Secure Manufacturing (2024)

Because security is never stronger than its weakest link, we have considered the full lifecycle of our products, from component sourcing, through manufacturing, to integration within a customer system, to ensure the highest levels of security.

Secure Manufacturing (1)

Made in Sweden & USA

Yubico is a Swedish company that owns subsidiaries in the USA, UK and Germany. We strongly believe there are security and privacy benefits for our customers by manufacturing and programming our products in Sweden and the USA.

To ensure that we are very close to all aspects of manufacturing, we have set up production where we are geographically based. That means we manufacture and finish our parts close to our two main offices in Sweden and the USA, where we can make continuous improvements while keeping a tight control over what’s made.

Secrets Protected with Secure Elements

Yubico products are built on state-of-the-art secure elements, used for the majority of smart card payment cards and passports, providing a high degree of resilience for secret information. The design of the YubiKey minimizes the attack surface, by moving storage of cryptographic keys and secure processing away from the computer and into an external dedicated hardware authentication device. In today’s highly complex systems, this is becoming increasingly important.

Device Protections

By using secure elements within the YubiKey, both the Yubico software and hardware is protected in a way that makes it very difficult to tamper with.

We have invented a new and efficient way to manufacture the USB YubiKeys — in one solid and robust piece of plastic. We use a high degree of automation for electronics assembly to molding, testing, laser marking and packing of our products. Yubico products are available in tamper-evident blister packaging for YubiKey sales on Yubico store and Amazon.com.

Yubico offers anonline portalfor users to test the authenticity of your YubiKey.

Secure Manufacturing (2)
Secure Manufacturing (3)
Secure Manufacturing (4)

Customer Controlled Secrets

YubiKeys are delivered to our logistics centers as “stem cells”, with the means to prevent any modifications during transit and storage. The authentication and encryption features are programmed at the time of shipment to customers. Customer cryptographic secrets are not stored by Yubico, and customers may choose to use their own computers and equipment for programming.

All YubiKeys sold on our web store can be programmed by customers using ourfree programming tools. Cryptographic keys cannot be read out from the device.More detailed information on the different options for programming YubiKeys can be found on ourProgramming Optionspage.

Yubico OTP Security

For high-security applications, we recommend the use of our public key offerings, including FIDO2/WebAuthn, FIDO U2F, GPG, and PIV.

For one-time password (OTP) applications, the Yubico OTP supported in the YubiKey offers enhanced security compared to traditional OTP tokens. Because the YubiKey automatically enters the passcode for you, we have chosen the full 128-bit key strength, represented by a 32 ModHex character passcode, offering a level of security several magnitudes higher than the common 6 or 8 digits. To further enhance security, the Yubico OTP is offered with an optional time variant code. The YubiKey has no battery but features a built-in clock that uses the power from the USB port or NFC (in supported models). This clock can be used to measure the time between two OTPs, verifying user presence so that pre-recorded OTPs cannot be used.

Communications Security

While Yubico previously initiated development of a BLE security key and contributed to the BLE U2F standards work, we decided not to launch the product as it does not meet our standards for security, usability and durability. BLE does not provide the security assurance levels of NFC and USB as it can be intercepted within 20 meters, and is a more complex protocol with a larger attack surface. Also, it requires batteries and pairing that offer a poor user experience.

Yubico is a believer in NFC, and the YubiKey design has proven at scale to deliver a superior contactless user experience.

FIDO Ecosystem Security

YubiKeys need websites, browsers, and operating systems to work in harmony to protect people. Therefore, to achieve a trusted Ecosystem, the security of browsers and devices are critical.

Attestation

Attestation is built-in to the FIDO and WebAuthn protocols, which enables each service provider to choose which security keys totrust, or to be more skeptical of, based on their individual needs and concerns. Each vendor can provide root attestation certificates which can be used to verify the authenticity of any security key they produce. The root certificate that issues all YubiKey attestation certificates is available at:https://developers.yubico.com/U2F/yubico-u2f-ca-certs.txt. This covers both U2F and FIDO2 devices.

More information for developers and administrators, including our recommendations on how to use attestation in a scalable way, can be found here.

Securing Secrets on Servers

We use our own cost-efficient and convenient YubiHSM hardware server module to protect access to all Yubico servers and systems, including for OTP secrets for YubiCloud, Yubico’s hosted validation service.

Technical Transparency

We are a strong believer in transparency and do whatever we can to provide documentation and open source software and libraries. We are also committed to ongoing work with third parties for certifications, security reviews and scrutiny.

