Yubico Regional VP talks password security and multi-factor authentication with Ausdroid

It’s been a few weeks in the works, but with the continual stream of data leaks, it seemed appropriate timing to discuss multi-factor authentication with Yubico. We were fortunate enough to be offered some time with Geoff Schomburgk, Regional Vice President, Asia Pacific & Japan (APJ).

We asked a number of questions to Geoff regarding the current security landscape, including some that challenged whether Yubico had a place in the retail (vs corporate market) with detailed responses provided to each question.

Ausdroid: Clearly, Yubico has a strong market, with a user base that is pretty loyal to the security landscape. What direction is the marketing likely to take to get more users onboard with 2FA and hardware authentication moving forward?

Geoff: Yubico’s marketing is focused on educating the broader market around the need for strong, phishing resistant multi-factor authentication (MFA).

Phishing is the predominant method employed by cybercriminals to steal usernames and passwords. They do this by masquerading as a reputable or known entity or person in an email, instant message, or another communication channel. Without a second form of authentication, the basic username and password are easily obtained by cybercriminals and allows them to reset passwords, lock victims out of their accounts, download private data, gain access to their mobile phones, their computers and even other computers on the network and they may even wipe the victim’s data and backups.

Our recent State of Global Authentication Survey shows that most people now understand that some form of MFA is needed to reduce the potential for a breach. But not all MFA is created equal and many of the MFA options in common use today, such as SMS, email and authenticator apps can still be phished.

Phishing-resistant MFA is immune from attempts to compromise or subvert the authentication process, commonly achieved through phishing attacks, which includes but is not limited to spear phishing, brute force attacks, man-in-the-middle attacks, replay attacks and credential stuffing.

So, from a marketing perspective, Yubico will continue to work with our partners to raise awareness of the need for phishing resistant MFA and the need for a hardware security key, such as a YubiKey.

Ausdroid: What will we see from Yubico to increase the levels of security to protect users in the next 12 – 24 months as we continue to see breaches increase and personal data compromised?

Geoff: Yubico will continue to focus on encouraging the adoption of phishing-resistant MFA, based on the FIDO2 standard, as the most secure form of MFA that virtually eliminates the potential for a data breach. Tech companies like Apple, who recently launched support for security keys as part of their iOS 16.3 update is an example of how the industry is making FIDO2 authentication, the most secure method of MFA, more widely available.

In addition, we also work with technology partners to jointly promote the benefits of phishing-resistant MFA. For example, as one of the founding members of the FIDO Alliance, Yubico works closely with partners such as Google, Microsoft, Apple and identity management providers such as Okta, Ping, Cisco/Duo as well as many others to promote the benefits of phishing resistant MFA.

Yubico is focused on securing large enterprises with our YubiEnterprise Subscription offering, making it easier and more convenient for large enterprises to adopt YubiKeys at scale. We believe this will have a positive trickle down effect to help secure all users.

Yubico’s Co-Founder Stina Ehrensvard recently announced that she is moving from her CEO role to a new role at Yubico as its Chief Evangelist. In this new role she too will be dedicating her time to help accelerate awareness on the simple things we all can do to be safe online.

At Yubico, we also believe that vulnerable populations shouldn’t have to worry about their digital security. Our Secure it Forward program was established to provide security keys to help nonprofits and at-risk organisations improve their authentication posture. For every 20 keys sold on the Yubico e-commerce store, we donate 1 key to nonprofits or organisations in need.

Ausdroid: With the ease of connection and use for authenticator apps, connected to – presumably secured by biometrics, private codes etc – mobile phones, how do you sell Yubico hardware to new users?

Geoff: As the creator and core contributor to the FIDO2, WebAuthn, and FIDO Universal 2nd Factor (U2F) open authentication standards, Yubico is a pioneer in delivering modern, hardware-based authentication security at scale.

YubiKeys are extremely easy to set up and use. They feature all of the modern security protocols, including FIDO2/WebAuthn, as well as FIDO U2F, SmartCard (PIV), OTP, OpenPGP, and more. And they come in a range of form factors to suit a variety of desktop, laptop and mobile applications.

YubiKeys are manufactured at our secure facilities in Sweden and USA. They have no breakable screens, do not require a battery, are both crush-proof and water-resistant, and can be used in sterile environments where smart devices are prohibited.

As stated above, any form of MFA is better than none, but not all MFA is created equal. There is a growing awareness that strong authentication is required but existing forms of MFA may be convenient, but they do not offer the highest levels of security.

Selling YubiKeys is about promoting the strongest form of MFA that is from a trusted partner and this job is made easier by a) the large number of customers, small/medium/large, who are already using YubiKeys and b) the tech companies like Microsoft, Google and Apple promoting strong phishing resistant MFA with secure authentication devices – like the YubiKey – as the Gold Standard for authentication.

The need and prevalence of security will only grow moving forward

While you may believe that your personal accounts are of no value to hackers, the data within them certainly can be. It gives a clear insight into you, your habits and contacts, and essentially your identity. It makes a lot of sense to protect your accounts and your private data with strong passwords and, wherever it’s offered, two-factor authentication. Yubico is one of the options on the market to do exactly that.

If you’re ready to upgrade your security, head to Yubico and check out their selector tool to help you select your Yubikey.