Identity & Access Management

How did Signal Desktop expose plaintext passwords?

The Signal Desktop application was found to be making decryption keys available in plaintext. Learn how the SQLite database and plaintext passwords were put at risk. Continue Reading

By

• Judith Myerson

Ponemon study: Poor password practices remain rampant

More than two-thirds of employees share passwords with colleagues, research reveals. Experts sound off on what's fueling poor password practices and how to solve the problem. Continue Reading

By

• Mekhala Roy

How can credential stuffing attacks be detected?

Credential stuffing attacks can put companies that offer online membership programs, as well as their customers, at risk. Find out how to proactively manage the threat. Continue Reading

By

• Nick Lewis

Dunkin' security alert warns of new credential-stuffing attacks

Dunkin' sent a security alert to customers warning of potentially malicious access of accounts due to the second credential stuffing attack in less than three months. Continue Reading

By

• Michael Heller, TechTarget

Idaptive officially launches their “Next-Gen Access Cloud” IDaaS platform

Next-Gen Access Cloud has a new architecture, and Idaptive will continue to expand its machine learning capabilities. Continue Reading

By

• Jack Madden

Defense Department eyes behavioral biometrics with new contract

The Department of Defense awards a $2.4 million contract to Twosense.AI in order to create a behavioral biometrics system that can replace the current ID card system. Continue Reading

By

• Michael Heller, TechTarget

Risk & Repeat: Apple restores enterprise certificates for Facebook, Google

This week's Risk & Repeat podcast looks at Apple's decision to temporarily revoke Facebook's and Google's enterprise certificates following reports of questionable app activity. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Google's Mark Risher: New types of 2FA are 'game changers'

Google's head of account security, Mark Risher, discusses the various types of 2FA and how new options of WebAuthn and U2F are going to be game changers for enterprise. Continue Reading

By

• Michael Heller, TechTarget

Google's Mark Risher discusses 2FA adoption strategies

Although some types of two-factor authentication have been found to be vulnerable, Google's Mark Risher says 2FA adoption should be the baseline of security for all enterprises. Continue Reading

By

• Michael Heller, TechTarget

Dailymotion credential stuffing attacks lasted more than 6 days

Video-sharing website Dailymotion reset passwords for an unknown number of users following 'large-scale' credential stuffing attacks that lasted for more than six days before being stopped. Continue Reading

By

• Michael Heller, TechTarget

The evolution of the Let's Encrypt certificate authority

Certificate authorities work differently since the open source Let's Encrypt project went into effect. Expert Fernando Gont explains how both CAs and Let's Encrypt operate. Continue Reading

By

• Fernando Gont, SI6 Networks

How can synthetic clicks aid a privilege escalation attack?

An Apple security expert introduced the concept of synthetic clicks, which can bypass privilege escalation defenses. Find out how this new attack technique works with Nick Lewis. Continue Reading

By

• Nick Lewis

Purchasing multifactor authentication tools: What to consider

Find out what you need to know before investing in a multifactor authentication tool, including the drawbacks and the benefits. Continue Reading

By

• David Strom

How can attacks bypass Windows Driver Signature Enforcement?

Security researchers demonstrated how a new fileless attack technique can bypass a Windows kernel protection feature at Black Hat 2018. Find out how the technique works. Continue Reading

By

• Nick Lewis

Exploring multifactor authentication benefits and technology

Take a look at multifactor authentication benefits and methods, as well as how the technologies have evolved from key fobs to smartphones, mobile devices and the cloud. Continue Reading

By

• David Strom

How can an authentication bypass vulnerability be exploited?

