Identity & Access Management

Risk & Repeat: Who's to blame for bad passwords?

This week's Risk & Repeat podcast discusses whether users are responsible for creating and reusing weak passwords or if the technology systems themselves are to blame. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Zero-trust security means new thinking plus practical steps

Implementing a security policy that, essentially, trusts no one and nothing doesn't have to be overwhelming if you understand the basics behind the security model. Continue Reading

By

• Johna Till Johnson, Nemertes Research

How does signed software help mitigate malware?

Okta researchers found a bypass that allows macOS malware to pose as signed Apple files. Discover how this is possible and how to mitigate this attack. Continue Reading

By

• Nick Lewis

How the Microsoft Authenticator app integrates with Azure AD

Microsoft expanded the Microsoft Authenticator app to integrate with tens of thousands of Azure AD apps. Expert Dave Shackleford explains how this tool is improving security. Continue Reading

By

• Dave Shackleford, Voodoo Security

How can U2F authentication end phishing attacks?

By requiring employees to use U2F authentication and physical security keys, Google eliminated phishing attacks. Learn how the combination works from expert Michael Cobb. Continue Reading

By

• Michael Cobb

How to monitor AWS credentials with the new Trailblazer tool

A security researcher introduced a tool called Trailblazer, which aims to simplify monitoring AWS credentials. Expert Dave Shackleford explains how it can bolster cloud security. Continue Reading

By

• Dave Shackleford, Voodoo Security

U.S. government domain officials to start using 2FA

The government domain registrar -- DotGov -- began rolling out two-factor authentication for officials managing .gov domains in order to mitigate against DNS hijacking. Continue Reading

By

• Michael Heller, TechTarget

How was Google Firebase security bypassed?

Google Firebase's inadequate back-end development led to data leaks and vulnerabilities, including HospitalGown. Learn more about this security flaw from expert Michael Cobb. Continue Reading

By

• Michael Cobb

Risk & Repeat: Inside the Facebook 2FA fail

This week's Risk & Repeat podcast discusses the latest controversy for Facebook, which has been using two-factor authentication numbers for advertising purposes. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

DigiCert, Gemalto and ISARA to provide quantum-proof certificates

Quantum computing threats are on the horizon, but DigiCert, Gemalto and ISARA have teamed up to develop new quantum-proof digital certificates and remake the PKI industry. Continue Reading

By

• Robert Richardson

User behavior analytics tackles cloud, hybrid environments

Integration of user behavior analytics as a feature of other security technologies such as SIEM and data loss prevention shows no sign of slowing down. User behavior analytics tools develop baselines and then correlate threat events, user and entity context, and peer analytics to alert security analysts of unusual activity.

Gartner expects user entity and behavior analytics techniques to become embedded in roughly 80% of the threat detection and incident response market by 2022. But between now and then, it appears more user behavior analytics tools are headed for optimization in the cloud. This optimization involves not only the analytical models, but also performance and cost.

"When you properly optimize analytics, the bill that you get from Amazon can be orders of magnitude smaller," said Stephan Jou, CTO of Interset Software Inc., an OEM provider that also offers stand-alone security analytics tools.

In this issue of Information Security, we look at new functionality in user behavior analytics and security analytics, and how these machine learning tools are attempting to help security operations centers stay on top of insider threats, external dangers and cloud security monitoring.

 Continue Reading

Microsoft wants to eliminate passwords -- and there's an app for that

At its Ignite 2018 conference, Microsoft declared an end to the password era and extended support for its Microsoft Authenticator app to Azure AD-connected apps. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Google Chrome sign-in changes cause confusion and concern

Google Chrome sign-in changes are being criticized by experts, and poor communication from Google has led to more confusion about user privacy and consent. Continue Reading

By

• Michael Heller, TechTarget

Hardcoded credentials continue to bedevil Cisco

Cisco hit by yet another new hardcoded credentials flaw, the latest in a long line of such flaws since last year, this time in its video surveillance manager appliance. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

PulseNet: How do improper authentication flaws affect it?

