Identity & Access Management
Top Stories
-
Tip
28 Jul 2026
CISO's guide to data obfuscation
With so many services requiring access to sensitive data, encryption alone is not enough. Data obfuscation has evolved into a core element of modern cybersecurity architecture. Continue Reading
-
Tip
24 Jul 2026
CISO's guide to privileged identity management
IAM is more crucial than ever in the AI era. To better control who -- and what -- is accessing systems and data, security teams need to move beyond standing access privileges. Continue Reading
-
Definition
11 Apr 2024
identity management (ID management)
Identity management (ID management) is the organizational process for ensuring individuals have the appropriate access to technology resources. Continue Reading
-
Opinion
10 Apr 2024
Identity, data security expectations for RSA Conference 2024
Security practitioners can expect to hear about key issues at this year's RSA Conference, including identity and data security, AI and DSPM. Continue Reading
-
Tutorial
27 Mar 2024
Use sudo insults to add spice to incorrect password attempts
The life of an admin doesn't have to be dry. When a user enters a wrong password, for example, why not respond with a message that says, 'You're fired!' With sudo insults, you can. Continue Reading
-
Definition
11 Mar 2024
identity provider
An identity provider (IdP) is a system component that provides an end user or internet-connected device with a single set of login credentials that ensures the entity is who or what it says it is across multiple platforms, applications and networks. Continue Reading
-
Tip
09 Feb 2024
Understand the pros and cons of enterprise password managers
Almost half of breaches occur because of compromised credentials. Using a password manager to control how users create their IDs may be a good step to protect enterprise assets. Continue Reading
-
Tip
05 Feb 2024
6 multi-cloud identity management tips and best practices
The more cloud services organizations adopt, the more identity challenges they face. Follow these five tips to improve multi-cloud identity management. Continue Reading
-
Tip
01 Feb 2024
Top 8 cloud IAM best practices to implement
Cloud adds a level of complexity to identity and access management. Be sure to follow these cloud IAM best practices to prevent identity-related security issues. Continue Reading
-
Tip
31 Jan 2024
7 cloud IAM challenges and how to address them
Cloud use affects how organizations manage access and identity governance. Learn about seven cloud IAM challenges and how to handle them. Continue Reading
-
News
26 Jan 2024
Microsoft: Legacy account hacked by Russian APT had no MFA
Microsoft has begun notifying other organizations that have been targeted in recent attacks by Midnight Blizzard, a Russian nation-state actor also known as Cozy Bear and APT29. Continue Reading
-
News
03 Jan 2024
SonicWall acquires Banyan to boost zero-trust, SSE offerings
With its second acquisition in two months, SonicWall aims to help enterprises with growing remote workforces through zero-trust network and security service edge offerings. Continue Reading
-
Definition
02 Jan 2024
identity theft
Identity theft, also known as identity fraud, is a crime in which an imposter obtains key pieces of personally identifiable information (PII), such as Social Security or driver's license numbers, to impersonate someone else. Continue Reading
-
Definition
28 Dec 2023
one-time password
A one-time password (OTP) is an automatically generated numeric or alphanumeric string of characters that authenticates a user for a single transaction or login one-time password session. Continue Reading
-
Opinion
06 Dec 2023
Amazon IAM announcements at re:Invent 2023
At AWS re:Invent 2023, Amazon announced several new features around machine and human identities designed to improve identity and access management. Continue Reading
-
Feature
01 Dec 2023
How to solve 2 MFA challenges: SIM swapping and MFA fatigue
While MFA improves account security, attacks still exploit it. Learn about two MFA challenges -- SIM swapping and MFA fatigue -- and how to mitigate them. Continue Reading
-
Feature
01 Dec 2023
5 MFA implementation tips for organizations
Organizations need to protect user accounts from malicious attackers. IAM expert Marco Fanti offers tips organizations can use when implementing MFA. Continue Reading
-
Definition
28 Nov 2023
privileged identity management (PIM)
Privileged identity management (PIM) is the monitoring and protection of superuser accounts that hold expanded access to an organization's IT environments. Continue Reading
-
Feature
27 Nov 2023
How passwordless authentication aids identity security
Enterprise Strategy Group's Jack Poller discusses survey results on user authentication practices and explains the security benefits of passwordless methods. Continue Reading
-
Definition
21 Nov 2023
possession factor