A vulnerability was found in Western Digital's My Cloud NAS device that can be easily exploited by hackers. Discover what this vulnerability is and how users can be protected. Continue Reading

By

• Judith Myerson

Key customer identity access management features to consider

Evaluating customer identity access management products is complicated but necessary. Learn what’s new and what you need most right now. Continue Reading

By

• Ed Moyle, SecurityCurve

CIAM vs. IAM: The key differences 'customer' makes

Find out everything you need to know about the nuances that differentiate customer IAM from traditional IAM so that you can implement the CIAM system at your organization. Continue Reading

By

• Ed Moyle, SecurityCurve

UnCAPTCHA attack updated to bypass spoken phrases

Researchers updated their unCAPTCHA proof of concept to be more efficient in bypassing audio CAPTCHAs and be able to handle spoken phrases and not just strings of numbers. Continue Reading

By

• Michael Heller, TechTarget

For effective customer IAM, bundle security and performance

CIAM can verify identity, manage access and deliver a smooth experience for customers. Get an expert's insights on how to tackle customer IAM now. Continue Reading

By

• Johna Till Johnson, Nemertes Research

How can users remove Google location tracking completely?

Disabling Google location tracking involves more than turning off Location History. Learn how to manage your account settings to stop tracking entirely with expert Michael Cobb. Continue Reading

By

• Michael Cobb

What's different about Google Asylo for confidential computing?

The Google Asylo framework is an open source alternative for confidential computing. Expert Rob Shapland explains how it works and how it's different from other offerings. Continue Reading

By

• Rob Shapland

IAM system strategy identifies metrics that work for business

Security professionals are using identity and access management systems to track metrics on password resets, onboarding and offboarding, and employee retention and customer service. Continue Reading

By

• Steve Zurier, ZFeatures

Risk & Repeat: DeepMasterPrints spells trouble for biometrics

This week's Risk & Repeat podcast looks at the future of biometric authentication after researchers unveiled a new approach that uses neural networks to bypass fingerprint scanners. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

DeepMasterPrints fake fingerprints can fool fingerprint sensors

Researchers have developed AI-generated synthetic fingerprints -- known as DeepMasterPrints -- that can spoof biometric scanners and potentially be used to launch practical attacks. Continue Reading

By

• Michael Heller, TechTarget

How were attackers able to bypass 2FA in a Reddit breach?

Reddit announced a breach after users were socially engineered and attackers bypassed 2FA protocols. Discover how this attack was possible and how sites can avoid falling victim. Continue Reading

By

• Judith Myerson

Risk & Repeat: Who's to blame for bad passwords?

This week's Risk & Repeat podcast discusses whether users are responsible for creating and reusing weak passwords or if the technology systems themselves are to blame. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Zero-trust security means new thinking plus practical steps

Implementing a security policy that, essentially, trusts no one and nothing doesn't have to be overwhelming if you understand the basics behind the security model. Continue Reading

By

• Johna Till Johnson, Nemertes Research

How the Microsoft Authenticator app integrates with Azure AD

Microsoft expanded the Microsoft Authenticator app to integrate with tens of thousands of Azure AD apps. Expert Dave Shackleford explains how this tool is improving security. Continue Reading

By

• Dave Shackleford, Voodoo Security

How does signed software help mitigate malware?

Okta researchers found a bypass that allows macOS malware to pose as signed Apple files. Discover how this is possible and how to mitigate this attack. Continue Reading

By

• Nick Lewis

How can U2F authentication end phishing attacks?

By requiring employees to use U2F authentication and physical security keys, Google eliminated phishing attacks. Learn how the combination works from expert Michael Cobb. Continue Reading

By

• Michael Cobb

How to monitor AWS credentials with the new Trailblazer tool

A security researcher introduced a tool called Trailblazer, which aims to simplify monitoring AWS credentials. Expert Dave Shackleford explains how it can bolster cloud security. Continue Reading

By

• Dave Shackleford, Voodoo Security

U.S. government domain officials to start using 2FA

The government domain registrar -- DotGov -- began rolling out two-factor authentication for officials managing .gov domains in order to mitigate against DNS hijacking. Continue Reading

By

• Michael Heller, TechTarget

How was Google Firebase security bypassed?

