Identity & Access Management

Risk & Repeat: Why are Amazon S3 buckets spilling on the web?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the series of enterprise data leaks through misconfigured Amazon S3 buckets and what should be done about them. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Industry reacts to Symantec certificate authority trust remediation

As the Symantec certificate authority scrambles to transition its certificate-issuance operations to a subordinate certificate authority, the CA industry sharpens its knives. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Symantec certificate authority business reportedly for sale

As Google and Mozilla prepare plans to reduce trust for Symantec's certificate authority, the antivirus vendor is reported to be seeking a buyer for its web certificate business. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Risk & Repeat: Should IAM systems be run by machine learning?

In this week's Risk & Repeat podcast, SearchSecurity editors discuss the identity and access management industry and how machine learning algorithms could govern IAM systems. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Q&A: Ping CEO on contextual authentication, intelligent identity

Ping Identity CEO Andre Durand talks with SearchSecurity about the data-driven move toward contextual authentication and intelligent identity and what this means for enterprises. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

WoSign CA certificates get end-of-trust date in Chrome

Google to distrust all WoSign CA certificates in Chrome starting in September, as the troubled certificate authority passed a key audit and is seeking a new CEO to help return trust. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

How did Webroot's antivirus signature update create false positives?

A Webroot antivirus signature update flagged Windows and Windows applications as dangerous. Expert Matthew Pascucci explains how it happened and what Webroot did about it. Continue Reading

By

• Matthew Pascucci

Risk & Repeat: Symantec, Mozilla spar over certificate issuance

In this week's Risk & Repeat podcast, SearchSecurity editors discuss Mozilla's suggested deadline for Symantec to turn over its certificate issuance operations. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Privileged user management trips up NSA

News roundup: DOD inspector general found NSA failed to implement secure privileged user management post-Snowden. Plus, Honda hit by WannaCry, Trump met with tech CEOs and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Machine learning in cybersecurity is coming to IAM systems

Machine learning in cybersecurity applications for identity management systems are becoming more common today. But will algorithms be the best option for authenticating and authorizing users? Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Hardcoded passwords could cause full IoT camera compromise

IoT cameras could be fully compromised due to multiple vulnerabilities, including hardcoded passwords that can be used regardless of user settings. Continue Reading

By

• Michael Heller, TechTarget

Symantec certificate authority aims for more delays on browser trust

Is the Symantec certificate authority operation too big to fail? That seems to be the message the security giant is sending in its latest response to a proposal from the browser community to turn ... Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Users' SSO information at risk after OneLogin security breach

News roundup: OneLogin security breach puts SSO data at risk but is vague about the details. Plus, Gmail boosts its phishing detection features, and more. Continue Reading

By

• Madelyn Bacon, TechTarget

Cloud access security brokers: Hard to tell what's real

Most cloud access security brokers offer CISOs a way to set policy and gain better understanding of multiple cloud services and data in use across the enterprise. As CASBs have gained momentum in recent years, use cases for them have expanded. Do these tools fill the gaps around visibility and control of software as a service and other cloud services?

Although cloud service visibility and data leak protection continue to be the biggest drivers, cloud access security brokers can do more than just help with your shadow IT problem and unsanctioned application activity in the cloud.

Organizations are increasingly looking to use cloud access security brokers to identify anomalies in data movement between on-premises and cloud apps as well as multiple cloud services. Malware identification and encryption of data have become important. More enterprises are also beginning to use CASBs or similar intermediary security technologies to provide some level of security policy management for custom identity-as-a-service platforms.

In this issue of Information Security magazine, we look at cloud access security brokers and the best ways to evaluate new models, such as infrastructure as a service and platform security.

 Continue Reading

RSA Authentication Manager offers a variety of authentication methods

With authentication methods ranging from risk-based to tokens, RSA Authentication Manager gives companies a number of ways to employ multifactor authentication. Continue Reading

By

• David Strom

Why WPA2-PSK can be a security risk even with an uncracked key

WPA2-PSK is a popular way to bolster wireless security, but it's not perfect. Expert Joseph Granneman explains WPA2 and other aspects of the complicated history of Wi-Fi security. Continue Reading

By

• Joseph Granneman, Illumination.io

Summing up Symantec VIP Service, a multifactor authentication tool

Expert David Strom looks at the Symantec VIP multifactor authentication product and how it can benefit enterprise security. Continue Reading

By

• David Strom

SecureAuth IdP: An overview of its multifactor authentication ability

Expert David Strom looks at how SecureAuth IdP uniquely combines multifactor authentication and single sign-on login capabilities in a single product. Continue Reading