GE reported an improper authentication flaw in its PulseNet network management software for critical infrastructures. Discover how this flaw works with Judith Myerson. Continue Reading

By

• Judith Myerson

Securing remote access for cloud-based systems

Don't believe the hype: Access control in the cloud is not a lost cause. Read these tips to learn how you can better secure remote access to your cloud-based systems. Continue Reading

By

• (ISC) 2

How does a WDC vulnerability put hardcoded passwords at risk?

Several vulnerabilities were found in Western Digital's My Cloud, including one that affects the default hardcoded password. Learn how to avoid such risks with expert Nick Lewis. Continue Reading

By

• Nick Lewis

How Azure AD uses cloud access control to protect credentials

Features such as Microsoft Azure AD Smart Lockout and Password Protection add security via trusted authentication. Learn more about cloud access control from expert Ed Moyle. Continue Reading

By

• Ed Moyle, SecurityCurve

How hard-coded credentials threaten ICS security

Hard-coded credentials open industrial control systems up to unauthorized access by malicious actors and threaten ICS security. Expert Ernie Hayden explains the threat and what enterprises can do about it. Continue Reading

By

• Ernie Hayden, 443 Consulting LLC

Weighing privileged identity management tools' pros and cons

Products that help security pros manage access privileges are essential to IT security. Learn how to evaluate market offerings and acquire the best for your company. Continue Reading

By

• Michael Cobb

OneLogin security chief delivers new security model

How did cloud identity and access management vendor OneLogin rebuild its security after a breach? We ask OneLogin security chief Justin Calmus. Continue Reading

By

• Kathleen Richards

How to mitigate the Efail flaws in OpenPGP and S/MIME

Efail exploits vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext in encrypted emails. Learn more about the Efail vulnerabilities from expert Michael Cobb. Continue Reading

By

• Michael Cobb

With Pwned Passwords API, annoying password policies can finally go away

Update password policies at your company by following the 2017 NIST regulations—improving user experience drastically, and the Pwned Passwords API can help. Continue Reading

By

• Kyle Johnson, Technology Editor

10 unified access management questions for OneLogin CSO Justin Calmus

Enterprise security veteran Justin Calmus, who describes himself as an avid hacker, joined OneLogin as the CSO earlier this year. After last year's breach, who would want this job? Continue Reading

By

• Kathleen Richards

Reddit breach sparks debate over SMS 2FA

Using two-factor authentication with one-time passwords sent via SMS has come under question again after a Reddit breach was blamed on the faulty 2FA method. Continue Reading

By

• Michael Heller, TechTarget

Anonymity tools: Why the cloud might be the best option

The cloud might be the best of the available anonymity tools. Expert Frank Siemons explains the other options for anonymity for security and why the cloud is the best for privacy. Continue Reading

By

• Frank Siemons, RedSec

Physical security keys eliminate phishing at Google

Successful phishing attempts have been eliminated among Google employees following a requirement to use physical security keys in order to gain access to all Google accounts. Continue Reading

By

• Michael Heller, TechTarget

As AI identity management takes shape, are enterprises ready?

Experts at the Identiverse 2018 conference discussed how artificial intelligence and machine learning are poised to reshape the identity and access management market. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

The threat of shadow admins in the cloud to enterprises

Having shadow admins in the cloud means unauthorized users can access everything a legitimate administrator can. Expert Ed Moyle explains how this works and how to stop it. Continue Reading

By

• Ed Moyle, SecurityCurve

How did an old, unpatched Firefox bug expose master passwords?

A Firefox bug went undetected for nine years. Expert Michael Cobb explains how it enabled attackers to access the browser's master password and what's being done to mitigate it. Continue Reading

By

• Michael Cobb

Risk & Repeat: Is AI-driven identity management the future?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss Identiverse 2018 and how artificial intelligence is being applied to identity and access management. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Why a zero-trust network with authentication is essential

Zero-trust networks are often deemed compromised and untrusted, making authentication variables essential to security. Expert Matthew Pascucci explains a zero-trust security model. Continue Reading

By

• Matthew Pascucci

Yubikey is hot in the security space, so we tested the consumer experience

How easy is it to use Yubikey and would I recommend it? Continue Reading

By

• Kyle Johnson, Technology Editor

How can a text editor plug-in enable privilege escalation?