Google Firebase's inadequate back-end development led to data leaks and vulnerabilities, including HospitalGown. Learn more about this security flaw from expert Michael Cobb. Continue Reading

By

• Michael Cobb

Risk & Repeat: Inside the Facebook 2FA fail

This week's Risk & Repeat podcast discusses the latest controversy for Facebook, which has been using two-factor authentication numbers for advertising purposes. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

DigiCert, Gemalto and ISARA to provide quantum-proof certificates

Quantum computing threats are on the horizon, but DigiCert, Gemalto and ISARA have teamed up to develop new quantum-proof digital certificates and remake the PKI industry. Continue Reading

By

• Robert Richardson

User behavior analytics tackles cloud, hybrid environments

Integration of user behavior analytics as a feature of other security technologies such as SIEM and data loss prevention shows no sign of slowing down. User behavior analytics tools develop baselines and then correlate threat events, user and entity context, and peer analytics to alert security analysts of unusual activity.

Gartner expects user entity and behavior analytics techniques to become embedded in roughly 80% of the threat detection and incident response market by 2022. But between now and then, it appears more user behavior analytics tools are headed for optimization in the cloud. This optimization involves not only the analytical models, but also performance and cost.

"When you properly optimize analytics, the bill that you get from Amazon can be orders of magnitude smaller," said Stephan Jou, CTO of Interset Software Inc., an OEM provider that also offers stand-alone security analytics tools.

In this issue of Information Security, we look at new functionality in user behavior analytics and security analytics, and how these machine learning tools are attempting to help security operations centers stay on top of insider threats, external dangers and cloud security monitoring.

 Continue Reading

Microsoft wants to eliminate passwords -- and there's an app for that

At its Ignite 2018 conference, Microsoft declared an end to the password era and extended support for its Microsoft Authenticator app to Azure AD-connected apps. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Google Chrome sign-in changes cause confusion and concern

Google Chrome sign-in changes are being criticized by experts, and poor communication from Google has led to more confusion about user privacy and consent. Continue Reading

By

• Michael Heller, TechTarget

Hardcoded credentials continue to bedevil Cisco

Cisco hit by yet another new hardcoded credentials flaw, the latest in a long line of such flaws since last year, this time in its video surveillance manager appliance. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

PulseNet: How do improper authentication flaws affect it?

GE reported an improper authentication flaw in its PulseNet network management software for critical infrastructures. Discover how this flaw works with Judith Myerson. Continue Reading

By

• Judith Myerson

Securing remote access for cloud-based systems

Don't believe the hype: Access control in the cloud is not a lost cause. Read these tips to learn how you can better secure remote access to your cloud-based systems. Continue Reading

By

• (ISC) 2

How does a WDC vulnerability put hardcoded passwords at risk?

Several vulnerabilities were found in Western Digital's My Cloud, including one that affects the default hardcoded password. Learn how to avoid such risks with expert Nick Lewis. Continue Reading

By

• Nick Lewis

How Azure AD uses cloud access control to protect credentials

Features such as Microsoft Azure AD Smart Lockout and Password Protection add security via trusted authentication. Learn more about cloud access control from expert Ed Moyle. Continue Reading

By

• Ed Moyle, SecurityCurve

How hard-coded credentials threaten ICS security

Hard-coded credentials open industrial control systems up to unauthorized access by malicious actors and threaten ICS security. Expert Ernie Hayden explains the threat and what enterprises can do about it. Continue Reading

By

• Ernie Hayden, 443 Consulting LLC

Weighing privileged identity management tools' pros and cons

Products that help security pros manage access privileges are essential to IT security. Learn how to evaluate market offerings and acquire the best for your company. Continue Reading

By

• Michael Cobb

OneLogin security chief delivers new security model

How did cloud identity and access management vendor OneLogin rebuild its security after a breach? We ask OneLogin security chief Justin Calmus. Continue Reading

