White Paper

Multi-factor
authentication:
Meet NIS2
requirements,avoid liabilityrisks© Swissbit AG 2024 – All rights reserved.

iShield Key Pro
More than just a FIDO stick!
Scalable, extendable, and customizable:
nSupports FIDO2, PIV, HOTP, TOTP

nAccess controlnMFA-compliant

swissbit.com/ishield-key

The European Union’s NIS2 Directive prescribes access
controls to protect critical infrastructures and essential services. Many companies, authorities and otherorganizations are affected by it and must act in goodtime to avoid severe penalties and even personalliability. How can the requirements for secure
multi-factor authentication be implemented economically?

Content
1. Is my company affected?

The EU Directive NIS2 (EU 2022/2555), which came into
force on January 16, 2023, is a central pillar of theEuropean cybersecurity strategy. The directive mustbe transposed into national law by October 17, 2024.
In addition to stricter reporting obligations in theevent of incidents, NIS2 requires the companies concerned to improve risk management and tighten
security requirements. Implementing access control
to IT systems and networks is particularly importantfor practical application. Many EU countries, including Germany, require multi-factor authentication(MFA) for that1. In the following, you will learn how
to implement this procedure economically and avoid
severe penalties. Incidentally, regardless of whether
national legislation has come into force, the NIS2
Directive will apply immediately from October 18,2024, even if it has not yet been transposed into
national law.

1. Is my company affected?
The first version of the NIS Directive was introduced
in 2016 to increase the security level of networks andinformation systems in the European Union. The aimof NIS2 is to protect critical infrastructures andimportant digital services even more comprehensively against cyber threats. To this end, NIS2 significantly expands the existing group of so-called “KRITIScompanies” (operators of critical infrastructures).

2. What penalties are there?
3. Access control obligation
4. Multi-factor authentication
5. Smartphone or USB token?
6. Avoid risks, save costs

In Germany alone, around 29,000 companies areadditionally affected. Alongside federal and criticalinfrastructures, the extended KRITIS group also
includes those classified as “essential” or “important” for the state community. Areas such as energy,transport, finance or health come under the category“essential” for the state community. Postal services,waste management, food, chemicals, digital services
or industrial and research facilities are regarded as“important”.
What is also new is that while “essential” and“important” entities are only affected as of a certain
number of employees or amount of revenue, NIS2
applies without exception to providers of DNS services and top-level domain name registers, as well
as operators of public electronic communications
networks or services. In addition, all companies thatare part of the supply chain of a directly affected
entity should also address NIS2, since they candemand assumption of liability in the event of aclaim.

1Section 30 (4), sentences 9 and 10 NIS2UmsuCG(Draft bill, processing status July 3, 2023, published by ag.kritis)32. What penalties are there?
Similar to the EU Data Protection Directive, companies, associations and non-profit organizations
face severe sanctions if they violate the NIS2 regulations. The maximum penalty for “essential” entities is up to 10 million euros or 2% of global
annual revenue, while “important” entities areliable for up to 7 million euros or 1.4%. The management or executive board may also face being
held personally liable2. As such, precautions in thearea of cybersecurity are comparable to liability
insurance: Just how important the investment
would have been only becomes clear in the eventof a claim.

Why you should not take any risks
when it comes to IT security.
Read our Zero Trust Whitepaper

3. Access control obligation

Access control

The following applies not only to NIS2 implementation: Cybersecurity is a management task and mustnot be delegated. So how do companies need toprepare for the new cybersecurity requirements inorder to avoid security and liability risks? One of theessential requirements of NIS2 is to develop appropriate concepts for access control. The reason isobvious: Secure IT structures start with the questionof who has access to the individual systems andnetworks. In particular, the following must be protected against unauthorized access:In the context of the NIS2 Directive, access control
is an essential element for ensuring the integrity,availability and confidentiality of network andinformation systems. These are indispensable
for maintaining critical social and economicfunctions. Effective access control reduces the riskof cyberattacks, data leaks and other incidents.
Appropriate measures and technologies ensurethat only authorized persons have access tocertain information, resources or areas within anetwork or information system. Multi-factor
authentication ensures that through a combination of knowledge components such as
passwords, biometric features or possession
components such as smartphones, smartcards
or USB tokens.

• Local access to PCs• Remote access via VPN• App access to cloud-based
and local applications

Many national NIS2 implementations, such as thedraft bill for the German NIS2 Implementation ActNIS2UmsuCG, explicitly require the implementationof multi-factor authentication for access control3.
Depending on the EU Member State, the nationalspecifications for restricted IT access must be checkedin detail.

2

https://www.security-insider.de/persoenliche-haftungsrisiken-aus-der-eurichtlinie-nis2-a-42f0b436de2c7f83633656b144b43f2f/ (retrieved on March 1, 2024)

3

Draft bill NIS2UmsuCG Section 30 (4) 9. & 10.

