Yubico YubiKeys

For securing your most sensitive accounts, systems, and data that require strong access controls, YubiKeys offer excellent protection by strengthening your organization's authentication strategy. Rather than relying solely on passwords or mobile-based two-factor methods for your highest-risk user logins, YubiKeys provide rock-solid multi-factor authentication tied to a tamper-resistant physical device. This eliminates many of the vulnerabilities associated with passwords and mobile authenticators alone. By requiring both a password and the possession of a YubiKey for access, you can drastically reduce the risks of unauthorized logins, even in the event of password leaks. YubiKeys also provide phishing protection by cryptographically verifying legitimate sites, preventing spoofing attacks.For infrastructure like production servers, databases, and network equipment where compromised access would be catastrophic, YubiKey-secured logins should be mandatory for administrators and engineers. Similarly for business-critical software as a service accounts and registrar/DNS logins where hijacking could shut down the business.

They are a great backup MFA device because it isn't safe to only have one MFA token. They are also good for anyone who doesn't want to use a smartphone as their MFA device. They have a FIPS-validated solution for anyone who works in government or government contracting.

Yubico YubiKeys are great for hybrid applications that support both modern and legacy authentication methods. For example, for web-based applications that are federated behind an IdP, the Yubico YubiKey WebAuthn (FIDO2) mechanism is the gold standard of phishing-resistant MFA. The same Yubico YubiKey (if a supported model) can also be used as an OTP hardware token so that the user does not have to use 2 different roaming authenticators for logging into all their applications. One YubiKey to rule them all!

Yubico YubiKeys shines when used as part of a larger MFA solution. It provides a very flexible component, however, it remains dependent on the infrastructure and environment in which it is deployed.

Yubico YubiKeys are durable, lightweight, easy to use, support several authentication protocols, and have an enterprise management option.

Works very well for MFA, both at the server and VPN. FIDO/FIDO2 also works very well.

Yubico YubiKeys are well suited for 2-factor and OTP authentication. They are not well suited for non-security applications.

The ability to have a high security posture and guard for protection of data and access

As long as users physically carry the Yubikey with them they can securely authenticate with our SSO architecture. The only problem with the Yubikey is limited support for mobile devices at this time. So much more secure with various threat actors targeting It infrastructure these days...

We have two distinct user bases; 'typical knowledge workers' and 'users without assigned endpoints, emails, etc., who work in a secured room.' As such, Yubikeys is an easy solution for Strong MFA.

As users are generally the weakest link in the corporate security chain, anything to avoid compromised passwords is a must. For us, Yubikeys from Yubico went a long way to securing our business. Just a touch on the key's contacts was enough to securely sign a user into their workstation. It conveyed a 2FA OTP and SSO to allow our people to never need a password again. Well, that was the dream. But replacing lost and damaged keys is very expensive, especially when you appear to have more than your fair share of clumsy and absent-minded staff.

For an advanced user, Yubikeys are powerful and easy to utilize once setup. However, I believe a lay-user is able to better benefit from less intense tools such as our 2FA's native app push notifications. Yubikeys provide a strong 2nd layer of security to systems that require 2 factor, and for lay users, this might be overkill.

It is well suited when a hardware authentication factor is needed or desired. The drawback is that you physically need to have it with you and that you may receive prompts to insert/use the key on devices that do not support it or cannot read the key due to no NFC or USB being present.

I 100% recommend Yubico for organizations that work with secure or confidential information. The use of 2-factor authentication should be a given: it protects information and assets (personal and organizational) and adds an additional layer of security. Yubico's security is demonstrably robust, and it integrates (sometimes with some finagling/legwork) with most 2FA platforms/logins. Additionally, the key itself is either a semipermanent unobtrusive attachment or a small key you can plug into the computer. I highly recommend Yubikeys for both personal and professional use.