Recommended
More Related Content
What's hot
What's hot (20)
Similar to The Best practices to secure smbs using yubico
Similar to The Best practices to secure smbs using yubico (20)
Recently uploaded
Recently uploaded (20)
The Best practices to secure smbs using yubico
- 1. © 2022 Yubico © 2022 Yubico Best practices to secure SMBs in an evolving cyber threat landscape January 28, 2022
- 2. © 2021 Yubico © 2018 Yubico What we’ll cover Evolving cyber threat and regulatory landscape Cybersecurity risks facing SMBs Critical need for phishing-resistant MFA How to get started
- 3. © 2022 Yubico CONFIDENTIAL - YUBICO INTERNAL ONLY © 2021 Yubico Abdulghani, IT Cloud Engineer, Clouds Zone
- 4. © 2022 Yubico © 2022 Yubico Evolving cyber threat and regulatory landscape
- 5. © 2022 Yubico We’re now squarely in the “new normal” Secure hybrid work is here to stay… Source: PEW Research Center, Dec 2020
- 6. © 2022 Yubico Hackers thrive in crisis FBI urges vigilance... 54% Source: FBI, 2021 Increase in cyber crimes since COVID-19 started... 300%
- 7. © 2022 Yubico 7 Remote and hybrid work risks Heightened threat vectors Places Technology People Remote workers are a high risk user category Home networks are generally less secure; lower confidence in remote endpoints Home networks not as secure as corporate Risk engine not adapting quickly enough to changes Accidental download of malware by family members Falling prey to phishing attacks tied to the pandemic
- 8. © 2022 Yubico 8 Clear need to move beyond passwords
- 9. © 2022 Yubico of hacking-related breaches use stolen credentials Source: Verizon Data Breach Investigation Report 80%
- 10. © 2022 Yubico © 2022 Yubico Cybersecurity risks facing SMBs
- 11. © 2022 Yubico SMBs are prime targets for cyberattacks Why?… 54% Your data is very lucrative Entry point for a larger attack Limited resources or dedicated IT support Inadequate cybersecurity training Easy profit from ready access to data 11
- 12. © 2022 Yubico Yet…SMBs grossly underestimate their risks “Why would anyone target us?... 54% Breaches involved small to mid-sized businesses 1 in 3 Source: Verizon’s 2020 Data Breach Investigations Report (DBIR)
- 13. © 2022 Yubico SMBs leaving themselves exposed Writing passwords down on paper…spreadsheets, documents 54% Using insecure methods to store passwords 1 in 5 Source: Devolutions State of Cybersecurity in SMBs 2021 - 2022
- 14. © 2022 Yubico A cybersecurity breach Fatal for SMBs... 54% Close down within 6 months of a breach 60% Source: US National Cyber Security Alliance
- 15. © 2022 Yubico SMBs need to secure digital transformation ● Secure the ways you fuel your business models ○ Ensure secure usage of social networks, and other communications channels, to generate demand, and stay connected with your customers. ● Ensure uninterrupted collaboration with your suppliers, partners and customers using software ○ Secure sharing of inventory information that enables flexibility and just in time shipping / delivery of supplies ● Secure usage of cloud-based applications ○ e.g. Using Salesforce.com to manage customer information ○ E.g. Workday for payroll and timesheets 15 © 2022 Yubico
- 16. © 2022 Yubico Secure key SMB business scenarios Remote and hybrid workers Mobile restricted Privileged users Office workers Shared workstations Supply Chain
- 17. © 2022 Yubico But there can be security challenges… ● Sifting through the options feels complicated ● Not sure of the right approach that will keep the business protected ● Limited IT support to get up and running ● Needs to be intuitive to drive up user adoption 17 You need an easy way to gain strong security, while making it a fast and easy process to enable user adoption
- 18. © 2022 Yubico © 2022 Yubico Critical need for strong authentication and phishing- resistant MFA that’s fast and easy
- 19. © 2021 Yubico What you know 19 What you have Who you are
- 20. © 2021 Yubico What you know Password PIN 20 What you have SMS OTP Smart card Security key Who you are Fingerprint Face Voice Iris
- 21. © 2021 Yubico Not all authentication is created equal Username and password Basic 2FA: SMS, email, mobile Strong authentication ● Not purpose-built for security ● Uses existing technology stacks that are vulnerable to network and software attacks ● Common target for credential phishing ● Purpose-built for security ● No network connection, stored data, or client software required ● Highly phishing resistant ● Deployed everywhere ● Known usability gaps ● Costly and hard to sustain ● Common target for credential phishing 80% attack penetration rate 0% attack penetration rate 10%-50% attack penetration rate © 2021 Yubico
- 22. © 2021 Yubico Ease of use Security Phishable 22 Non-phishable Some MFA is better than no MFA ...but not all MFA is phishing-resistant
- 23. © 2021 Yubico Not all MFA is phishing resistant
- 24. © 2021 Yubico Not all MFA is phishing resistant
- 25. © 2021 Yubico Not all MFA is phishing resistant
- 26. © 2021 Yubico Not all MFA is phishing resistant
- 27. © 2021 Yubico Not all MFA is phishing resistant
- 28. © 2021 Yubico Not all MFA is phishing resistant
- 29. 29 Security key (YubiKey) 10% 21% 24% 50% 0% On device prompt (OTP push app) Secondary email SMS code Phone number Hardware FIDO security keys …proven to stop account takeovers in their tracks
- 30. © 2021 Yubico 30 Security ● Dedicated, security-focused chip ● Protect against phishing and MitM Privacy ● No privacy risk being a personal device ● Can be anonymous, if desired Portability ● Portable root of trust across all devices ● Mobile restricted areas, shared workstations Reliability ● No battery or signal dependency ● Crush and water resistant Affordability ● Easier recovery and multiple backups reduce support costs TPM Mobile apps/built-in authenticators have limitations
- 31. © 2021 Yubico 31 Twitter breach and recommendation... “MFA is critical, but not all MFA methods are created equal. The most secure form of MFA is a physical security key, or hardware MFA, involving a USB key that is plugged into a computer to authenticate users. This type of hardware MFA would have stopped the Hackers, and Twitter is now implementing it in place ofÇapplication-based MFA.”
- 32. © 2022 Yubico © 2022 Yubico How to get started
- 33. © 2022 Yubico CONFIDENTIAL - YUBICO INTERNAL ONLY © 2021 Yubico Rami Kayyali CTO – The Kernel
- 34. © 2022 Yubico 34 No power, cellular connection, or client software required Authenticate across desktop and mobile with a simple tap or touch Natively supported by all major OSes and web browsers Multi-protocol support for your systems as you grow Subscription and delivery services that keep costs predictable and affordable Transparent and secure supply chain Lower TCO — costs less than a password reset! YubiKey: Hardware security right-sized for SMBs