Identity & Access Management: Page

An overview of the CISA Zero Trust Maturity Model

A zero-trust framework blocks all attempts to access internal infrastructure without authentication. The CISA Zero Trust Maturity Model is a roadmap to get there.

By Paul Kirvan • Oct. 12, 2022

Top 6 challenges of a zero-trust security model

Zero trust has a number of challenges, but because the model is highly beneficial, it's important for organizations to learn how to overcome them.

By Sharon Shea, Dennis Turpitka • Oct. 11, 2022

How to conduct a cybersecurity audit based on zero trust

This checklist offers guidance on how to prepare for a zero-trust cybersecurity audit and helps document how well cybersecurity controls are performing based on CISA's ZTMM.

By Paul Kirvan • Oct. 11, 2022

Perimeter security vs. zero trust: It’s time to make the move

Perimeter security requires a border to protect enterprise data. With more and more users working outside that border, zero trust promises a better security option for the future.

By Andrew Froehlich • Oct. 7, 2022

Top zero-trust certifications and training courses

Most organizations are expected to implement zero trust in the next few years. Learn about zero-trust certifications and trainings that can help prepare your security team.

By Isabella Harford, Katie Donegan • Oct. 5, 2022

Multifactor authentication isn’t perfect, passwordless is better

Passwords are frequently the root cause of breaches, and multifactor authentication only provides a stopgap for account protection. It's time to adopt a passwordless strategy.

By Jack Poller • Sept. 29, 2022

The 5 principles of zero-trust security

Zero trust is a journey, not a destination. Ensure your corporate network is safe from internal and external threats by implementing these five principles of zero-trust security.

By Andrew Froehlich • Sept. 29, 2022

Why zero trust requires microsegmentation

Microsegmentation is a key security technique that enables organizations to achieve a zero-trust model and helps ensure the security of workloads regardless of where they are located.

By Andrew Froehlich , Sharon Shea • Sept. 28, 2022

Compare zero trust vs. the principle of least privilege

Zero trust and the principle of least privilege may appear to solve the same issue, but they have their differences. Read up on the two methodologies.

By Andrew Froehlich • Sept. 28, 2022

Cybercriminals launching more MFA bypass attacks

New research from Okta shows that cybercrime groups have stepped up their attacks on multifactor authentication systems in an effort to thwart account security measures.

By Shaun Nichols • Sept. 21, 2022

Researcher unveils smart lock hack for fingerprint theft

An academic researcher demonstrated how IoT smart locks could become tools for attackers to covertly steal fingerprints and potentially access more sensitive personal data.

By Shaun Nichols • Sept. 1, 2022

What is identity sprawl and how can it be managed?

With identity-based attacks on the rise, organizations need to prioritize identity management. Learn about identity sprawl, why it's a risk and how it can be managed.

By Michael Cobb • Aug. 18, 2022

Why 2023 is the year of passwordless authentication

Passwords may soon be relegated to the past thanks to IAM vendors' efforts to create passwordless login options. Here's why 2023 should be the year of passwordless authentication.

By Jack Poller • Aug. 11, 2022

Ermetic addresses IAM weaknesses in multi-cloud environments

Researchers at the cloud security vendor discussed the importance of understanding the different identity and access management features among the major cloud providers.

By Arielle Waldman • Aug. 10, 2022

Amazon CSO Steve Schmidt preaches fungible resources, MFA

In a Q&A with SearchSecurity, Amazon CSO Steve Schmidt discusses his time as head of AWS security and shifts the cloud provider made to improve its posture, as well as customers'.

By Rob Wright, Arielle Waldman • Aug. 3, 2022

Thoma Bravo to acquire Ping Identity for $2.8B

Thoma Bravo's bid is expected to close in the fourth quarter of 2022. Ping Identity's purchase price represents a 63% premium over the vendor's closing price Tuesday.

By Alexander Culafi • Aug. 3, 2022

SSH key management best practices and implementation tips

SSH connects key systems and the people and processes necessary to keep them functioning. Learn how to use SSH key management best practices to protect your systems and network.

By Peter Loshin • July 29, 2022

AWS issues MFA call to action at re:Inforce 2022

To reduce growing attack surfaces in the cloud, AWS executives emphasized the importance of implementing MFA to protect accounts and blocking public access to cloud resources.

By Arielle Waldman • July 26, 2022

Atlassian Confluence plugin contains hardcoded password

A flaw in Questions for Confluence, a first-party application in Atlassian Confluence, contains a hardcoded password enabling access into any vulnerable instance.

By Alexander Culafi • July 21, 2022

Access management issues may create security holes

Employees who aren't credentialed to access corporate systems to do their jobs find ways around the red tape that could lead to security breaches.

By Shaun Nichols • June 23, 2022

X.509 certificate

An X.509 certificate is a digital certificate that uses the widely accepted international X.509 public key infrastructure (PKI) standard to verify that a public key belongs to the user, computer or service identity contained within the certificate.

By Alexander Gillis, Sharon Shea • June 17, 2022

3 types of PKI certificates and their use cases

Public key infrastructure helps authenticate senders via cryptography and digital certificates. Learn about three types of PKI certificates and their use cases.

By Isabella Harford • June 10, 2022

Are 14-character minimum-length passwords secure enough?

When it comes to minimum password length, 14-character passwords are generally considered secure, but they may not be enough to keep your enterprise safe.

By Randall Gamby, Sharon Shea • June 9, 2022

Twitter fined $150M for misusing 2FA data

The DOJ and FTC said the social media company misused consumers' personal data for advertisement purposes, from which it gained benefit.

By Arielle Waldman • May 26, 2022

8 ways to avoid NFT scams

People and businesses are turning to NFTs to make money, trade collectibles and use as promotions. But scams are also trying to trick people and businesses out of money.

By Amanda Hetler • May 26, 2022