Developers use text editors to enhance efficiency in the workplace even though they require vulnerable third-party plug-ins. Discover these vulnerabilities with Judith Myerson. Continue Reading

By

• Judith Myerson

How can a hardcoded password vulnerability affect Cisco PCP?

Cisco patched a hardcoded password vulnerability found in their PCP software. Learn how the software works and how attackers can exploit this vulnerability with Judith Myerson. Continue Reading

By

• Judith Myerson

How does UBoatRAT use Google services and GitHub to spread?

A new remote access Trojan called UBoatRAT was found spreading via Google services and GitHub. Learn how spotting command-and-control systems can protect enterprises with Nick Lewis. Continue Reading

By

• Nick Lewis

Golden SAML: How can it abuse SAML authentication protocol?

CyberArk researchers created an attack called Golden SAML that uses Mimikatz techniques and applied it to a federated environment. Learn more about the attack with Nick Lewis. Continue Reading

By

• Nick Lewis

How does a SAML vulnerability affect single sign-on systems?

Researchers at Duo Security discovered a SAML vulnerability that enabled attackers to dupe single sign-on systems. Expert Michael Cobb explains how the exploit works. Continue Reading

By

• Michael Cobb

How will the new WPA3 protocol strengthen password security?

The development of WPA3 helps advance Wi-Fi protocol, as the next generation of Wi-Fi-enabled devices begins to demand more. Expert Michael Cobb explains how it differs from WPA2. Continue Reading

By

• Michael Cobb

Sexy, but stupid: Biometrics security requires balancing risks

When it comes to biometrics, security coexists with stupidity, unless implementers take the time to understand the limits, according to Adam Englander at RSAC 2018. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Akamai touts network perimeter security shifts, zero-trust model

As network perimeter security grows less practical, Akamai talks at RSA Conference about moving beyond firewalls to improve authentication with a zero-trust model. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Self-sovereign identity: How will regulations affect it?

Will laws like GDPR and PSD2 force enterprises to change their identity management strategies? Expert Bianca Lopes talks regulations, self-sovereign identity and blockchain. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

SSH announces new key and certificate management service

A new key and certificate management service is now offered by SSH, which teamed up with AppViewX to provide a way to administer cryptographic keys and digital certificates. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Will biometric authentication systems replace passwords?

Biometric authentication systems have gained traction on mobile devices, but when will they become dominant within the enterprise? Expert Bianca Lopes weighs in on the topic. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

How TLS mutual authentication for cloud APIs bolsters security

Secure access to cloud APIs is necessary but challenging. One viable option to combat that is TLS mutual authentication, according to expert Ed Moyle. Continue Reading

By

• Ed Moyle, SecurityCurve

SAP CSO Justin Somaini on using blockchain for security

Blockchain has generated both hype and skepticism, but SAP CSO Justin Somaini believes the technology has applications for security that can improve open source software. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Firefox bug exposes passwords to brute force -- for nine years

A Firefox bug exposing the browser's master password to a simple brute force attack against inadequate SHA-1 hashing is still on the books after nearly nine years. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

How can improper certificate pinning be stopped by the Spinner tool?

Researchers developed a tool to help prevent improper certificate pinning that causes security issues. Expert Michael Cobb reviews the issue and the Spinner tool. Continue Reading

By

• Michael Cobb

23,000 Symantec certificates revoked following leak of private keys

DigiCert revoked 23,000 Symantec SSL certificates amid a public spat between the company and former reseller partner Trustico, which claimed the certificates were 'compromised.' Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Single sign-on best practices: How can enterprises get SSO right?

Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good start. Here's how to do it. Continue Reading

By

• Joel Dubin
• Linda Rosencrance

New SAML vulnerability enables abuse of single sign-on

Duo Security discovered a new SAML flaw affecting several single sign-on vendors that allows attackers to fool SSO systems and log in as other users without their passwords. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Facebook's 2FA bug lands social media giant in hot water

Facebook came under fire after a two-factor authentication bug sent non-security notifications to users' phones, sparking a debate about media coverage and 2FA adoption. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Bypassing facial recognition: The means, motive and opportunity

Researchers bypassed Apple's facial recognition authentication program, Face ID, in under a week. Expert Michael Cobb explains why it's not a major cause for concern for users. Continue Reading

By

• Michael Cobb

How does credential stuffing enable account takeover attacks?

Credential stuffing activity is outpacing the growth of other cyberattacks and enabling account takeover attacks. Akamai Technologies' Patrick Sullivan explains the threat. Continue Reading

By

• Patrick Sullivan

Comodo calls out Symantec certificate issues, applauds Google

Bill Conner and Bill Holtz, who recently joined Comodo CA as chairman and CEO, respectively, discuss Symantec's certificate issues and their effect on the certificate market. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Risk & Repeat: Backdoor access, strong encryption debate rolls on

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the FBI's continued criticism of encrypted devices and the risks of vendor-created backdoor access points. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Public key pinning: Why is Google switching to a new approach?

After introducing HTTP Public Key Pinning to the internet two years ago, the upcoming Chrome will replace it with the Expect-CT header. Matt Pascucci explains the switch. Continue Reading

By

• Matthew Pascucci

Canvas fingerprinting: How does it compromise security?

Mozilla recently decided to pull the HTML canvas element from the Firefox browser. Learn from expert Matt Pascucci what this means for the security and privacy of users. Continue Reading

By

• Matthew Pascucci

Behavioral analytics, security go hand in hand

This Security School explores behavioral analytics as a tool for enhancing the security of enterprise systems and data. Continue Reading

Browser login managers allow tracking scripts to steal credentials

News roundup: Login managers enable the exposure of user credentials in over 1,000 websites. Plus, Mozilla patched a critical vulnerability in Thunderbird, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

CISSP Domain 5: Cloud identity management and access control

From cloud identity and access management to physical access control, this study guide will help you review key concepts from Domain 5 of the CISSP exam. Continue Reading

CISSP Domain 5 quiz: Types of access control systems

Get ready for the CISSP exam with this 10-question practice quiz covering key concepts in Domain 5, including access control, identity, authentication and more. Continue Reading

By

• (ISC) 2

How machine learning-powered password guessing impacts security

A new password guessing technique takes advantage of machine learning technologies. Expert Michael Cobb discusses how much of a threat this is to enterprise security. Continue Reading

By

• Michael Cobb

How can Windows digital signature check be defeated?

A security researcher discovered that editing two registry keys can alter a Windows digital signature check. Matt Pascucci explains what that means for digital signatures. Continue Reading

By

• Matthew Pascucci

Use caution with OAuth 2.0 protocol for enterprise logins

Many apps are using the OAuth 2.0 protocol for both authentication and authorization, but technically it's only a specification for delegated authorization, not for authentication. Continue Reading

By

• Michael Cobb

How to prevent password attacks and other exploits

Prevention is essential to protection against various types of password attacks, unauthorized access and related threats. Expert Adam Gordon outlines how to proactively bolster your defenses. Continue Reading

By

• (ISC) 2

Advanced Protection Program locks down Google accounts

Google's Advanced Protection Program greatly increases the security of user accounts, but the usability tradeoffs may not be worth it for average users. Continue Reading

By

• Michael Heller, TechTarget

Windows digital signature bypassed with two registry edits

The DerbyCon keynote covered why security research is an approachable field, as well as how to bypass a Windows digital signature check to run unwanted code. Continue Reading

By

• Michael Heller, TechTarget

Fearmongering around Apple Face ID security announcement

As fears grow over government surveillance, the phrase "facial recognition" often triggers a bit of panic in the public, and some commentators are exploiting that fear to overstate any risks ... Continue Reading