The Yubico team, investors and advisors, have a long proven track record and are well respected in the security industry and open standards communities. Our goal has always been to be transparent and take responsibility for the quality and integrity of our products.

Since 2014 and the launch of FIDO U2F in Gmail, Yubico has donated and discounted YubiKeys to journalists, dissidents and non-profit organizations working for civil rights. Learn more about the programhere.

Certifications

Yubico’s products are certified against FIPS, FIDO, and soon CSPN to meet the compliance needs of some of our customers. However, as mentioned throughout, our investment in the safety and security of our products goes far beyond what these require. We do this in order to provide the safest products we can, and because most certifications focus on interoperability, few review cryptographic code, and none cover total system architecture, implementation, and supply chain security. You can read more about what FIDO certifications cover on their website, and what NIST’s FIPS certification covers on the NIST website.

Secure Manufacturing (2024)

FAQs

Where are Yubi keys made? ›

Yubico is a Swedish company that owns subsidiaries in the USA, UK and Germany. We strongly believe there are security and privacy benefits for our customers by manufacturing and programming our products in Sweden and the USA.

What is an example of a security technology? ›

Video surveillance cameras, IoT enabled commercial door locks, and password protection are all security technology examples that can deter people from attempting to gain unauthorized access to a space or information.

What is security in IT industry? ›

Security for information technology (IT) refers to the methods, tools and personnel used to defend an organization's digital assets. The goal of IT security is to protect these assets, devices and services from being disrupted, stolen or exploited by unauthorized users, otherwise known as threat actors.

What is an example of digital security? ›

Digital security is a set of best practices and tools used to safeguard your personal data and online identity. Password managers, parental controls, and antivirus software are examples of such tools.

Who is YubiKey owned by? ›

Founded in 2007 by CEO Stina Ehrensvärd, Yubico is a private company with offices in Palo Alto, Seattle, and Stockholm. Yubico CTO, Jakob Ehrensvärd, is the lead author of the original strong authentication specification that became known as Universal 2nd Factor (U2F).

How do I know if my YubiKey is real? ›

Compatible devices

Insert your Yubico device, and click Verify Device to begin the process. Touch the YubiKey when prompted, and if asked, allow it to see the make and model of the device. If you see "Verification complete", your device is authentic.

What are the four 4 main security technology components? ›

The four components are:
  • Deterrence. The initial layer of security; the goal of deterrence is to convince unwanted persons that a successful effort to enter an unauthorized area is unlikely. ...
  • Detection. ...
  • Delay. ...
  • Response.

What are the four main security technology components? ›

An effective security system comprises of four elements: Protection, Detection, Verification & Reaction. These are the essential principles for effective security on any site, whether it's a small independent business with a single site, or a large multinational corporation with hundreds of locations.

What is the 3 types of computer security? ›

The Different Types of Cybersecurity
  • Network Security. Most attacks occur over the network, and network security solutions are designed to identify and block these attacks. ...
  • Cloud Security. ...
  • Endpoint Security. ...
  • Mobile Security. ...
  • IoT Security. ...
  • Application Security. ...
  • Zero Trust.

What are the three basics of IT security? ›

Three basic security concepts important to information on the internet are confidentiality, integrity, and availability.

What are the three major areas of security? ›

There are three primary areas or classifications of security controls. These include management security, operational security, and physical security controls.

What is a real life example of cyber security? ›

What are examples of cyber security? Network security examples include firewalls that prevent illegal access to a network and antivirus. Antispyware software and VPNs (Virtual Private Networks) are other examples used for secure remote access.

What is the difference between cyber security and digital security? ›

Digital security involves protecting your online presence (data, identity, assets). At the same time, cyber security covers more ground, protecting entire networks, computer systems, and other digital components, and the data stored within from unauthorized access.

What are the three 3 advantages of cyber security? ›

The five benefits of using cyber security are: Increased protection of sensitive data. Reduced risks of data breaches. Enhanced detection and response to attacks.

Do Google employees use YubiKey? ›

Google Stopped the Scammers Cold with Security Keys.

That's when they handed out 85,000 security keys—the actual brand was Yubikey—to their employees and required every employees to use their security key every time they logged into their email or Google accounts.

Can someone use a stolen YubiKey? ›

If you lose your Yubikey, you can still use your phone authenticator app, but you cannot create a backup Yubikey. However, Yubikey also provides methods to recover your account, so you can get a replacement. An advantage to Yubikey is that it comes on a USB that cannot be identified.

