Identity & Access Management
Top Stories
-
Tip
28 Jul 2026
CISO's guide to data obfuscation
With so many services requiring access to sensitive data, encryption alone is not enough. Data obfuscation has evolved into a core element of modern cybersecurity architecture. Continue Reading
-
Tip
24 Jul 2026
CISO's guide to privileged identity management
IAM is more crucial than ever in the AI era. To better control who -- and what -- is accessing systems and data, security teams need to move beyond standing access privileges. Continue Reading
-
Feature
22 Jul 2020
Zero-trust framework ripe for modern security challenges
What is zero-trust security, and why deploy it now? Analysts explain its importance in the current IT era and how to get started with evaluation and implementation. Continue Reading
-
News
17 Jul 2020
Identity theft subscription services uncovered on dark web
Identity theft subscriptions are now being offered on the dark web. This information is being used for carding operations, account generation and other cybercrime schemes. Continue Reading
-
Answer
15 Jun 2020
How to protect workloads using a zero-trust security model
Never trust, always verify. Learn how to implement a zero-trust security model to help manage risk and protect IT workloads at your organization. Continue Reading
-
Tip
11 Jun 2020
3 key identity management tips to streamline workflows
Organizations must audit IAM processes to ensure that opportunities to streamline workflows are not missed. Use these identity management tips to get started. Continue Reading
-
Tip
09 Jun 2020
How to ensure security for 3 types of digital identity
Enterprise identity and access management strategies must include processes for managing and securing three types of digital identity. Learn how. Continue Reading
-
Tip
03 Jun 2020
4 essential identity and access management best practices
Now is the time to shore up the who, what and where of network identities. Adopt these four critical identity and access management best practices to bolster your infosec program. Continue Reading
-
Tip
01 Jun 2020
How to fortify IoT access control to improve cybersecurity
Security technology is still playing catch-up with the new risks and attack vectors associated with IoT. Learn how to improve IoT access control and identity management here. Continue Reading
-
News
23 Apr 2020
COVID-19 strains critical certificate authority processes
Border crossings. Police checkpoints. Security cages. Secret safes. These are just some of the hurdles certificate authorities face as they strive to maintain security during COVID-19. Continue Reading
-
News
08 Apr 2020
Researchers beat fingerprint authentication with 3D printing scheme
New research by Cisco Talos shows popular fingerprint scanning technology can be defeated by lifting actual fingerprints and reproducing them through 3D printers. Continue Reading
-
Tip
06 Apr 2020
SASE identity policies enhance security and access control
Will the Secure Access Service Edge model be the next big thing in network security? Learn how SASE's expanded definition of identity is fundamental to this emerging access model. Continue Reading
-
Opinion
03 Mar 2020
Idaptive adds new remote employee onboarding option & passwordless authentication to Next-Gen Access
Seeing more and more vendors jump on the passwordless train makes my heart swell! Continue Reading
-
Opinion
26 Feb 2020
RSA 2020 day 1: Windows 10X & secured core PCs; Hysolate updates; LastPass passwordless login
Security-focused conferences are my time to shine--and geek out on the latest in security news. Continue Reading
-
Tip
25 Feb 2020
Tackle identity management in the cloud with AaaS or IDaaS
Has your organization considered outsourcing cloud identity management? Learn more about the benefits of AaaS, aka IDaaS, and what to consider before settling on a particular service. Continue Reading
-
News
12 Feb 2020
Data security, IAM led cybersecurity investments in 2019
Vendors specializing in data security, risk and compliance, and IAM raised the most funding in 2019, according to Momentum Cyber, a strategic advisor and investment bank for the cybersecurity industry. Continue Reading
-
Opinion
10 Feb 2020
Idaptive is taking machine learning for authentication and applying it to authorization
We’ve seen AI/ML/analytics used for figuring out if a user is who they say they are. Now, how about if they’re doing what they should? Continue Reading
-
Feature
31 Jan 2020
Can IDaaS adoption improve enterprise security posture?
Experts suggest enterprises consider identity as a service as organizations' data management needs grow and access management becomes more complex. Continue Reading
-
Opinion
27 Jan 2020
Where does 1Password Enterprise Password Manager fit in the EUC landscape?
Reduce the chance of a breach due to poor password habits with password vaulting. Continue Reading
-
Answer
21 Jan 2020
How effective are traditional authentication methods?