By

• Michael Heller, TechTarget

Google Cloud Key Management Service (KMS)

Google Cloud Key Management Service (KMS) is a cloud service for managing encryption keys for other Google cloud services that enterprises can use to implement cryptographic functions. Continue Reading

By

• Madelyn Bacon, TechTarget

Learn what network access control systems can do for you

Network access control systems keep rogue or compromised devices off of corporate networks. See how they work and the other security technologies with which they work. Continue Reading

By

• Rob Shapland

Common web application login security weaknesses and how to fix them

Flawed web application login security can leave an enterprise vulnerable to attacks. Expert Kevin Beaver reviews the most common mistakes and how to fix them. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

How can VMware vulnerabilities in vSphere expose credentials?

Two VMware vulnerabilities in vSphere Data Protection were recently patched. Expert Judith Myerson explains how the flaws work and how to defend against them. Continue Reading

By

• Judith Myerson

Are biometric authentication methods and systems the answer?

Biometric authentication methods, like voice, fingerprint and facial recognition systems, may be the best replacement for passwords in user identity and access management. Continue Reading

By

• Michael Cobb

Risk & Repeat: Why are Amazon S3 buckets spilling on the web?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the series of enterprise data leaks through misconfigured Amazon S3 buckets and what should be done about them. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Industry reacts to Symantec certificate authority trust remediation

As the Symantec certificate authority scrambles to transition its certificate-issuance operations to a subordinate certificate authority, the CA industry sharpens its knives. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Symantec certificate authority business reportedly for sale

As Google and Mozilla prepare plans to reduce trust for Symantec's certificate authority, the antivirus vendor is reported to be seeking a buyer for its web certificate business. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Risk & Repeat: Should IAM systems be run by machine learning?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the identity and access management industry and how machine learning algorithms could govern IAM systems. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Q&A: Ping CEO on contextual authentication, intelligent identity

Ping Identity CEO Andre Durand talks with SearchSecurity about the data-driven move toward contextual authentication and intelligent identity and what this means for enterprises. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

WoSign CA certificates get end-of-trust date in Chrome

Google to distrust all WoSign CA certificates in Chrome starting in September, as the troubled certificate authority passed a key audit and is seeking a new CEO to help return trust. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

How did Webroot's antivirus signature update create false positives?

A Webroot antivirus signature update flagged Windows and Windows applications as dangerous. Expert Matthew Pascucci explains how it happened and what Webroot did about it. Continue Reading

By

• Matthew Pascucci

Risk & Repeat: Symantec, Mozilla spar over certificate issuance

In this week's Risk & Repeat podcast, SearchSecurity editors discuss Mozilla's suggested deadline for Symantec to turn over its certificate issuance operations. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Privileged user management trips up NSA

News roundup: DOD inspector general found NSA failed to implement secure privileged user management post-Snowden. Plus, Honda hit by WannaCry, Trump met with tech CEOs and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Machine learning in cybersecurity is coming to IAM systems

Machine learning in cybersecurity applications for identity management systems are becoming more common today. But will algorithms be the best option for authenticating and authorizing users? Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Hardcoded passwords could cause full IoT camera compromise

IoT cameras could be fully compromised due to multiple vulnerabilities, including hardcoded passwords that can be used regardless of user settings. Continue Reading

By

• Michael Heller, TechTarget

Symantec certificate authority aims for more delays on browser trust

Is the Symantec certificate authority operation too big to fail? That seems to be the message the security giant is sending in its latest response to a proposal from the browser community to turn ... Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Users' SSO information at risk after OneLogin security breach

News roundup: OneLogin security breach puts SSO data at risk but is vague about the details. Plus, Gmail boosts its phishing detection features, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Cloud access security brokers: Hard to tell what's real

Most cloud access security brokers offer CISOs a way to set policy and gain better understanding of multiple cloud services and data in use across the enterprise. As CASBs have gained momentum in recent years, use cases for them have expanded. Do these tools fill the gaps around visibility and control of software as a service and other cloud services?

