules of Use printed at the back of this booklet.
What is the Identity Management Centre (IMC)?
This is your personal interface to Signify where you can find and manage all the information about you, such as how to:

    • update your personal details, check your security questions and change your PIN,
    • check details about your Organisation,
    • check your own activity and security logs,
    • manage your Organisation's users and authentication nodes if you have Signify administrator rights.

To access My IMC go to https://imc.signify.nccgroup.com/ log in with your Signify Account ID and passcode and you will be taken to My IMC.


When do I use my Username and when do I use my Signify Account ID?

You only use your Signify Account ID to log into the Signify website and access My IMC (your registered email address can also
be used).
Whenever you log in to your Organisation's systems, you should use the appropriate username that you have been allocated on that system: there is a reminder of your usernames at My IMC.

What if I've forgotten my Signify Account ID?

Simply log into https://imc.signify.nccgroup.com/ and click on the ? button next to the log in box. Type in any one of your registered e-mail addresses and the system will automatically fill in your Signify Account ID.

What if my token is lost or broken?

If your token is lost, damaged or faulty, it is your responsibility to report it to Signify as soon as possible, otherwise the security of your information is at risk.
Go to https://helpdesk.signify.nccgroup.com/#/help, where you will be taken through a step-by-step process to register your token as lost or broken.
Depending on your Organisation's service and security levels:

  • Signify or your administrator will dispatch your new token.
  • you may be given a set of Emergency Access codes which you can use while waiting for your new token to arrive.
  • you may be able to report your token lost by ringing a telephone helpdesk. If you do have a telephone helpdesk service, its number will be shown in your Welcome E-mail.

CSCS will be notified of any loss and you will be charged £75 for your replacement token. Faulty tokens will be replaced free of charge.

How do I change my secret PIN?

Go to My IMC. Select the option to change PIN. Follow the straightforward on-line instructions. It is good practice to change your secret PIN regularly, and it is essential that you change it if you suspect that someone else has found out what it is.

What if I have forgotten my secret PIN?

Go to https://helpdesk.signify.nccgroup.com/#/help and choose the appropriate option. You will then be stepped through a security process. After you have completed this, a replacement PIN will be automatically sent to you by e-mail or SMS to one of your registered addresses/ numbers.
You should then visit https://imc.signify.nccgroup.com/ and log in to My IMC using this replacement PIN and your current token code. You will then be prompted to create yourself a new secret PIN.

What if I no longer need to use my token?

At the point you no longer have a need for your Signify token, inform either your organisation's IT helpdesk or Signify administrator. They will then carry out the appropriate action.

  

How do I get help?

Via the Web

If you have a problem with your Signify token or service, you
can use the Signify Self Service End User Helpdesk to resolve it. Visit https://helpdesk.signify.nccgroup.com/#/help or follow the Helpdesk link on the Signify website.
This should be your first step to get help. It will answer most of your queries about the Signify Service and help you to solve most problems quickly and easily.

By Telephone


If your Organisation has provided you with this level of service you may also have telephone access to the Self Service End User Helpdesk.
If you are authorised to access this service, its number will be shown in your Welcome E-mail. Please take a moment to add this number to your records.

What if I have other problems with my Organisation's systems?

If your problem is not with your Signify token but relates to the other services offered by your Organisation, please direct your queries to their support service. Where possible, information about these will be available via My IMC.

Signify website: https://helpdesk.signify.nccgroup.com/#/help

Important Rules For Using The Signify Service
These Rules of Use apply to your use of the enclosed Signify token or other device (your Device), your secret Personal Identification Number (your PIN) and your use of the Signify Service (the Service).

  1. You should use your Device and your PIN to identify yourself to any systems or service secured by Signify in accordance with these Rules, the instructions in this Welcome Guide and any which may be communicated to you from time to time by Signify, and any agreements between yourself and your Organisation and between Signify and your Organisation.
  2. Your Device (and all of its components and technology) will remain at all times the property of, and confidential to, Signify Solutions Limited (Signify). It is important that you take proper care of your Device, keep it safe and secure at all times and guard against loss, damage and theft.
  3. Your PIN must remain secret to you at all times. No other person ever needs to know this PIN and you should not disclose it to anyone. This includes your colleagues and system administrators at your company and also personnel who are, or claim to be, representatives of Signify or a Partner of Signify. You should be extremely suspicious of anyone who ever tells you that they need to know your PIN, and you should report any such incident to Signify immediately.
  4. All actions performed under the login using a Device will be attributed to the registered keeper of the Device
  5. The privacy of your Device and the confidentiality of your PIN are crucial to the verification of your on-line identity and the security of your information and the networked system(s) which may be accessed using your identity.
  6. If your Device is lost, damaged or stolen, or if you believe that the confidentiality of your secret PIN has been compromised in any way, you should report these incidents immediately to Signify as instructed in the Welcome Guide and at https://helpdesk.signify.nccgroup.com/#/help. Signify's Web Helpdesk is available to you 24 x 7. Signify will then disable your Device or allow you to change your PIN, so as to ensure that no third party may misuse them.
  7. If you do not report these incidents immediately, there is the risk that your on-line identity may be stolen by someone else. Any activities they carry out using your identity will compromise the security and integrity of your information and systems. You may be held legally responsible for activities that are perpetrated using your identity.
  8. You must not give away, sell, rent or lend your Device even to someone you believe to be an authorised user of the Service.
  9. You must not mistreat, damage or open your Device or try to reverse-engineer, decompile, disassemble, translate, copy or alter the Device or any of its components.
  10. If you lose or break your Device, you may be charged a replacement fee by your Organisation.
  11. Should your Signify Service account be terminated for any reason, or if you have no further need to use the Signify Service, you should return your Device to CSCS.