The possession factor, in a security context, is a category of user authentication credentials based on items that the user has with them, typically a hardware device such as a security token or a mobile phone used in conjunction with a software token. Continue Reading
-
Definition
09 Nov 2023
mandatory access control (MAC)
Mandatory access control (MAC) is a security strategy that restricts the ability individual resource owners have to grant or deny access to resource objects in a file system. Continue Reading
-
Definition
01 Nov 2023
authentication
Authentication is the process of determining whether someone or something is who or what they say they are. Continue Reading
-
Tip
26 Oct 2023
How to create a company password policy, with template
Use these guidelines and our free template to ensure your company's password policy sets the ground rules for strong and effective password creation and use. Continue Reading
-
News
24 Oct 2023
1Password stops attack linked to Okta breach
1Password said a threat actor used a HAR file stolen in the recent Okta breach to access the password manager's Okta tenant, but the activity was detected and blocked. Continue Reading
-
Definition
20 Oct 2023
soft token
A soft token is a software-based security token that generates a single-use login personal identification number (PIN). Continue Reading
-
Opinion
18 Oct 2023
SailPoint extends identity security platform with data security
With DAS, privilege access management, AI and other features, SailPoint moves Atlas from an identity governance platform to an identity security platform. Continue Reading
-
Definition
18 Oct 2023
Google Authenticator
Google Authenticator is a mobile security application that provides a second type of confirmation for websites and online services that use two-factor authentication (2FA) to verify a user's identity before granting him or her access to secure resources. Continue Reading
-
News
16 Oct 2023
Google Authenticator synchronization raises MFA concerns
Infosec experts say a synchronization feature added to Google's Authenticator app could lead to unintended consequences for organizations' multifactor authentication codes. Continue Reading
-
Answer
16 Oct 2023
Best practices to conduct a user access review
User entitlement reviews ensure only authorized users have access to essential systems and data. Uncover the steps of a user access review and helpful best practices. Continue Reading
-
News
04 Oct 2023
Okta debuts passkey support to combat account compromises
The identity and access management vendor introduced products and features that addressed new social engineering techniques that require additional security measures beyond MFA. Continue Reading
-
Opinion
02 Oct 2023
Transitioning to single-vendor SASE will take time
New Enterprise Strategy Group research reveals enterprises are interested in single-vendor SASE -- but with multiple tools on hand, the transition will take planning and time. Continue Reading
-
Definition
26 Sep 2023
Protected Extensible Authentication Protocol (PEAP)
Protected Extensible Authentication Protocol (PEAP) is a security protocol commonly used to protect wireless networks. Continue Reading
-
Opinion
21 Sep 2023
Strong identity security could've saved MGM, Caesars, Retool
Three cyber attacks that featured vishing led to compromised identities, data loss and the interruption of operations. Passwordless authentication could have prevented all three. Continue Reading
-
Opinion
12 Sep 2023
Time for an identity security revolution
Identity needs to be the foundational component of the cybersecurity stack, because attackers are primarily after an organization's data. Continue Reading
-
News
07 Sep 2023
How Storm-0558 hackers stole an MSA key from Microsoft
Microsoft detailed a series of errors that led to a consumer account signing key accidentally being included in a crash dump that was later accessed by Storm-0558 actors. Continue Reading
-
Opinion
06 Sep 2023
Identity needs a seat at the cybersecurity table
The shift to the cloud and remote work, combined with the rise of phishing and other identity-related attacks, puts identity security at the forefront of cybersecurity concerns. Continue Reading
-
Definition
23 Aug 2023
BYOI (bring your own identity)
BYOI (bring your own identity) is an approach to digital authentication in which an end user's username and password are managed by a third party. BYOI is increasingly being used for website authentication. Continue Reading
-
News
08 Aug 2023
CrowdStrike observes massive spike in identity-based attacks
Identity-based attacks like Kerberoasting saw massive increases over the last 12 months as adversary breakout time fell, according to CrowdStrike's 2023 Threat Hunting Report. Continue Reading
-
Definition
07 Aug 2023
orphan account
An orphan account, also referred to as an orphaned account, is a user account that can provide access to corporate systems, services and applications but does not have a valid owner. Continue Reading
-
Tip
31 Jul 2023
How honey tokens support cyber deception strategies