Are you up to date on the most popular digital authentication methods and their potential cybersecurity risks? Learn how the right technology can improve and secure access management. Continue Reading
-
Opinion
17 Dec 2019
Login.gov starts to fill the gap between social logins and enterprise identities
Access federal services with a service designed for governmental use but that uses common standards. Continue Reading
-
News
13 Dec 2019
Google expands multiple Chrome password protection features
Chrome's updated, built-in protections are intended to help users protect their passwords and data against malware, data breaches and phishing sites, according to the company. Continue Reading
-
News
13 Dec 2019
RSA teams up with Yubico for passwordless authentication
RSA Security joined forces with Yubico to eliminate passwords within the enterprise. RSA's Jim Ducharme explains what it will take to the reach the 'last mile' of the pursuit. Continue Reading
-
Tip
05 Dec 2019
How to implement zero-trust cloud security
The nature of cloud environments and workloads is changing. Security team approaches must evolve in response. Learn how to implement zero-trust cloud security from expert Dave Shackleford. Continue Reading
-
Tip
20 Nov 2019
How to use and manage BitLocker encryption
Built into business versions of the Windows OS, Microsoft BitLocker encryption is an integral enterprise encryption tool. Read on to learn how BitLocker works and how to manage it. Continue Reading
-
Answer
20 Nov 2019
Comparing Diffie-Hellman vs. RSA key exchange algorithms
See which encryption method uses digital signatures, symmetric key exchanges, bulk encryption and much more in this Diffie-Hellman vs. RSA showdown. Continue Reading
-
Feature
07 Nov 2019
Creating and managing a zero-trust security framework
IEEE senior member Kevin Curran outlines how enterprises should introduce a zero-trust security framework and discusses implementation challenges they are likely to face. Continue Reading
-
Opinion
29 Oct 2019
How to go passwordless if not all your apps support modern authentication standards
We want to eliminate passwords ASAP, unfortunately, some older apps can stand in the way of progress—thankfully, some identity providers devised solutions. Continue Reading
-
Opinion
17 Oct 2019
Okta competing with Microsoft, Google, and others in passwordless offerings
While giants Microsoft and Google try leading the passwordless charge, Okta also plans to help organizations cut down on password use. Continue Reading
-
Opinion
15 Oct 2019
NIST offers a handy vendor-neutral overview of zero trust architecture
Curious about zero trust but don’t understand it yet or how to achieve it, then NIST is here to help you. Continue Reading
-
Opinion
14 Oct 2019
Okta is making big investments in on-premises identity
Okta is also working to bring more context into access decisions. Continue Reading
-
Opinion
09 Oct 2019
How far is Google going in eliminating passwords?
We looked at Microsoft, let’s see how a couple other vendors are doing as well, starting with Google. Continue Reading
-
News
03 Oct 2019
Ping Identity launches identity and access management tool
PingCentral aims to streamline the identity and access management processes and bridge the gap between IAM teams and application teams to improve productivity. Continue Reading
-
Opinion
24 Sep 2019
When will we finally ditch passwords? Here’s Microsoft’s 4-step plan
Let’s be honest, passwords suck, and vendors are working to eliminate or reduce our reliance on them—what is Microsoft’s roadmap? Continue Reading
-
Tip
17 Sep 2019
RPA security best practices include access control, system integration
Robotic process automation can revolutionize enterprise workflows, but if RPA security risks aren't controlled, bots could end up doing more harm than good. Continue Reading
-
Opinion
17 Sep 2019
A look at ID proofing: bootstrapping a digital ID using a mobile device and physical ID
For the moment, it’s more for B2C than for employees, but it’s poised to keep spreading. Continue Reading
-
Answer
16 Sep 2019
What's the purpose of CAPTCHA technology and how does it work?
Learn about the purpose of CAPTCHA challenges that enable websites to differentiate bots from authentic users to stop spammers from hijacking forums and blog comment sections. Continue Reading
-
Quiz
16 Sep 2019
Test your infosec smarts about IAM and other key subjects
Solidify your knowledge and get CPE credits by taking this quiz on IAM, security frameworks, IoT third-party risks and more. Continue Reading
-
News
08 Aug 2019
'Dupe' there it is: SAML authentication bypass threatens Microsoft
Micro Focus security researchers demonstrated a new technique, dubbed 'dupe key confusion,' which allows threat actors to bypass Microsoft's SAML token validation. Continue Reading
-
News
02 Aug 2019
CloudKnox Security adds privileged access features to platform
CloudKnox Security updated its Cloud Security Platform with features such as Privilege-on-Demand, Auto-Remediation for Machine Identities and Anomaly Detection. Continue Reading
-
Feature
01 Aug 2019
New tech steers identity and access management evolution
IAM is evolving to incorporate new technologies -- like cloud-based services and containerization -- promising more secure, granular management of access to company IT assets. Continue Reading
-
Opinion
01 Aug 2019
Is your identity management up to the task?