By

• Kathleen Richards

How to mitigate the Efail flaws in OpenPGP and S/MIME

Efail exploits vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext in encrypted emails. Learn more about the Efail vulnerabilities from expert Michael Cobb. Continue Reading

By

• Michael Cobb

With Pwned Passwords API, annoying password policies can finally go away

Update password policies at your company by following the 2017 NIST regulations—improving user experience drastically, and the Pwned Passwords API can help. Continue Reading

By

• Kyle Johnson, Technology Editor

10 unified access management questions for OneLogin CSO Justin Calmus

Enterprise security veteran Justin Calmus, who describes himself as an avid hacker, joined OneLogin as the CSO earlier this year. After last year's breach, who would want this job? Continue Reading

By

• Kathleen Richards

Reddit breach sparks debate over SMS 2FA

Using two-factor authentication with one-time passwords sent via SMS has come under question again after a Reddit breach was blamed on the faulty 2FA method. Continue Reading

By

• Michael Heller, TechTarget

Anonymity tools: Why the cloud might be the best option

The cloud might be the best of the available anonymity tools. Expert Frank Siemons explains the other options for anonymity for security and why the cloud is the best for privacy. Continue Reading

By

• Frank Siemons, RedSec

Physical security keys eliminate phishing at Google

Successful phishing attempts have been eliminated among Google employees following a requirement to use physical security keys in order to gain access to all Google accounts. Continue Reading

By

• Michael Heller, TechTarget

As AI identity management takes shape, are enterprises ready?

Experts at the Identiverse 2018 conference discussed how artificial intelligence and machine learning are poised to reshape the identity and access management market. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

The threat of shadow admins in the cloud to enterprises

Having shadow admins in the cloud means unauthorized users can access everything a legitimate administrator can. Expert Ed Moyle explains how this works and how to stop it. Continue Reading

By

• Ed Moyle, SecurityCurve

How did an old, unpatched Firefox bug expose master passwords?

A Firefox bug went undetected for nine years. Expert Michael Cobb explains how it enabled attackers to access the browser's master password and what's being done to mitigate it. Continue Reading

By

• Michael Cobb

Risk & Repeat: Is AI-driven identity management the future?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss Identiverse 2018 and how artificial intelligence is being applied to identity and access management. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Why a zero-trust network with authentication is essential

Zero-trust networks are often deemed compromised and untrusted, making authentication variables essential to security. Expert Matthew Pascucci explains a zero-trust security model. Continue Reading

By

• Matthew Pascucci

Yubikey is hot in the security space, so we tested the consumer experience

How easy is it to use Yubikey and would I recommend it? Continue Reading

By

• Kyle Johnson, Technology Editor

How can a text editor plug-in enable privilege escalation?

Developers use text editors to enhance efficiency in the workplace even though they require vulnerable third-party plug-ins. Discover these vulnerabilities with Judith Myerson. Continue Reading

By

• Judith Myerson

How can a hardcoded password vulnerability affect Cisco PCP?

Cisco patched a hardcoded password vulnerability found in their PCP software. Learn how the software works and how attackers can exploit this vulnerability with Judith Myerson. Continue Reading

By

• Judith Myerson

How does UBoatRAT use Google services and GitHub to spread?

A new remote access Trojan called UBoatRAT was found spreading via Google services and GitHub. Learn how spotting command-and-control systems can protect enterprises with Nick Lewis. Continue Reading

By

• Nick Lewis

Golden SAML: How can it abuse SAML authentication protocol?

CyberArk researchers created an attack called Golden SAML that uses Mimikatz techniques and applied it to a federated environment. Learn more about the attack with Nick Lewis. Continue Reading

By

• Nick Lewis

How does a SAML vulnerability affect single sign-on systems?

Researchers at Duo Security discovered a SAML vulnerability that enabled attackers to dupe single sign-on systems. Expert Michael Cobb explains how the exploit works. Continue Reading

By

• Michael Cobb

How will the new WPA3 protocol strengthen password security?