Learn how to flip the script on malicious hackers with honey tokens, which act like tripwires to reveal an attacker's presence. Continue Reading
-
Definition
28 Jul 2023
national identity card
A national identity card is a portable document, typically a plasticized card with digitally embedded information, that is used to verify aspects of a person's identity. Continue Reading
-
Tip
28 Jul 2023
Improve IAM with identity threat detection and response
Attackers increasingly target user accounts to gain access. Identity threat detection and response offers organizations a way to improve security for identity-based systems. Continue Reading
-
News
17 Jul 2023
Microsoft still investigating stolen MSA key from email attacks
While Microsoft provided additional attack details and techniques used by Storm-0558, it remains unclear how the Microsoft account signing key was acquired. Continue Reading
-
Definition
07 Jul 2023
mobile authentication
Mobile authentication is the verification of a user's identity via a mobile device using one or more authentication methods for secure access. Continue Reading
-
Definition
06 Jul 2023
single-factor authentication (SFA)
Single-factor authentication (SFA) is a process for securing access to a given system, such as a network or website, that identifies the party requesting access through only one category of credentials. Continue Reading
-
Definition
05 Jul 2023
knowledge-based authentication
Knowledge-based authentication (KBA) is an authentication method in which users are asked to answer at least one secret question. Continue Reading
-
Definition
30 Jun 2023
security token
A security token is a physical or wireless device that provides two-factor authentication (2FA) for users to prove their identity in a login process. Continue Reading
-
News
27 Jun 2023
ChatGPT users at risk for credential theft
As ChatGPT's user base continues to grow, Group-IB says threat actors have exploited stolen accounts to collect users' sensitive data and professional credentials. Continue Reading
-
Feature
20 Jun 2023
Blockchain security: Everything you should know for safe use
Despite its reputation, blockchain is subject to many of the same vulnerabilities as other software. It helps to have a clear idea of its inherent strengths and weaknesses. Continue Reading
-
Definition
09 Jun 2023
logon (or login)
In computing, a logon is a procedure that enables an entity to access a secure system such as an operating system, application, service, website or other resource. Continue Reading
-
Tip
08 Jun 2023
How to secure blockchain: 10 best practices
Blockchain has huge potential in the enterprise, but remember all emerging technologies come with their own risks. Consider these 10 best practices for securing blockchain. Continue Reading
-
News
17 May 2023
KeePass vulnerability enables master password theft
KeePass developer Dominik Reichl said the vulnerability should be fixed in KeePass version 2.54, which is expected to release in July along with other security updates. Continue Reading
-
News
08 May 2023
Intel BootGuard private keys leaked following MSI hack
Intel said it was "actively investigating" reports that OEM BootGuard keys were stolen and leaked by ransomware actors following a breach at motherboard maker MSI Continue Reading
-
Feature
05 May 2023
How to implement principle of least privilege in Azure AD
Restricting users' permissions in Microsoft Azure AD to only what they need to complete their job helps secure and reduce the cloud attack surface. Continue Reading
-
News
03 May 2023
Google rolls out passkeys in service of passwordless future
Google referred to its new passkey option, which features facial recognition, fingerprint and PIN-based authentication, as 'the beginning of the end of the password.' Continue Reading
-
Definition
02 May 2023
password manager
A password manager is a technology tool that helps internet users create, save, manage and use passwords across different online services. Continue Reading
-
News
01 May 2023
1Password execs outline shift to passwordless authentication
1Password CEO Jeff Shiner and Anna Pobletts, head of passwordless, discuss the power of passkeys, the adoption challenges ahead, and the threat of generative AI attacks. Continue Reading
-
News
26 Apr 2023
CrowdStrike details new MFA bypass, credential theft attack
At RSA Conference 2023, CrowdStrike demonstrated an effective technique that a cybercrime group used in the wild to steal credentials and bypass MFA in Microsoft 365. Continue Reading
-
Definition
14 Apr 2023
two-step verification
Two-step verification is a process that involves two authentication steps performed one after the other to verify that someone or something requesting access is who or what they say they are. Continue Reading
-
Definition
13 Apr 2023
private CA (private PKI)
A private CA is an enterprise-specific certificate authority that functions like a publicly trusted CA. Continue Reading
-
Tutorial
12 Apr 2023
How to create fine-grained password policy in AD