By

• David Strom

VASCO IDENTIKEY Authentication Server and a look at its key features

Expert David Strom takes a closer look at VASCO's IDENTIKEY Authentication Server, one of the leading multifactor authentication products on the market. Continue Reading

By

• David Strom

TLS client authentication ensures secure IoT connection

The TLS client authentication protocol has been part of the security standard for years, but it's just now coming into its own in certifying secure IoT connections. Continue Reading

By

• Michael Heller, TechTarget

Risk & Repeat: Symantec offers plan to restore certificate trust

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss Symantec's continued struggles with certificate trust, and what Mozilla and Google are doing about it. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Symantec certificate authority offers counter-proposal to Google

Symantec certificate authority proposal takes the pain out of sanctions for misissued certs, offers more audits, greater transparency and promise of "continuous improvement." Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Is your IAM policy a roadmap to security or leading you off a cliff?

Identity and access management, or IAM, has long been a crucial consideration in the formulation of corporate security strategy. IAM policy today must contend with a variety of major changes sweeping the world of IT. One of the latest is the spread of cloud-based services, particularly the relativity new identity as a service. IDaaS and other products are having a significant impact on the market, as cloud-based IAM is now being released by both "establishment" players (i.e., Microsoft and Oracle) and next-gen companies like Ping Identity and Okta.

This Information Security magazine Insider Edition tackles these seismic changes in the "identity layer" and considers other factors affecting IAM policy now and how they have an impact. In addition, we look at multifactor authentication, which is an established identity security practice. But multifactor is not without its own challenges when to comes to implementation and maintenance. We also take a careful look at the specific risks to cloud-based IAM tools, from shadow IT, mobility and more.

Readers of the special edition of Information Security magazine on IAM policy and security concerns will come away better equipped to assess their current IAM policy and adapt it to the current and future world of IT.

 Continue Reading

Identity and access management strategy: Time to modernize?

More likely than not, your company's identity and access management strategy needs an update. Learn how to decide if that's the case and, if so, what you should do now. Continue Reading

By

• Michael Cobb

Risk & Repeat: Mozilla joins the Symantec certificate authority debate

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss mounting pressure on the Symantec certificate authority business to provide answers about its practices. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

How does the PoisonTap exploit bypass password locks on computers?

The PoisonTap exploit can bypass password locks on computers, enabling an attacker to remotely control systems. Expert Nick Lewis explains how the attack works. Continue Reading

By

• Nick Lewis

How to deal with Identity and access management systems

An identity and access management system is increasingly essential to corporate security, but technological advances have made managing an IAM more complex than ever. Continue Reading

Risk & Repeat: Strong encryption under fire again

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the latest round of the encryption debate and what it means for apps that use strong encryption. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

How does a U2F security key keep Facebook users safe?

Universal second factor devices can be used to strengthen authentication on major websites such as Facebook. Expert Matthew Pascucci explains how U2F works. Continue Reading

By

• Matthew Pascucci

How do identity governance and access management systems differ?

Identity governance and access management systems overlap naturally, but they are still distinct. Expert Matthew Pascucci explains the difference between these two aspects of IAM. Continue Reading

By

• Matthew Pascucci

Google considers options on Symantec certificate authority 'failures'

Symantec certificate authority cries foul, as Google considers severe options following the company allegedly misissuing as many as 30,000 digital certificates. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Enterprise SSO: The promise and the challenges ahead

It was inevitable that enterprise SSO would encounter the cloud. Learn how to adjust your company's approach to single sign-on so it keeps working well. Continue Reading

By

• Rob Shapland

SHA-1 certificates: How will Mozilla's deprecation affect enterprises?

Mozilla browser users will encounter 'untrusted connection' errors if they use SHA-1 signed certificates. Expert Michael Cobb explains why, and what enterprises can do. Continue Reading

By

• Michael Cobb

SHA-1 deprecation more important after hash officially broken

SHA-1 deprecation in browsers comes as researchers create hash collisions and Google offers website and developer tools to protect against malicious uses. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Q&A: Yubico brings FIDO authentication protocol to the masses

Yubico founder and CEO Stina Ehrensvard spoke with SearchSecurity at RSAC 2017 about FIDO authentication and how Google uses it to secure logins and cut costs. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Risk & Repeat: Bad Symantec certificates strike again

In this episode of SearchSecurity's Risk & Repeat podcast, editors discuss the discovery of more bad Symantec certificates and what it means for the antivirus software maker. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Symantec CA report offers more clarity on certificate transparency catch

One week after certificate transparency revealed a Symantec CA improperly issued over 100 digital certificates, Symantec offers more details on the incident. Continue Reading