IAM is an organization's best defense for its weakest link, end users. Make sure you're following the right framework and keeping your tools honed and ready for battle. Continue Reading
- E-Zine 01 Aug 2019
-
Tip
25 Jul 2019
How to limit the cloud security blast radius of credential attacks
Explore how the security blast radius concept, which has admins evaluating how to assess and limit the damage of a threat, can be applied to cloud identity and access management. Continue Reading
-
News
24 Jul 2019
Citrix breach blamed on poor password security
An investigation revealed the password spraying attack that gave malicious actors access to Citrix systems resulted in only some business documents being stolen. Continue Reading
-
Opinion
24 Jul 2019
What's the difference between a password and a PIN?
A question I've always had but was too afraid to ask when I first learned about passwordless experiences. Continue Reading
-
Tip
23 Jul 2019
Which is better: anomaly-based IDS or signature-based IDS?
Even as vendors improve IDS by incorporating both anomaly-based IDS and signature-based IDS, understanding the difference will aid intrusion protection decisions. Continue Reading
-
Opinion
23 Jul 2019
A look at MobileIron’s zero sign-on and passwordless authentication plans
MobileIron’s “zero sign-on” tech uses phones to authenticate when accessing SaaS apps from unmanaged devices. Continue Reading
-
News
19 Jul 2019
Enzoic for Active Directory brings continuous password protection
Updates to Enzoic for Active Directory include NIST-compliant Continuous Password Protection, checking passwords against a live database of common or vulnerable passwords. Continue Reading
-
News
19 Jul 2019
CyberArk brings updates to privileged access security offering
CyberArk introduces CyberArk Alero to its privileged access management product lineup, in addition to other endpoint management and cloud offering updates. Continue Reading
-
Tip
17 Jul 2019
The benefits of IAM can far outweigh the costs
Identity and access management is a critical piece of enterprise information security. But the benefits of IAM go beyond illuminating who -- and what -- might be using your network. Continue Reading
-
News
09 Jul 2019
OneLogin Desktop Pro for Windows reduces password load
By eliminating the need for remote workers to sign into Active Directory to access their network, OneLogin's Desktop Pro for Windows aims to make working remotely easier, according to the vendor. Continue Reading
-
News
08 Jul 2019
Ipsidy's Identity Portal uses biometrics for secure access
Identity Portal by Ipsidy uses biometric authorization methods to ensure secure account access, enable users to verify changes, protect customers from fraudulent phone calls, and more. Continue Reading
-
Feature
27 Jun 2019
Words to go: Identity and access management security
IT pros must keep up to date with rapidly changing identity technology and access threats. Help protect IAM security by getting familiar with this list of foundation terms. Continue Reading
-
Tip
25 Jun 2019
What identity governance tools can do for your organization
Learn how to evaluate available security tools that manage the governance of your users' identity and access to company systems and data. Continue Reading
-
Feature
21 Jun 2019
Biometric authentication terms to know
Consumers are on board with biometric authentication, but enterprises aren't so sure. Here's a breakdown of the must-know terms for companies considering biometric authentication. Continue Reading
-
Opinion
20 Jun 2019
Despite recent vulnerabilities, you shouldn’t stop using hardware security keys like Yubikey
No solution is perfect, but these hardware security keys remain an awesome option in keeping accounts secure from attackers! Continue Reading
-
News
17 Jun 2019
YubiKey FIPS recalled from government for reduced randomness
Yubico recalled YubiKey FIPS series devices after discovering an issue leading to reduced randomness in values generated by the keys, which are used by federal agencies. Continue Reading
-
Tip
07 Jun 2019
3 reasons privilege escalation in the cloud works
Statistics show that many cloud attacks are linked to credential and privilege misuse. Learn three ways threat actors are able to launch privilege escalation attacks in the cloud. Continue Reading
-
News
05 Jun 2019
Apple single sign-on option promises privacy for users
Apple is preparing its own single sign-on offering, called Sign In with Apple, which will focus on user privacy. But experts are split on how well this will work. Continue Reading
-
Tip
04 Jun 2019
Zero-trust security model means more than freedom from doubt
A zero-trust security model has a catchy name, but the methodology means more than not trusting any person or device on the network. What you need to know. Continue Reading
-
Answer
31 May 2019
Why are fewer companies using SMS 2FA for authentication?
Instead of SMS two-factor authentication, some companies are switching to 2FA through messaging apps and social media platforms. Learn what's behind this authentication trend. Continue Reading
-
News
17 May 2019
How Google turned 1.5 billion Android phones into 2FA keys
Google product manager Christiaan Brand discusses the journey to making 1.5 billion Android devices work as 2FA security keys and the plan for the future. Continue Reading
-
Answer
13 May 2019
How does an identity and access management framework work?