Fine-grained password policies are a simple and effective way of ensuring password settings meet business requirements. Continue Reading
-
Tutorial
12 Apr 2023
How to enable Active Directory fine-grained password policies
Specifying multiple password policies customized to specific account types adds another layer to an organization's security posture. Using PSOs instead of Group Policy can help. Continue Reading
-
Answer
12 Apr 2023
How to use a public key and private key in digital signatures
Ensuring authenticity of online communications is critical to conduct business. Learn how to use a public key and private key in digital signatures to manage electronic documents. Continue Reading
-
Tip
11 Apr 2023
Centralized vs. decentralized identity management explained
With decentralized identity, organizations can worry less about data security and privacy, while users get more control over their information. But it's not without challenges. Continue Reading
-
Feature
11 Apr 2023
How to use Azure AD Connect synchronization for hybrid IAM
Organizations face many challenges authenticating and authorizing users in hybrid infrastructures. One way to handle hybrid IAM is with Microsoft Azure AD Connect for synchronization. Continue Reading
-
Opinion
06 Apr 2023
Top RSA Conference 2023 trends and topics
Enterprise Strategy Group's Jack Poller outlines his picks for getting the most out of the 2023 RSA Conference, from keynotes to startups, AI, innovation and more. Continue Reading
-
Definition
05 Apr 2023
deprovisioning
Deprovisioning is the part of the employee lifecycle in which access rights to software and network services are taken away. Continue Reading
-
Definition
30 Mar 2023
CSR (Certificate Signing Request)
A Certificate Signing Request (CSR) is a specially formatted encrypted message sent from a Secure Sockets Layer (SSL) digital certificate applicant to a certificate authority (CA). Continue Reading
-
Definition
30 Mar 2023
authentication factor
An authentication factor is a category of credential that is intended to verify, sometimes in combination with other factors, that an entity involved in some kind of communication or requesting access to some system is who, or what, they are declared to be. Continue Reading
-
News
27 Mar 2023
Zoom launches Okta Authentication for E2EE to verify identity
Authenticated Zoom attendees will get a blue shield icon next to their participant name to give enterprises additional security during sensitive meetings. Continue Reading
-
Definition
24 Mar 2023
three-factor authentication (3FA)
Three-factor authentication (3FA) is the use of identity-confirming credentials from three separate categories of authentication factors -- typically, the knowledge, possession and inherence categories. Continue Reading
-
Definition
20 Mar 2023
FIDO (Fast Identity Online)
FIDO (Fast Identity Online) is a set of technology-agnostic security specifications for strong authentication. Continue Reading
-
Definition
15 Mar 2023
YubiKey
YubiKey is a security token that enables users to add a second authentication factor to online services from tier 1 vendor partners, including Google, Amazon, Microsoft and Salesforce. Continue Reading
-
Opinion
02 Mar 2023
Accurately assessing the success of zero-trust initiatives
Zero-trust preparation can be difficult. Measuring how well the model provides security and business benefits after implementation is even more difficult. Continue Reading
-
Definition
24 Feb 2023
sudo (su 'do')
Sudo is a command-line utility for Unix and Unix-based operating systems such as Linux and macOS. Continue Reading
-
Opinion
03 Feb 2023
4 identity predictions for 2023
Identity's place in the attack chain is driving the shift of identity responsibility from IT operations to security to look into passwordless, digital IDs, platforms and more. Continue Reading
-
Definition
29 Dec 2022
credential theft
Credential theft is a type of cybercrime that involves stealing a victim's proof of identity. Continue Reading
-
Definition
29 Dec 2022
self-sovereign identity
Self-sovereign identity (SSI) is a model for managing digital identities in which individuals or businesses have sole ownership over the ability to control their accounts and personal data. Continue Reading
-
Definition
29 Dec 2022
continuous authentication
Continuous authentication is a method of verification aimed at providing identity confirmation and cybersecurity protection on an ongoing basis. Continue Reading
-
Definition
28 Dec 2022
privilege creep
Privilege creep is the gradual accumulation of access rights beyond what individuals need to do their job. Continue Reading
-
News
15 Dec 2022
Google drops TrustCor certificates as questions loom
Google joined Mozilla and Microsoft in removing support for TrustCor Systems certificates following a Washington Post report on TrustCor's connections to spyware vendors. Continue Reading
-
Tip
13 Dec 2022
What are the differences between su and sudo commands?