By

• Peter Loshin, Former Senior Technology Editor

Google creates its own root certificate authority

Google is expanding its certificate authority capabilities by creating its own root certificate authority, but experts are unsure of Google's plans moving forward. Continue Reading

By

• Michael Heller, TechTarget

How improper SSH key management is putting enterprises at risk

In part two of his interview with SearchSecurity, SSH creator Tatu Ylonen explains why proper SSH key management is crucial and how attackers can use lost or exposed keys. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Gmail phishing campaign uses real-time techniques to bypass 2FA

Researchers saw a Gmail phishing campaign in the wild using clever tricks to access accounts including a difficult 2FA bypass only possible in real time. Continue Reading

By

• Michael Heller, TechTarget

Google Cloud KMS simplifies the key management service, but lacks features

Experts are impressed with the simplicity of Google's Cloud KMS even if it doesn't separate itself from the key management service competition. Continue Reading

By

• Michael Heller, TechTarget

Risk & Repeat: CES Cybersecurity Forum tackles passwords, IoT

In this episode of SearchSecurity's Risk & Repeat podcast, editors highlight the topics discussed at the CES Cybersecurity Forum, as well as new technologies showcased at the event. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Privileged access management and security in the enterprise

This Security School explores the important steps enterprises need to take when managing privileged access accounts to prevent credential abuse and security incidents. Continue Reading

How can two-factor authentication systems be used effectively?

Two-factor authentication systems require more than using codes sent through SMS and smart cards. Expert Michael Cobb explains how to properly and effectively implement 2FA. Continue Reading

By

• Michael Cobb

FIDO authentication standard could signal the passing of passwords

The FIDO authentication standard could eventually bypass passwords, or at least augment them, as government and industry turns to more effective authentication technologies. Continue Reading

By

• Michael Cobb

How to buy digital certificates for your enterprise

In the market to buy digital certificates? Learn exactly how digital certificates work, which features are key and how to evaluate the available options on the market. Continue Reading

By

• Michael Cobb

Can an HTML5 document with a digital signature be authenticated?

A digital signature on an HTML5 document cannot be authenticated the same way a PDF can. Expert Michael Cobb explains how enterprises should address this issue. Continue Reading

By

• Michael Cobb

Preventing privilege creep: How to keep access and roles aligned

Privilege creep can result in the abuse of user access and security incidents. Expert Michael Cobb explains how enterprises can keep user roles and privileges aligned. Continue Reading

By

• Michael Cobb

Strong authentication methods: Are you behind the curve?

Not sure who's really behind that username and password? Google, Facebook and others may finally give multifactor authentication technology the 'push' it needs. Continue Reading

By

• Dan Sullivan

Why signature-based detection isn't enough for enterprises

Signature-based detection and machine learning algorithms identify malicious code and threats. Expert Michael Cobb explains how both techniques defend networks and endpoints. Continue Reading

By

• Michael Cobb

What's the difference between two-step verification and 2FA?

The terms two-step verification and two-factor authentication are used interchangeably, but do they differ from one another? Expert Michael Cobb explains. Continue Reading

By

• Michael Cobb

Comparing the best network access control products

Expert Rob Shapland takes a look at the best network access control products on the market today and examines the features and capabilities that distinguish the top vendors in this space. Continue Reading

By

• Rob Shapland

Is third-party access the next IAM frontier?

Identity and access management of employees is so complex that many companies have faltered when it comes to securing programs for trusted partners. Continue Reading

By

• Michael Cobb

Can simple photography beat biometric systems?

Simple photography cracking biometric systems highlights the need for two-factor authentication in enterprises according to expert Randall Gamby. Continue Reading

By

• Randall Gamby, HP

Multifactor authentication: A buyer's guide to MFA products

In this SearchSecurity buyer's guide, learn how to evaluate and procure the right multifactor authentication product for your organization. Continue Reading

The fundamentals of FDE: The business case for full disk encryption

Expert Karen Scarfone outlines the benefits of FDE to help businesses decide if the storage encryption technology is right for their organization. Continue Reading

By

• Karen Kent, Trusted Cyber Annex

CISSP online training: Inside the access control domain

Spotlight article: Shon Harris discusses the main topics covered in the CISSP domain on access control, including authorization, authentication, identity management and more. Continue Reading

By

• Shon Harris , Logical Security

When single sign-on fails, is a second SSO implementation worthwhile?

