White Paper

Zero Trust
Solutions withHardware
Authentication© Swissbit AG 2024 – All rights reserved.

1. Introduction
In a world where cyber attacks and data
breaches have become constant threats forcompanies, the traditional idea of trust
faces new challenges. Over the last years,
the concept of “zero trust” has become
established as a promising alternative toconventional network security approaches.
Admittedly, the term initially sounds harshand contrary to a corporate culture of trust,
but in truth it is a robust and implementable cybersecurity concept.
But what exactly does zero trust meanand how can it be implemented effectively in practice? This white paper
explains the backgrounds and demonstrates how companies can protect theircritical resources, confidential data andintellectual property effectively againstinternal and external threats. Particularattention is paid to the integration of zerotrust solutions with hardware authentication, such as with FIDO security keys.
The aim is to illustrate that zero trust is
not a highly complex concept, but rather
that it includes a set of clearly definedprinciples and best practices, which help
companies increase their security leveland proactively minimize risks.

Table of Contents
1. Introduction
2. Why zero trust is the best defense
3. Two-factor authentication with FIDO
4. More than FIDO: additional security features
5. Digression: User authentication for government
agencies and large enterprises
6. Conclusion

22. Why zero trust is the best defense
When it comes to network security, theclassic trusted network approach iscommonly used. In simple terms, adistinction is made here between aninternal secure network and the insecureInternet. Firewalls and VPNs ensure a clear
separation. In practice, this means thatusers can move more or less freely between
computers
withintheorganization
However, this becomes an issue not only if
an inside attacker gains unauthorizedaccess to resources within the network.
Another significant risk is that once
attackers have managed to gain access tothe network from the outside, they canoften move around in it unnoticed.

Management) is critical in this respect.
Based on a set of rules for authorizations,
everyone must authenticate themselves
uniquely to the various systems. Once an IT
environment where security is achieved
through the highest level of mistrust has
been established, a secure authentication
solution must also be implemented.

The zero trust approach does away with thenotion of a trusted network inside adefined corporate perimeter and instead
uses the data itself as its starting point.
This data-centric approach creates security
by constantly monitoring who is accessing
what data. Commonly used zero trust
concepts include determining the sensitivity of data, assessing risks, establishingaccess rules and enforcing these. One way
to do this is with software-defined perimeters. This means that network access andconnections are established according to aneed-to-know principle. Anyone whowants to access an app or a resource in thenetwork is authorized for just this one app
or a resource after successful authentication and can use it without seeing
anything of the rest of the network. In
other words, access management is shiftedfrom the network perimeter to the resourcesor apps.
Of course, a security architecture such as
this involves some expenditure. For
instance, it must be defined what is to beprotected and at what level (protectionneeds analysis). This includes critical andconfidential data as well as applications
and services as well as IT, OT and IoTdevices. Data flows have to be investigatedin order to decide how transactions are tobe protected. This is followed by questions
about network design and maintenance.
However, IAM (Identity and Access3

3. Two-factor authentication with FIDO
Passwords alone are not sufficient – they
are susceptible to phishing and social engineering attacks, and if they lack complexity,
they can even be second-guessed orobtained by trial and error. In other words,
authentication must always take into
account several factors in order to prove theidentity of the user. In addition to the secretknowledge factor, in other words, the password, there should be at least one otherfactor such as a biometric characteristic or atamper-proof object. For the latter, very
convenient solutions are now available,
which can also be provided with additional
cryptographic functionalities. Security keys,
such as iShield Key Pro from Swissbit, arebased on the FIDO standard.
FIDO stands for Fast IDentity Online. The FIDO
Alliance was established in 2013 by a groupof international companies with the goal ofdeveloping open and license-free industry
standards for authentication. The alliancehas been successful in achieving this with
the WebAuthn standard, which is used tospecify hardware and software for two-factor
authentication. The standard Client toAuthenticator Protocol (CTAP) specifies theassociated communication protocol between
the security token and the device (PC/cellphone). Like its predecessor U2F (UniversalSecond Factor), FIDO2 enjoys broad support
on current system platforms and operatingsystems (Windows, Linux, MacOS, Android,iOS). The authentication solution is based onstrong asymmetrical cryptography and, witha hardware-based unclonable private key, ismore secure than other common methods
such as SMS passwords or time-based
one-time passwords (TOTP) on cell phones.
The original intention of the FIDO Alliance
was to replace passwords in cloud applications. However, applications for two-factor
authentication in combination with the zerotrust approach will become more importantin future. For example, with a hardware-based security token, attacks oncompany software, such as ERP, PPS, CRM,CMS, etc., can be efficiently prevented.
In essence, a FIDO security key consists of asecurity chip with cryptography module, anNFC and a USB interface. The application isvery simple. To register the key, users areprompted to unlock the FIDO device with afingerprint reader, a secure PIN or anotherspecified method. The device then generates a new public and private key pair. Thekey pair connects the device to an application and the user’s account. The public key
is sent to an online service provider whichlinks it with the user’s account. The privatekey and all information about the local
authentication method (for example, a PIN
or biometric data) never leave the local
device. When the user logs in, the FIDO
server sends a request to the device, which
sends it back signed.