How expensive is a YubiKey? ›

A YubiKey is the ultimate line of defense against having your online accounts taken over. And with prices starting at $25, it's one of those indispensable gadgets for the 21st century.

Can a YubiKey be hacked? ›

Locked ones are only marginally easier to tamper with than proper smartcards, nearly impossible to be worth it for anyone than state actors. > A Yubikey can be hacked to send arbitrary keystrokes - but that's of limited usefulness.

Can YubiKey get malware? ›

Yubico's YubiKey is built on a foundation of strong authentication. This robust resistance to phishing offers malware protection because it hinges on the ability to detect these attacks before they take place.

Why is YubiKey so expensive? ›

It is costly to design, mould, manufacture, sell and support a hardware product, even something as small as this. Since you don't want your 2FA company to go out of business there is good value in knowing they have a stable business model that can actually support a company rather than just burning capital.

What is the 4 C's in security? ›

Securing the 4 Cs of Cloud-Native Systems: Cloud, Cluster, Container, and Code.

What is the CIA model of security? ›

The three letters in "CIA triad" stand for Confidentiality, Integrity, and Availability. The CIA triad is a common model that forms the basis for the development of security systems.

What is that one security related tool you can t be without? ›

A firewall is the first (of many) layers of defense against malware, viruses and other threats. It scrutinizes and filters both incoming and outgoing data.

What is the most common cause of a data breach? ›

Criminal hacking—it's what causes the majority of data breaches. These are planned attacks by cybercriminals always looking to exploit computer systems or networks. Some common techniques include phishing, password attacks, SQL injections, malware infection, and DNS spoofing.

What are the 7 aspects of security? ›

Our security culture model is an important element of a wider Security Culture Framework. The model consists of seven dimensions: attitudes, behaviors, cognition, communication, compliance, norms, and responsibilities.

What are the six types of security threat? ›

The main types of cybersecurity threats that companies face today include malware, social engineering, web application exploits, supply chain attacks, Denial of Service attacks, and man-in-the-middle attacks.

What are the primary types of security? ›

What are the Types of Security? There are four main types of security: debt securities, equity securities, derivative securities, and hybrid securities, which are a combination of debt and equity.

What is the latest technology in cyber security? ›

The latest technologies in cybersecurity include Artificial Intelligence (AI) and Machine Learning (ML), Behavioral Biometrics, Zero Trust Architecture, Blockchain, Quantum Computing, Cloud Security, and IoT Security.

What are the types of system security? ›

These include firewalls, data encryption, passwords and biometrics. A firewall consists of software and hardware set up between an internal computer network and the Internet to filter out unwanted intrusions. Data encryption is the process of encoding messages so it can only be viewed by authorized individuals.

What are key principles of security? ›

What are the 3 Principles of Information Security? The basic tenets of information security are confidentiality, integrity and availability. Every element of the information security program must be designed to implement one or more of these principles. Together they are called the CIA Triad.

What are the elements of security? ›

It relies on five major elements: confidentiality, integrity, availability, authenticity, and non-repudiation.

Which is one of the three pillars of security? ›

The CIA triad refers to an information security model made up of the three main components: confidentiality, integrity and availability. Each component represents a fundamental objective of information security.

What is the difference between safety and security? ›

What's the difference between safety and security? Safety stands for accident avoidance, and security for crime prevention. The best way to explain it is to use an example: If you think of an emergency exit, on the one hand you have the safety aspect.

What are three examples of cyber theft? ›

Common forms of cybercrime include:
  • phishing: using fake email messages to get personal information from internet users;
  • misusing personal information (identity theft);
  • hacking: shutting down or misusing websites or computer networks;
  • spreading hate and inciting terrorism;
  • distributing child p*rnography;

What is cyber security in one sentence? ›

Cyber security is the application of technologies, processes, and controls to protect systems, networks, programs, devices and data from cyber attacks. It aims to reduce the risk of cyber attacks and protect against the unauthorised exploitation of systems, networks, and technologies.

Who uses cyber security? ›

Cyber security is important because government, military, corporate, financial, and medical organizations collect, process, and store unprecedented amounts of data on computers and other devices.

Which is better IT security or cyber security? ›

two word spelling difference may simply come down to regional preference – American authors tend to use cybersecurity as one word, whereas British professionals have been known to separate the word into two.

Which pays more cybersecurity or information technology? ›

Compared to other information technology (IT) jobs, cybersecurity jobs pay $12,700 more per year on average [3].