Linux administrators have choices when deciding how to delegate privileges. Learn about the options they can take while ensuring their operations remain secure. Continue Reading
-
Tip
06 Dec 2022
How to implement least privilege access in the cloud
More organizations are moving their resources to the cloud but are not paying attention to how cloud access privileges are allocated. Learn how to limit access in the cloud. Continue Reading
-
News
01 Dec 2022
Mozilla, Microsoft drop Trustcor as root certificate authority
Mozilla and Microsoft removed support for TrustCor certificates after a Washington Post report revealed the company's ties to government contractors specializing in spyware. Continue Reading
-
News
15 Nov 2022
Twitter users experience apparent SMS 2FA disruption
The 2FA notification disruption occurred after CEO Elon Musk announced plans to shutter a majority of Twitter's microservices, though reasons for the outage are unconfirmed. Continue Reading
-
News
10 Nov 2022
TrustCor under fire over certificate authority concerns
TrustCor Systems, a certificate authority registered in Panama, is in hot water after a Washington Post report raised questions about its apparent connections to a spyware vendor. Continue Reading
-
Feature
08 Nov 2022
5 ways to overcome multifactor authentication vulnerabilities
Improve the resiliency of multifactor authentication by giving users more information, making default settings more secure, hiding secrets and more. Continue Reading
-
Tip
26 Oct 2022
Why it's time to expire mandatory password expiration policies
Password expiration policies that force users to regularly reset passwords are counterproductive. It's time to align those policies with proven approaches to password security. Continue Reading
-
Tip
24 Oct 2022
6 ways to prevent privilege escalation attacks
Privileges dictate the access a user or device gets on a network. Hackers who access these privileges can create tremendous damage. But there are ways to keep your networks safe. Continue Reading
-
Definition
20 Oct 2022
What is the zero-trust security model?
The zero-trust security model is a cybersecurity approach that denies access to an enterprise's digital resources by default and grants authenticated users and devices tailored, siloed access to only the applications, data, services and systems they need to do their jobs. Continue Reading
-
Tip
12 Oct 2022
An overview of the CISA Zero Trust Maturity Model
A zero-trust framework blocks all attempts to access internal infrastructure without authentication. The CISA Zero Trust Maturity Model is a roadmap to get there. Continue Reading
-
Tip
11 Oct 2022
Top 6 challenges of a zero-trust security model
Zero trust has a number of challenges, but because the model is highly beneficial, it's important for organizations to learn how to overcome them. Continue Reading
-
Tip
11 Oct 2022
How to conduct a cybersecurity audit based on zero trust
This checklist offers guidance on how to prepare for a zero-trust cybersecurity audit and helps document how well cybersecurity controls are performing based on CISA's ZTMM. Continue Reading
-
Tip
07 Oct 2022
Perimeter security vs. zero trust: It's time to make the move
Perimeter security requires a border to protect enterprise data. With more and more users working outside that border, zero trust promises a better security option for the future. Continue Reading
-
Feature
05 Oct 2022
Top zero-trust certifications and training courses
Most organizations are expected to implement zero trust in the next few years. Learn about zero-trust certifications and trainings that can help prepare your security team. Continue Reading
-
Opinion
29 Sep 2022
Multifactor authentication isn't perfect, passwordless is better
Passwords are frequently the root cause of breaches, and multifactor authentication only provides a stopgap for account protection. It's time to adopt a passwordless strategy. Continue Reading
-
Tip
29 Sep 2022
The 5 principles of zero-trust security
Zero trust is a journey, not a destination. Ensure your corporate network is safe from internal and external threats by implementing these five principles of zero-trust security. Continue Reading
-
Tip
28 Sep 2022
Why zero trust requires microsegmentation
Microsegmentation is a key security technique that enables organizations to achieve a zero-trust model and helps ensure the security of workloads regardless of where they are located. Continue Reading
-
Answer
28 Sep 2022
Compare zero trust vs. the principle of least privilege
Zero trust and the principle of least privilege may appear to solve the same issue, but they have their differences. Read up on the two methodologies. Continue Reading
-
News
21 Sep 2022
Cybercriminals launching more MFA bypass attacks
New research from Okta shows that cybercrime groups have stepped up their attacks on multifactor authentication systems in an effort to thwart account security measures. Continue Reading
-
News
01 Sep 2022
Researcher unveils smart lock hack for fingerprint theft
An academic researcher demonstrated how IoT smart locks could become tools for attackers to covertly steal fingerprints and potentially access more sensitive personal data. Continue Reading
-
Tip
18 Aug 2022
What is identity sprawl and how can it be managed?
With identity-based attacks on the rise, organizations need to prioritize identity management. Learn about identity sprawl, why it's a risk and how it can be managed. Continue Reading