The development of WPA3 helps advance Wi-Fi protocol, as the next generation of Wi-Fi-enabled devices begins to demand more. Expert Michael Cobb explains how it differs from WPA2. Continue Reading

By

• Michael Cobb

Sexy, but stupid: Biometrics security requires balancing risks

When it comes to biometrics, security coexists with stupidity, unless implementers take the time to understand the limits, according to Adam Englander at RSAC 2018. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Akamai touts network perimeter security shifts, zero-trust model

As network perimeter security grows less practical, Akamai talks at RSA Conference about moving beyond firewalls to improve authentication with a zero-trust model. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Self-sovereign identity: How will regulations affect it?

Will laws like GDPR and PSD2 force enterprises to change their identity management strategies? Expert Bianca Lopes talks regulations, self-sovereign identity and blockchain. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

SSH announces new key and certificate management service

A new key and certificate management service is now offered by SSH, which teamed up with AppViewX to provide a way to administer cryptographic keys and digital certificates. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Will biometric authentication systems replace passwords?

Biometric authentication systems have gained traction on mobile devices, but when will they become dominant within the enterprise? Expert Bianca Lopes weighs in on the topic. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

How TLS mutual authentication for cloud APIs bolsters security

Secure access to cloud APIs is necessary but challenging. One viable option to combat that is TLS mutual authentication, according to expert Ed Moyle. Continue Reading

By

• Ed Moyle, SecurityCurve

SAP CSO Justin Somaini on using blockchain for security

Blockchain has generated both hype and skepticism, but SAP CSO Justin Somaini believes the technology has applications for security that can improve open source software. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Firefox bug exposes passwords to brute force -- for nine years

A Firefox bug exposing the browser's master password to a simple brute force attack against inadequate SHA-1 hashing is still on the books after nearly nine years. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

How can improper certificate pinning be stopped by the Spinner tool?

Researchers developed a tool to help prevent improper certificate pinning that causes security issues. Expert Michael Cobb reviews the issue and the Spinner tool. Continue Reading

By

• Michael Cobb

23,000 Symantec certificates revoked following leak of private keys

DigiCert revoked 23,000 Symantec SSL certificates amid a public spat between the company and former reseller partner Trustico, which claimed the certificates were 'compromised.' Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Single sign-on best practices: How can enterprises get SSO right?

Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good start. Here's how to do it. Continue Reading

By

• Joel Dubin
• Linda Rosencrance

New SAML vulnerability enables abuse of single sign-on

Duo Security discovered a new SAML flaw affecting several single sign-on vendors that allows attackers to fool SSO systems and log in as other users without their passwords. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Facebook's 2FA bug lands social media giant in hot water

Facebook came under fire after a two-factor authentication bug sent non-security notifications to users' phones, sparking a debate about media coverage and 2FA adoption. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Bypassing facial recognition: The means, motive and opportunity

Researchers bypassed Apple's facial recognition authentication program, Face ID, in under a week. Expert Michael Cobb explains why it's not a major cause for concern for users. Continue Reading

By

• Michael Cobb

How does credential stuffing enable account takeover attacks?

Credential stuffing activity is outpacing the growth of other cyberattacks and enabling account takeover attacks. Akamai Technologies' Patrick Sullivan explains the threat. Continue Reading

By

• Patrick Sullivan

Comodo calls out Symantec certificate issues, applauds Google

Bill Conner and Bill Holtz, who recently joined Comodo CA as chairman and CEO, respectively, discuss Symantec's certificate issues and their effect on the certificate market. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Risk & Repeat: Backdoor access, strong encryption debate rolls on

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the FBI's continued criticism of encrypted devices and the risks of vendor-created backdoor access points. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Public key pinning: Why is Google switching to a new approach?