A comprehensive identity and access management framework is an IT necessity. But how do the two components work together? Continue Reading
-
Opinion
07 May 2019
We talk a lot about access and authentication, but what about revoking user access?
Google hopes to make it easier with their proposed Continuous Access Evaluation Protocol. Continue Reading
-
Feature
06 May 2019
5 common authentication factors to know
Multifactor authentication is a security system that requires two or more authentication steps to verify the user's identity. Discover the most important terms related to MFA. Continue Reading
-
Infographic
01 May 2019
Are users your biggest risk? Raise IT security awareness
Users are either your best line of defense or greatest vulnerability. Learn how attackers exploit human behavior and fight back by improving user security awareness. Continue Reading
-
Tip
18 Apr 2019
Identity and access management trends show new access roles
Identity and access management trends reflect a changing cybersecurity landscape. Learn how IAM is changing and what you should do before buying an IAM tool. Continue Reading
-
News
12 Apr 2019
WPA3 flaws found in Dragonfly handshake
Researchers discovered vulnerabilities in the WPA3 protocol, specifically in the Dragonfly handshake authentication, allowing for multiple exploits branded Dragonblood. Continue Reading
-
Answer
26 Mar 2019
Can PDF digital signatures be trusted?
Digital signatures on PDF documents don't necessarily guarantee their contents are valid, as new research shows viewer implementations don't always detect incomplete signatures. Continue Reading
-
Feature
26 Mar 2019
Zero-trust security model primer: What, why and how
What exactly is a zero-trust security model? This primer explains the basics about the philosophy behind how designing a security architecture strictly limits access to all, not just outsiders. Continue Reading
-
News
22 Mar 2019
Study reveals sale of SSL/TLS certificates on dark web
Security researchers discovered the availability of SSL/TLS certificates for sale on the dark web, which allow cybercriminals to disguise their malicious activity as legitimate. Continue Reading
-
News
22 Mar 2019
Chris Wysopal talks blockchain hype and realistic uses
While marketers ride the hype train around blockchain, Chris Wysopal says there are realistic uses for the technology. And there are blockchain risks that need to be considered, as well. Continue Reading
-
News
01 Mar 2019
Research sparks debate over password manager vulnerabilities
Researchers found several popular password managers expose master passwords in system memory, but experts recommend consumers and enterprises should still use the products. Continue Reading
-
Tutorial
01 Mar 2019
Mimikatz tutorial: How it hacks Windows passwords, credentials
In this Mimikatz tutorial, learn about the password and credential dumping program, where you can acquire it and how easy it makes it to compromise system passwords. Continue Reading
-
Tip
20 Feb 2019
Key steps to put your zero-trust security plan into action
There are three key categories of vendor zero-trust products. Learn what they are, and how to evaluate and implement the one that's best for your company. Continue Reading
-
Answer
19 Feb 2019
How did Signal Desktop expose plaintext passwords?
The Signal Desktop application was found to be making decryption keys available in plaintext. Learn how the SQLite database and plaintext passwords were put at risk. Continue Reading
-
News
15 Feb 2019
Ponemon study: Poor password practices remain rampant
More than two-thirds of employees share passwords with colleagues, research reveals. Experts sound off on what's fueling poor password practices and how to solve the problem. Continue Reading
-
Answer
14 Feb 2019
How can credential stuffing attacks be detected?