Which is better IT or cyber security? ›

Although roles and responsibilities may overlap, IT typically has a broader focus on projects, like building and operating computer networks and systems. Cybersecurity focuses on protecting the information within those systems. Cybersecurity and IT use different strategies and skills to achieve many of the same goals.

Which act violates cyber security? ›

4. An/A ________ is an act that violates cyber-security. Explanation: An “attack” or “cyber-attack” is an attempt taken by attackers to alter, delete, steal or expose any specific data by gaining unauthorized access.

What are the downsides to cybersecurity? ›

Sometimes implementing cyber security measures can be risky for individuals or businesses because they have to compromise their data. It also increases the risk of security breaches that result in loss of money, customer trust, and the company's reputation.

What are the negatives of cyber security? ›

Generally, the disadvantages of cyber security also come in the following manners: Firewalls are tricky to be set up properly. Firewalls that are incorrectly constructed may block users from engaging in certain Internet activity till the firewall is configured correctly. Slows down the system even more than before.

What happens if you lose a YubiKey? ›

If you lose your Yubikey, you can still use your phone authenticator app, but you cannot create a backup Yubikey. However, Yubikey also provides methods to recover your account, so you can get a replacement. An advantage to Yubikey is that it comes on a USB that cannot be identified.

How long do YubiKeys last? ›

How long does a YubiKey last? The internals of the YubiKey's security algorithms currently limits each key to 30+ years of usage. The Yubikey is powered by the USB port and therefore requires no battery and there is no display on it that can break. The key itself will survive years of daily use.

How many YubiKeys can I have? ›

YubiKey recommends having more than one token to reduce the risk of being locked out of your account because of token loss. You can link up to 5 YubiKey tokens with your account.

Where are YubiKeys sold? ›

From our webstore: www.yubico.com/store.

Is it safe to leave YubiKey plugged in all the time? ›

Do I need to keep my yubikey plugged in all the time? A. No, you only need to insert your yubikey when you are prompted to do so during login. Leaving it plugged in could result in the yubikey being lost or damaged.

Can someone steal my YubiKey? ›

A properly implemented Yubikey cannot be cloned. It can be stolen, but ideally you would notice it was missing. An authenticator can be copy/cloned.

Can someone hack YubiKey? ›

Locked ones are only marginally easier to tamper with than proper smartcards, nearly impossible to be worth it for anyone than state actors. > A Yubikey can be hacked to send arbitrary keystrokes - but that's of limited usefulness.

Can I reuse an old YubiKey? ›

Should YubiKeys be reused? YubiKeys could be reused. There are a number of considerations that need to be taken into account when deciding on whether or not to reuse YubiKeys. Besides removing and reissuing credentials, tracking systems may need to be updated.

Can a YubiKey be cloned? ›

For security, the firmware on the YubiKey does not allow for secrets to be read from the device after they have been written to the device. Therefore you cannot duplicate or back up a YubiKey or Security Key.

Can you use the same YubiKey on multiple computers? ›

Yes! Just plug your YubiKey into any computer and log in the way you normally would. That's really it—you'll be able to log in to all of your accounts, same as before. You can use your YubiKey to log in on as many devices as you want, so long as there's a slot for it.

Can Amazon use YubiKey? ›

AWS IAM and root users can use their YubiKey as a multi-factor authentication (MFA) device to add an extra layer of protection on top of their user name and password.

Is there an alternative to YubiKey? ›

Ping Identity

PingOne Cloud Platform is a user auth and Identity-as-a-service (IDaaS) platform. It offers a scalable and flexible solution for managing user identities, access, and security in the cloud.

Is Yubico a US company? ›

Yubico was founded in Sweden 2007 with the mission to make secure login easy and available for everyone.

Top Articles
Latest Posts
Article information

Author: Francesca Jacobs Ret

Last Updated:

Views: 5812

Rating: 4.8 / 5 (68 voted)

Reviews: 91% of readers found this page helpful

Author information

Name: Francesca Jacobs Ret

Birthday: 1996-12-09

Address: Apt. 141 1406 Mitch Summit, New Teganshire, UT 82655-0699

Phone: +2296092334654

Job: Technology Architect

Hobby: Snowboarding, Scouting, Foreign language learning, Dowsing, Baton twirling, Sculpting, Cabaret

Introduction: My name is Francesca Jacobs Ret, I am a innocent, super, beautiful, charming, lucky, gentle, clever person who loves writing and wants to share my knowledge and understanding with you.