Identity & Access Management: Page

YubiKey FIPS recalled from government for reduced randomness

Yubico recalled YubiKey FIPS series devices after discovering an issue leading to reduced randomness in values generated by the keys, which are used by federal agencies.

By Michael Heller • June 17, 2019

3 reasons privilege escalation in the cloud works

Statistics show that many cloud attacks are linked to credential and privilege misuse. Learn three ways threat actors are able to launch privilege escalation attacks in the cloud.

By Dave Shackleford • June 7, 2019

Apple single sign-on option promises privacy for users

Apple is preparing its own single sign-on offering, called Sign In with Apple, which will focus on user privacy. But experts are split on how well this will work.

By Michael Heller • June 5, 2019

Zero-trust security model means more than freedom from doubt

A zero-trust security model has a catchy name, but the methodology means more than not trusting any person or device on the network. What you need to know.

By Johna Johnson • June 4, 2019

Why are fewer companies using SMS 2FA for authentication?

Instead of SMS two-factor authentication, some companies are switching to 2FA through messaging apps and social media platforms. Learn what's behind this authentication trend.

By Tsahi Levent-Levi • May 31, 2019

How Google turned 1.5 billion Android phones into 2FA keys

Google product manager Christiaan Brand discusses the journey to making 1.5 billion Android devices work as 2FA security keys and the plan for the future.

By Michael Heller • May 17, 2019

How does an identity and access management framework work?

A comprehensive identity and access management framework is an IT necessity. But how do the two components work together?

By Andrew Froehlich • May 13, 2019

We talk a lot about access and authentication, but what about revoking user access?

Google hopes to make it easier with their proposed Continuous Access Evaluation Protocol.

By Kyle Johnson • May 7, 2019

5 common authentication factors to know

Multifactor authentication is a security system that requires two or more authentication steps to verify the user's identity. Discover the most important terms related to MFA.

By Katie Donegan • May 6, 2019

Are users your biggest risk? Raise IT security awareness

Users are either your best line of defense or greatest vulnerability. Learn how attackers exploit human behavior and fight back by improving user security awareness.

By Jessica Scarpati • May 1, 2019

Identity and access management trends show new access roles

Identity and access management trends reflect a changing cybersecurity landscape. Learn how IAM is changing and what you should do before buying an IAM tool.

By Johna Johnson • April 18, 2019

WPA3 flaws found in Dragonfly handshake

Researchers discovered vulnerabilities in the WPA3 protocol, specifically in the Dragonfly handshake authentication, allowing for multiple exploits branded Dragonblood.

By Michael Heller • April 12, 2019

Can PDF digital signatures be trusted?

Digital signatures on PDF documents don't necessarily guarantee their contents are valid, as new research shows viewer implementations don't always detect incomplete signatures.

By Hanno Böck • March 26, 2019

Zero-trust security model primer: What, why and how

What exactly is a zero-trust security model? This primer explains the basics about the philosophy behind how designing a security architecture strictly limits access to all, not just outsiders.

By Jessica Scarpati • March 26, 2019

Study reveals sale of SSL/TLS certificates on dark web

Security researchers discovered the availability of SSL/TLS certificates for sale on the dark web, which allow cybercriminals to disguise their malicious activity as legitimate.

By Mekhala Roy • March 22, 2019

Chris Wysopal talks blockchain hype and realistic uses

While marketers ride the hype train around blockchain, Chris Wysopal says there are realistic uses for the technology. And there are blockchain risks that need to be considered, as well.

By Michael Heller • March 22, 2019

Research sparks debate over password manager vulnerabilities

Researchers found several popular password managers expose master passwords in system memory, but experts recommend consumers and enterprises should still use the products.

By Mekhala Roy • March 1, 2019

Mimikatz tutorial: How it hacks Windows passwords, credentials

In this Mimikatz tutorial, learn about the password and credential dumping program, where you can acquire it and how easy it makes it to compromise system passwords.

By Peter Loshin • March 1, 2019

Key steps to put your zero-trust security plan into action

There are three key categories of vendor zero-trust products. Learn what they are, and how to evaluate and implement the one that's best for your company.

By Dave Shackleford • Feb. 20, 2019

How did Signal Desktop expose plaintext passwords?

The Signal Desktop application was found to be making decryption keys available in plaintext. Learn how the SQLite database and plaintext passwords were put at risk.

By Judith Myerson • Feb. 19, 2019

Ponemon study: Poor password practices remain rampant

More than two-thirds of employees share passwords with colleagues, research reveals. Experts sound off on what's fueling poor password practices and how to solve the problem.

By Mekhala Roy • Feb. 15, 2019

How can credential stuffing attacks be detected?

Credential stuffing attacks can put companies that offer online membership programs, as well as their customers, at risk. Find out how to proactively manage the threat.

By Nick Lewis • Feb. 14, 2019

Dunkin’ security alert warns of new credential-stuffing attacks

Dunkin' sent a security alert to customers warning of potentially malicious access of accounts due to the second credential stuffing attack in less than three months.

By Michael Heller • Feb. 13, 2019

Idaptive officially launches their “Next-Gen Access Cloud” IDaaS platform

Next-Gen Access Cloud has a new architecture, and Idaptive will continue to expand its machine learning capabilities.

By Jack Madden • Feb. 11, 2019

Defense Department eyes behavioral biometrics with new contract

The Department of Defense awards a $2.4 million contract to Twosense.AI in order to create a behavioral biometrics system that can replace the current ID card system.

By Michael Heller • Feb. 8, 2019