44. More than FIDO: additional security
features
In addition to FIDO2, hardware security keys
can also provide more security techniques.
With Swissbit iShield Key Pro, these are
HOTP (HMAC-based One-time Password) andPIV (Personal Identity Verification). This
opens up even more flexible deployment
options for companies. The event-basedmethod HOTP is a combination of private
key and counter-based one-time password
and is used to back up two-factor authentication for web services that do not support
WebAuthn/U2F. HOTP can also be used inoffline application scenarios when users
have no Internet access. (See item 5)
The second method which is suitable foraccess to local resources is PIV to store
digital certificates and private keys on thebasis of a public key infrastructure (PKI),
using the cryptography standard PKCS #11.
PIV is an open standard used widely inindustry and by public authorities forauthentication,digital
signatures,encryption and physical access authorization. For instance, a USB flash drive with
PIV can be used to log on to Windows (forlocal accounts or via Microsoft ActiveDirectory), also in combination with drive
encryption through BitLocker.

5. Digression: User authentication forgovernment agencies and large
enterprises
SurePassID and Swissbit have jointly
developed a solution that combines theiShield Key Pro security key with theSurePassID authentication server. Thissolution is aimed specifically at government
agencies and large enterprises and fulfills
the increasing demand for more phishing-resistant and user authentication
without password. It enables fast provisionof FIDO2-based authentication via public
and private clouds and air gaps. An air gap
is a computer network that is physicallyisolated from other networks and theInternet. There is no direct connection toexternal networks, which means that datacannot be transferred unintentionally or beinfluenced by external sources. This type ofnetwork is often used in environments
where security is critical and where thehighest levels of confidentiality andprotection from external threats arerequired.

5Even in scenarios without FIDO2 support thesolution provides a seamless transition to acompliant HOTP authentication method, withno adverse effects on the user experience.
This makes it ideal for organizations withvarious access scenarios. The solution fromSurePassID and Swissbit enables simple
implementation of FIDO2-based authentication for users who access cloud applications from remote locations or who use
applications and devices in high-security
facilities.
The combination of FIDO2 and the zero trust
approach is especially important in thisenvironment, as existing cloud-based
authentication solutions and public cloudgateways are not suitable for user authentication in private clouds or air gaps.

5. Conclusion
Introduction of a data-centric zero trust
security policy involves many individual
authentication procedures. A solution basedon the FIDO standard makes working withthe software secured in this way much moreconvenient and faster. If individual accessauthorizations cannot be secured with FIDO,
HOTP and PIV are other easy-to-use methods.
The methods have a great advantage incommon: use of a hardware-based security
feature in two-factor authentication meetsthe highest security standards.

The joint solution from SurePassID andSwissbit provides functions such asautomated provisioning and removal ofaccess rights and central management oflogin information. This simplifies theimplementation for organizations withmany users operating in different network
environments.

6

Author

About Swissbit

Alexander Summerer
Head of Authentication

Swissbit AG is the leading European
manufacturer of storage, security
and embedded IoT solutions fordemanding applications. As trusted
partner, Swissbit empowers thedigital and connected world byreliably storing and protecting data
in industrial, security and IoTapplications.

Do you have any questions? Get in touch!
Swissbit Europe (HQ)
Tel. +41 71 913 03 00
sales@swissbit.com
Swissbit North America
Tel. +1 978-490-3252
salesna@swissbit.com

www.swissbit.com

Swissbit Japan
Tel. +81 3 6258 0521
sales-japan@swissbit.com
Swissbit Asia
Tel. +886 912 059 197
salesasia@swissbit.com

Subject to change without prior notice.
© Swissbit AG 2024 – All rights reserved.

www.swissbit.com/iShield-Key