Credential stuffing attacks can put companies that offer online membership programs, as well as their customers, at risk. Find out how to proactively manage the threat. Continue Reading
-
News
13 Feb 2019
Dunkin' security alert warns of new credential-stuffing attacks
Dunkin' sent a security alert to customers warning of potentially malicious access of accounts due to the second credential stuffing attack in less than three months. Continue Reading
-
Opinion
11 Feb 2019
Idaptive officially launches their “Next-Gen Access Cloud” IDaaS platform
Next-Gen Access Cloud has a new architecture, and Idaptive will continue to expand its machine learning capabilities. Continue Reading
-
News
08 Feb 2019
Defense Department eyes behavioral biometrics with new contract
The Department of Defense awards a $2.4 million contract to Twosense.AI in order to create a behavioral biometrics system that can replace the current ID card system. Continue Reading
-
Podcast
08 Feb 2019
Risk & Repeat: Apple restores enterprise certificates for Facebook, Google
This week's Risk & Repeat podcast looks at Apple's decision to temporarily revoke Facebook's and Google's enterprise certificates following reports of questionable app activity. Continue Reading
-
News
06 Feb 2019
Google's Mark Risher: New types of 2FA are 'game changers'
Google's head of account security, Mark Risher, discusses the various types of 2FA and how new options of WebAuthn and U2F are going to be game changers for enterprise. Continue Reading
-
News
06 Feb 2019
Google's Mark Risher discusses 2FA adoption strategies
Although some types of two-factor authentication have been found to be vulnerable, Google's Mark Risher says 2FA adoption should be the baseline of security for all enterprises. Continue Reading
-
News
29 Jan 2019
Dailymotion credential stuffing attacks lasted more than 6 days
Video-sharing website Dailymotion reset passwords for an unknown number of users following 'large-scale' credential stuffing attacks that lasted for more than six days before being stopped. Continue Reading
-
Tip
28 Jan 2019
The evolution of the Let's Encrypt certificate authority
Certificate authorities work differently since the open source Let's Encrypt project went into effect. Expert Fernando Gont explains how both CAs and Let's Encrypt operate. Continue Reading
-
Answer
24 Jan 2019
How can synthetic clicks aid a privilege escalation attack?
An Apple security expert introduced the concept of synthetic clicks, which can bypass privilege escalation defenses. Find out how this new attack technique works with Nick Lewis. Continue Reading
-
Feature
23 Jan 2019
Purchasing multifactor authentication tools: What to consider
Find out what you need to know before investing in a multifactor authentication tool, including the drawbacks and the benefits. Continue Reading
-
Answer
22 Jan 2019
How can attacks bypass Windows Driver Signature Enforcement?
Security researchers demonstrated how a new fileless attack technique can bypass a Windows kernel protection feature at Black Hat 2018. Find out how the technique works. Continue Reading
-
Feature
18 Jan 2019
Exploring multifactor authentication benefits and technology
Take a look at multifactor authentication benefits and methods, as well as how the technologies have evolved from key fobs to smartphones, mobile devices and the cloud. Continue Reading
-
Answer
14 Jan 2019
How can an authentication bypass vulnerability be exploited?
A vulnerability was found in Western Digital's My Cloud NAS device that can be easily exploited by hackers. Discover what this vulnerability is and how users can be protected. Continue Reading
-
Tip
11 Jan 2019
Key customer identity access management features to consider
Evaluating customer identity access management products is complicated but necessary. Learn what’s new and what you need most right now. Continue Reading
-
Tip
11 Jan 2019
CIAM vs. IAM: The key differences 'customer' makes
Find out everything you need to know about the nuances that differentiate customer IAM from traditional IAM so that you can implement the CIAM system at your organization. Continue Reading
-
News
10 Jan 2019
UnCAPTCHA attack updated to bypass spoken phrases
Researchers updated their unCAPTCHA proof of concept to be more efficient in bypassing audio CAPTCHAs and be able to handle spoken phrases and not just strings of numbers. Continue Reading
-
Tip
17 Dec 2018
For effective customer IAM, bundle security and performance
CIAM can verify identity, manage access and deliver a smooth experience for customers. Get an expert's insights on how to tackle customer IAM now. Continue Reading
-
Answer
06 Dec 2018
How can users remove Google location tracking completely?
Disabling Google location tracking involves more than turning off Location History. Learn how to manage your account settings to stop tracking entirely with expert Michael Cobb. Continue Reading
-
Tip
05 Dec 2018
What's different about Google Asylo for confidential computing?
The Google Asylo framework is an open source alternative for confidential computing. Expert Rob Shapland explains how it works and how it's different from other offerings. Continue Reading
-
Feature
03 Dec 2018
IAM system strategy identifies metrics that work for business
Security professionals are using identity and access management systems to track metrics on password resets, onboarding and offboarding, and employee retention and customer service. Continue Reading
-
Podcast
30 Nov 2018
Risk & Repeat: DeepMasterPrints spells trouble for biometrics
This week's Risk & Repeat podcast looks at the future of biometric authentication after researchers unveiled a new approach that uses neural networks to bypass fingerprint scanners. Continue Reading
-
News
21 Nov 2018
DeepMasterPrints fake fingerprints can fool fingerprint sensors
Researchers have developed AI-generated synthetic fingerprints -- known as DeepMasterPrints -- that can spoof biometric scanners and potentially be used to launch practical attacks. Continue Reading
-
Answer
21 Nov 2018
How were attackers able to bypass 2FA in a Reddit breach?
Reddit announced a breach after users were socially engineered and attackers bypassed 2FA protocols. Discover how this attack was possible and how sites can avoid falling victim. Continue Reading