After introducing HTTP Public Key Pinning to the internet two years ago, the upcoming Chrome will replace it with the Expect-CT header. Matt Pascucci explains the switch. Continue Reading

By

• Matthew Pascucci

Canvas fingerprinting: How does it compromise security?

Mozilla recently decided to pull the HTML canvas element from the Firefox browser. Learn from expert Matt Pascucci what this means for the security and privacy of users. Continue Reading

By

• Matthew Pascucci

Behavioral analytics, security go hand in hand

This Security School explores behavioral analytics as a tool for enhancing the security of enterprise systems and data. Continue Reading

Browser login managers allow tracking scripts to steal credentials

News roundup: Login managers enable the exposure of user credentials in over 1,000 websites. Plus, Mozilla patched a critical vulnerability in Thunderbird, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

CISSP Domain 5: Cloud identity management and access control

From cloud identity and access management to physical access control, this study guide will help you review key concepts from Domain 5 of the CISSP exam. Continue Reading

CISSP Domain 5 quiz: Types of access control systems

Get ready for the CISSP exam with this 10-question practice quiz covering key concepts in Domain 5, including access control, identity, authentication and more. Continue Reading

By

• (ISC) 2

How machine learning-powered password guessing impacts security

A new password guessing technique takes advantage of machine learning technologies. Expert Michael Cobb discusses how much of a threat this is to enterprise security. Continue Reading

By

• Michael Cobb

How can Windows digital signature check be defeated?

A security researcher discovered that editing two registry keys can alter a Windows digital signature check. Matt Pascucci explains what that means for digital signatures. Continue Reading

By

• Matthew Pascucci

Use caution with OAuth 2.0 protocol for enterprise logins

Many apps are using the OAuth 2.0 protocol for both authentication and authorization, but technically it's only a specification for delegated authorization, not for authentication. Continue Reading

By

• Michael Cobb

How to prevent password attacks and other exploits

Prevention is essential to protection against various types of password attacks, unauthorized access and related threats. Expert Adam Gordon outlines how to proactively bolster your defenses. Continue Reading

By

• (ISC) 2

Advanced Protection Program locks down Google accounts

Google's Advanced Protection Program greatly increases the security of user accounts, but the usability tradeoffs may not be worth it for average users. Continue Reading

By

• Michael Heller, TechTarget

Windows digital signature bypassed with two registry edits

The DerbyCon keynote covered why security research is an approachable field, as well as how to bypass a Windows digital signature check to run unwanted code. Continue Reading

By

• Michael Heller, TechTarget

Fearmongering around Apple Face ID security announcement

As fears grow over government surveillance, the phrase "facial recognition" often triggers a bit of panic in the public, and some commentators are exploiting that fear to overstate any risks ... Continue Reading

By

• Michael Heller, TechTarget

Google Cloud Key Management Service (KMS)

Google Cloud Key Management Service (KMS) is a cloud service for managing encryption keys for other Google cloud services that enterprises can use to implement cryptographic functions. Continue Reading

By

• Madelyn Bacon, TechTarget

Learn what network access control systems can do for you

Network access control systems keep rogue or compromised devices off of corporate networks. See how they work and the other security technologies with which they work. Continue Reading

By

• Rob Shapland

Common web application login security weaknesses and how to fix them

Flawed web application login security can leave an enterprise vulnerable to attacks. Expert Kevin Beaver reviews the most common mistakes and how to fix them. Continue Reading

By

• Kevin Beaver, Principle Logic, LLC

How can VMware vulnerabilities in vSphere expose credentials?

Two VMware vulnerabilities in vSphere Data Protection were recently patched. Expert Judith Myerson explains how the flaws work and how to defend against them. Continue Reading

By

• Judith Myerson

Are biometric authentication methods and systems the answer?

Biometric authentication methods, like voice, fingerprint and facial recognition systems, may be the best replacement for passwords in user identity and access management. Continue Reading

By

• Michael Cobb