44. Multi-factor authentication
Countries such as Germany stipulate multi-factor authentication (MFA) for access control in their NIS2
implementation. This procedure is particularly effective because it does not rely solely on knowledge factors
such as PINs or passwords, but also requires other factors such as possession or biometric features. Possession
components can be hardware-based, for example, a USB token, a smartcard or a smartphone. Softwarebased MFA solutions, on the other hand, use smartphone apps, SMS or e-mails to send generated accesscodes.

Something you
know
Password or phrase+PIN

Login

Something youareSomething youhave

Finger or thumb print
Face scan
Iris scan

Code from App or SMS
Push notification
USB token

MFA

Authenticated

Additional layer of protection: Multi-factor authentication (MFA) requires at least two
proofs of identity for IT access.

5. Smartphone or USB token?

Passwordless IT accessBasically, even a bad MFA is better than none.
However, there are major differences with regard tosecurity, practicality and cost-effectiveness. Tokenbased MFA solutions, for example, are more securethan smartphone-based solutions due to theiradditional hardware components and, dependingon the protocol, integrated anti-phishing protection. Hackers can intercept a SMS with a transmitted
access code or compromise the smartphone’s operating system. By contrast, MFA solutions with USB
tokens and modern authentication protocols such as
FIDO2 or PIV offer a much smaller target.

The global FIDO2 standard enables secure passwordless login procedures for computer systems,
company networks, websites and apps. FIDO2 isan initiative of the FIDO Alliance with the World
Wide Web Consortium (W3C), which is supported
by companies such as Apple, Microsoft andGoogle. With FIDO2-compatible tokens, companies can easily implement phishing-resistant
MFA solutions.

More: fidoalliance.org/fido2/

5

Another advantage of the USB token over the smartphone are the significantly lower investment costs.
For the price of an average smartphone, the purchasecan equip around 20 to 30 people with tokens. That’sa considerable cost factor if the entire workforce is tobe equipped in compliance with NIS2. Added to thatare the high lifecycle costs of smartphones, including
preparation, maintenance and device replacement.

easyUsability

USB tokens are also easier to bring into line withcompany guidelines than smartphone-based solutions. Some employees do not want to use worksmartphones, let alone their private smartphones
for authentication in a professional context. A USB
token, on the other hand, is easy to introduce a
mandatory basis and therefore offers a very simple
and consistent basis for implementing MFA.

Phishable

Phishing-resistantPIN„12345“poorMobile
Authenticator
Passwords„r@ndom!&Pässwörd“OTP, Hardware-Token
Smartcard
weakstrong

Security

Advantages and disadvantages of different MFA procedures.

6. Avoid risks, save costs
The transposition of NIS2 into national law holds
the management of KRITIS companies personallyresponsible for protecting their IT systems fromunauthorized access. Experience in recent years with
the General Data Protection Regulation shows thatleniency is not to be expected in criminal prosecution. Affected companies should act now to meetdeadlines, avoid severe penalties, and effectively
protect the security of their IT environment against
unauthorized access.

Anyone who wants to be on the safe side from alegal, technical and economic perspective withregard to the important NIS topic of multi-factor
authentication is well advised to use USB tokenbased solutions such as the iShield Key Pro from
Swissbit. These are not only significantly cheaperand easier to use than smartphone-based solutions,but also offer the best possible security, including
anti-phishing.

Do you want to find out more about NIS2, MFA andUSB tokens without any obligation? Contact us at:
swissbit.com/contact6

Efficient and secure: iShield Key Pro from Swissbit
The hardware-based MFA solution iShield Key Pro from Swissbit offers the best possible security for
NIS2-compliant access to websites, applications, services and corporate networks. The strong hardware-based authentication option Made in Germany offers cost-effective and secure protection against
online attacks such as phishing, social engineering or account takeovers. The iShield Key Pro can evenreplace smartphones with an authenticator app, as it can be used flexibly with the following standards:• FIDO & FIDO2: phishing-resistant multi-factor authentication, basis for zero trust architectures• PIV: electronic signature for PDFs and e-mails• HTOP & TOTP: for non-FIDO-compatible legacy and existing systems

Find out more:swissbit.com/ishield-key

7

Authors

About Swissbit

Alexander Summerer
Head of Authentication

Swissbit AG is the leading European
manufacturer of storage, security
and embedded IoT solutions fordemanding applications. As trustedpartner, Swissbit empowers thedigital and connected world byreliably storing and protecting data
in industrial, security and IoTapplications.

Stefan Gockel
Key Account Manager Embedded IoT Solutions

Do you have any questions? Get in touch!
Swissbit Europe (HQ)
Tel. +41 71 913 03 00
sales@swissbit.com

www.swissbit.com

Swissbit North America
Tel. +1 978-490-3252
salesna@swissbit.com
Swissbit Japan
Tel. +81 3 6258 0521
sales-japan@swissbit.com
Subject to change without prior notice.
Swissbit Asia
Tel. +886 912 059 197
salesasia@swissbit.com© Swissbit AG 2024 – All rights reserved.