Although cloud service visibility and data leak protection continue to be the biggest drivers, cloud access security brokers can do more than just help with your shadow IT problem and unsanctioned application activity in the cloud.

Organizations are increasingly looking to use cloud access security brokers to identify anomalies in data movement between on-premises and cloud apps as well as multiple cloud services. Malware identification and encryption of data have become important. More enterprises are also beginning to use CASBs or similar intermediary security technologies to provide some level of security policy management for custom identity-as-a-service platforms.

In this issue of Information Security magazine, we look at cloud access security brokers and the best ways to evaluate new models, such as infrastructure as a service and platform security.

 Continue Reading

RSA Authentication Manager offers a variety of authentication methods

With authentication methods ranging from risk-based to tokens, RSA Authentication Manager gives companies a number of ways to employ multifactor authentication. Continue Reading

By

• David Strom

Why WPA2-PSK can be a security risk even with an uncracked key

WPA2-PSK is a popular way to bolster wireless security, but it's not perfect. Expert Joseph Granneman explains WPA2 and other aspects of the complicated history of Wi-Fi security. Continue Reading

By

• Joseph Granneman, Illumination.io

Summing up Symantec VIP Service, a multifactor authentication tool

Expert David Strom looks at the Symantec VIP multifactor authentication product and how it can benefit enterprise security. Continue Reading

By

• David Strom

SecureAuth IdP: An overview of its multifactor authentication ability

Expert David Strom looks at how SecureAuth IdP uniquely combines multifactor authentication and single sign-on login capabilities in a single product. Continue Reading

By

• David Strom

VASCO IDENTIKEY Authentication Server and a look at its key features

Expert David Strom takes a closer look at VASCO's IDENTIKEY Authentication Server, one of the leading multifactor authentication products on the market. Continue Reading

By

• David Strom

TLS client authentication ensures secure IoT connection

The TLS client authentication protocol has been part of the security standard for years, but it's just now coming into its own in certifying secure IoT connections. Continue Reading

By

• Michael Heller, TechTarget

Risk & Repeat: Symantec offers plan to restore certificate trust

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss Symantec's continued struggles with certificate trust, and what Mozilla and Google are doing about it. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Symantec certificate authority offers counter-proposal to Google

Symantec certificate authority proposal takes the pain out of sanctions for misissued certs, offers more audits, greater transparency and promise of "continuous improvement." Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Is your IAM policy a roadmap to security or leading you off a cliff?

Identity and access management, or IAM, has long been a crucial consideration in the formulation of corporate security strategy. IAM policy today must contend with a variety of major changes sweeping the world of IT. One of the latest is the spread of cloud-based services, particularly the relativity new identity as a service. IDaaS and other products are having a significant impact on the market, as cloud-based IAM is now being released by both "establishment" players (i.e., Microsoft and Oracle) and next-gen companies like Ping Identity and Okta.

This Information Security magazine Insider Edition tackles these seismic changes in the "identity layer" and considers other factors affecting IAM policy now and how they have an impact. In addition, we look at multifactor authentication, which is an established identity security practice. But multifactor is not without its own challenges when to comes to implementation and maintenance. We also take a careful look at the specific risks to cloud-based IAM tools, from shadow IT, mobility and more.

Readers of the special edition of Information Security magazine on IAM policy and security concerns will come away better equipped to assess their current IAM policy and adapt it to the current and future world of IT.

 Continue Reading

Identity and access management strategy: Time to modernize?

More likely than not, your company's identity and access management strategy needs an update. Learn how to decide if that's the case and, if so, what you should do now. Continue Reading

By

• Michael Cobb

Risk & Repeat: Mozilla joins the Symantec certificate authority debate

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss mounting pressure on the Symantec certificate authority business to provide answers about its practices. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

How does the PoisonTap exploit bypass password locks on computers?

The PoisonTap exploit can bypass password locks on computers, enabling an attacker to remotely control systems. Expert Nick Lewis explains how the attack works. Continue Reading

By

• Nick Lewis