The key to GDPR compliance and online privacy protection

October 12, 2017 3 minute read

The EU General Data Protection Regulation (GDPR) is a new set of mandates aimed to protect the privacy of internet users. From May, 2018, any organization operating, storing or processing data of EU citizens will be subject to the requirements. With the threat of hefty fines of €20M or 4% of worldwide turnover for non-compliance, whichever is greater, GDPR has got everyone’s attention.

One of the key components for GDPR compliance is the need for strong authentication. With billions of stolen credentials now in circulation, the use of username and passwords is no longer sufficient for protecting personal data. The European Union Agency for Network and Information Security – ENISA –  describes authentication as ‘key to securing computer systems’ and as the first step ‘in using a remote service or facility, and performing access control’. Referenced as GDPR-compliant authentication solutions are one time password solutions, smart cards, and FIDO Universal 2nd Factor (U2F).

At Yubico, it’s been our mission to make strong two factor authentication easy to use and deploy, and available for everyone. We disrupted One Time Password (OTP) technology introducing the simple touch and no client software install solution of the YubiKey. We co-created the FIDO U2F open standard and developed a next generation, simplified, and more secure PIV smart card technology. All these protocols and acronyms – OTP, PIV, FIDO U2F – enable one YubiKey to provide strong authentication for secure access to the majority of IT systems, ranging from computers and phones to networks and online services.

But of all the three protocols, FIDO U2F is the most powerful.

FIDO U2F has today proven at scale that it is the strongest defense against modern phishing attacks that hijack the session, the so called man-in-the middle attacks. As well as being easy and affordable to use and support, FIDO U2F preserves the privacy of internet citizens.

Many online authentication and identity technologies store user data and cryptographic secrets in centralized servers. An essential feature of FIDO U2F is that it does not store any means of personally identifiable information (PII), and while it works across any number of services, it does this without sharing any information between the services. And it is these game changing privacy measures that make the YubiKey and FIDO U2F optimal for GDPR compliance.

Government regulations supporting public safety are not new. Several times before we have seen government step up and re-write laws when the health and security of citizens are at risk. We may like it or not, but some of these laws have been effective. For example, today, significantly fewer people are killed by cars and cigarettes compared to the 1950s.

With the May 28, 2018 deadline for GDPR rapidly approaching, the days of usernames and passwords as an acceptable authentication technique are numbered. The hefty fines that can be imposed for GDPR non-compliance may be the necessary means for organizations to become responsible when operating, storing or processing data of EU citizens. Learn more about the security, usability, cost and privacy benefits of FIDO U2F.

Please contact us if we can help you with GDPR compliant authentication.

Share this article:

Recommended content

Modern approaches to remote identity provisioning across civilian agencies

Learn how Yubico, ID.me and Entrust are working together to offer remote identity provisioning of strong authentication alternate credentials to civilian agencies

The YubiKey 5 FIPS Series is here and there are 5 things you need to know

Today, we’re thrilled to announce yet another product milestone in addition to the launch of YubiHSM 2 FIPS — the long-awaited YubiKey 5 FIPS Series is now generally available. It is the industry’s first set of multi-protocol security keys with support for FIDO2 and WebAuthn, along with smart card (PIV/CAC), to receive FIPS 140-2 validation, Overall ...

A Yubico first...introducing the YubiHSM 2 FIPS

Compliance mandates require many of our customers in regulated industries or in high-risk environments to prove adequate levels of protection for their data, no matter where it lives or travels. This is why today we’ve not only launched the YubiKey 5 FIPS Series but also the smallest FIPS-validated hardware security module (HSM) in the world, ...

Top 10 security regulations you need to know about in the U.S. and EU

Compliance has always been part of routine planning and development for security experts in the enterprise. But recent headline-grabbing attacks like the SolarWinds incident may have pushed compliance much higher up the priority list. It’s difficult to track the dizzying array of regulations on both sides of the pond and what they require, so we’ve ...