I’ve decided to proceed with the 25 user ActivIdentity starter kit for the two-factor authentication. The decision on ActivIdentity has primarily been driven by recommendation by multiple vendors and the easy point of entry for me, the decision to go ahead has been driven by the likely need to hand over our VPN secret key to a third party at some point. We can, and will, switch on username/password authentication but that’s not enough as users may share details. I need the token - the tokens with the starter pack will be the keychain tokens.

I am anticipating quite a cultural challenge in implementing this technology and I need to decide where best to deploy the various components on our infrastructure - but that’s the fun of the job.