After a failed SSO implementation, is there any benefit to an enterprise trying again? Expert Michele Chubirka discusses. Continue Reading

By

• Michele Chubirka

Preventing plaintext password problems in Google Chrome

Plaintext passwords are risky business. Michael Cobb discusses what Google says about the Chrome password vulnerability and potential exploits. Continue Reading

By

• Michael Cobb

Understanding IDaaS: The benefits and risks of Identity as a Service

Are identities safe in the cloud? Experts say enterprises must carefully weigh the risks vs. rewards of identity management as a service. Continue Reading

By

• Crystal Bedell

OAuth 2.0: Pros and cons of using the federation protocol

Learn the advantages and disadvantages of using Open Authorization for Web application authentication. Continue Reading

By

• Michael Cobb

How MAC and HMAC use hash function encryption for authentication

Hash function encryption is the key for MAC and HMAC message authentication. See how this differs from other message authentication tools from expert Michael Cobb. Continue Reading

By

• Michael Cobb

User provisioning best practices: Access recertification

User access recertification is the process of continually auditing users' permissions to make sure they have access only to what they need. Implementing recertification, however, can be challenging. Get best practices on creating a recertification process in this tip from IAM expert Randall Gamby. Continue Reading

By

• Randall Gamby, HP

What is an encryption collision?

Michael Cobb reviews how encryption collision attacks on cryptographic hash functions could compromise the security of all kinds of digital systems. Continue Reading

By

• Michael Cobb

Five steps to eliminate rogue wireless access

Unauthorized wireless access points aren't always malicious. Learn how to distinguish between them and mitigate threats posed by rogue APs. Continue Reading

By

• Lisa Phifer, Core Competence

ID and password authentication: Keeping data safe with management and policies

Learn how to improve authentication and avoid password hacking with management policies that enforce password expiration, length and complexity requirements. Continue Reading

By

• SearchSecurity.com

Configuring privilege levels

This section of the chapter excerpt focuses on supporting multiple administrative levels of router configuration. Continue Reading

Key management challenges and best practices

Key management is essential to a successful encryption project. In this tip, expert Randy Nash explains the challenges financial organizations face when implementing key management and some of the best practices to overcome them. Continue Reading

By

• Randy Nash, Contributor

Ophcrack: Password cracking made easy

Scott Sidel examines the open source security tool Ophcrack, a password cracking tool aimed at ensuring the strength of corporate passwords. Continue Reading

By

• Scott Sidel

What is the purpose of RFID identification?

RFID identification can be used to keep track of everything from credit cards to livestock. But what security risks are involved? Continue Reading

By

• Joel Dubin

What are the pros and cons of using stand-alone authentication that is not Active Directory-based?

Password managment tools other than Active Directory are available, though they may not be the best access control coordinators. Continue Reading

By

• Joel Dubin

How can root and administrator privileges of different systems be delegated on one account?

In this expert response, Joel Dubin discusses how corporations can manage "superuser" accounts by delegating root and administrator privileges. Continue Reading

By

• Joel Dubin

Choosing from the top PKI products and vendors

In this expert response, security pro Joel Dubin discusses the best ways to compare PKI products and vendors for enterprise implementation of PKI. Continue Reading

By

• Joel Dubin

How secure is the Windows registry?

In this SearchSecurity.com Q&A, platform security expert Michael Cobb explains the weaknesses of the Windows registry and explores other OS alternatives. Continue Reading

By

• Michael Cobb

Is the use of digital certificates with passwords considered two-factor authentication?

In this SearchSecurity.com Q&A identity management and access control expert Joel Dubin identifies the factors that contribute to two-factor authentication, such as smart cards and digital certificates. Continue Reading

By

• Joel Dubin

How to test an enterprise single sign-on login

In this SearchSecurity.com Q&A, identity management and access control expert Joel Dubin examines the best ways to test an enterprise single sign-on (SSO) login. Continue Reading

By

• Joel Dubin

How to verify 140-2 (FIPS 140-2) compliance

In this SearchSecurity.com Q&A, identity management and access control expert, Joel Dubin, discuses several ways to verify that Federal Information Processing Standard 140-2 is being enforced. Continue Reading

By

• Joel Dubin

Will biometric authentication replace the password?

Some security observers say user IDs and passwords are obsolete and can be easily cracked, but that doesn't mean you should fire up biometric authentication projects just yet. In this SearchSecurity.com Q&A, identity management and access control expert Joel Dubin explains why enterprises are still holding back on biometrics. Continue Reading

By

• Joel Dubin

Can single sign-on (SSO) provide authentication for remote logons?

If you're accessing multiple applications through a remote Citrix server, you have two options. Identity management and access control expert Joel Dubin explains both in this SearchSecurity.com Q&A. Continue Reading

By

• Joel Dubin