Bring Your Own Token to Replace the Traditional Smartcards for Strong Authentication and Signing
summary
Cisco replaces badge-based smartcards with a Bring-Your-Own-Token system using YubiKey 4/5 (firmware ≥4.3.5) and PIV/CCID, adds a self-service Crypto ID portal and client that performs key generation, attested provisioning and AD certificate publishing, drops provisioning from ~2 weeks to under 5 minutes, eliminates a ~$350k/year CMS bill, and equips ~2,000 Windows admins for smartcard logon, TLS client auth, SSH and S/MIME (S/MIME keys escrowed in HSM). Key limits: strict firmware whitelist/blacklist, attestation and PIN/PUK handling, single-active-token policy and per-vendor middleware work.
AI-written summary · about
chapters (5)
- 0:00Start
- 19:31SIMPLE
- 23:48MASTER WAYNE
- 26:17Consider Key Escrow for S/MIME Certificates
- 41:56Thank you!
related talks
23mBalancing enhanced security with excellent user experience in the enterprise
27mWebAuthn, Yubikeys, and You: What we wish we knew before...
24mStrong Auth Supply Chain
25mCTAP 2.1: FIDO's new tricks for passkeys on security keys
27mFrom Consumer Convenience to Enterprise Security: Demystifying Passkeys in the Workforce
26mPasskeys: A Breakthrough Step for Workforce Authentication on Shared Computers
26mHolistic Authentication
15mUp your SSH security game