Identity & Access Management: Page

Google’s Mark Risher: New types of 2FA are ‘game changers’

Google's head of account security, Mark Risher, discusses the various types of 2FA and how new options of WebAuthn and U2F are going to be game changers for enterprise.

By Michael Heller • Feb. 6, 2019

Google’s Mark Risher discusses 2FA adoption strategies

Although some types of two-factor authentication have been found to be vulnerable, Google's Mark Risher says 2FA adoption should be the baseline of security for all enterprises.

By Michael Heller • Feb. 6, 2019

Dailymotion credential stuffing attacks lasted more than 6 days

Video-sharing website Dailymotion reset passwords for an unknown number of users following 'large-scale' credential stuffing attacks that lasted for more than six days before being stopped.

By Michael Heller • Jan. 29, 2019

The evolution of the Let’s Encrypt certificate authority

Certificate authorities work differently since the open source Let's Encrypt project went into effect. Expert Fernando Gont explains how both CAs and Let's Encrypt operate.

By Fernando Gont • Jan. 28, 2019

How can synthetic clicks aid a privilege escalation attack?

An Apple security expert introduced the concept of synthetic clicks, which can bypass privilege escalation defenses. Find out how this new attack technique works with Nick Lewis.

By Nick Lewis • Jan. 24, 2019

Purchasing multifactor authentication tools: What to consider

Find out what you need to know before investing in a multifactor authentication tool, including the drawbacks and the benefits.

By David Strom • Jan. 23, 2019

How can attacks bypass Windows Driver Signature Enforcement?

Security researchers demonstrated how a new fileless attack technique can bypass a Windows kernel protection feature at Black Hat 2018. Find out how the technique works.

By Nick Lewis • Jan. 22, 2019

Exploring multifactor authentication benefits and technology

Take a look at multifactor authentication benefits and methods, as well as how the technologies have evolved from key fobs to smartphones, mobile devices and the cloud.

By David Strom • Jan. 18, 2019

How can an authentication bypass vulnerability be exploited?

A vulnerability was found in Western Digital's My Cloud NAS device that can be easily exploited by hackers. Discover what this vulnerability is and how users can be protected.

By Judith Myerson • Jan. 14, 2019

Key customer identity access management features to consider

Evaluating customer identity access management products is complicated but necessary. Learn what’s new and what you need most right now.

By Ed Moyle • Jan. 11, 2019

CIAM vs. IAM: The key differences ‘customer’ makes

Find out everything you need to know about the nuances that differentiate customer IAM from traditional IAM so that you can implement the CIAM system at your organization.

By Ed Moyle • Jan. 11, 2019

UnCAPTCHA attack updated to bypass spoken phrases

Researchers updated their unCAPTCHA proof of concept to be more efficient in bypassing audio CAPTCHAs and be able to handle spoken phrases and not just strings of numbers.

By Michael Heller • Jan. 10, 2019

For effective customer IAM, bundle security and performance

CIAM can verify identity, manage access and deliver a smooth experience for customers. Get an expert's insights on how to tackle customer IAM now.

By Johna Johnson • Dec. 17, 2018

How can users remove Google location tracking completely?

Disabling Google location tracking involves more than turning off Location History. Learn how to manage your account settings to stop tracking entirely with expert Michael Cobb.

By Michael Cobb • Dec. 6, 2018

What’s different about Google Asylo for confidential computing?

The Google Asylo framework is an open source alternative for confidential computing. Expert Rob Shapland explains how it works and how it's different from other offerings.

By Rob Shapland • Dec. 5, 2018

IAM system strategy identifies metrics that work for business

Security professionals are using identity and access management systems to track metrics on password resets, onboarding and offboarding, and employee retention and customer service.

By Steve Zurier • Dec. 3, 2018

DeepMasterPrints fake fingerprints can fool fingerprint sensors

Researchers have developed AI-generated synthetic fingerprints -- known as DeepMasterPrints -- that can spoof biometric scanners and potentially be used to launch practical attacks.

By Michael Heller • Nov. 21, 2018

How were attackers able to bypass 2FA in a Reddit breach?

Reddit announced a breach after users were socially engineered and attackers bypassed 2FA protocols. Discover how this attack was possible and how sites can avoid falling victim.

By Judith Myerson • Nov. 21, 2018

Zero-trust security means new thinking plus practical steps

Implementing a security policy that, essentially, trusts no one and nothing doesn't have to be overwhelming if you understand the basics behind the security model.

By Johna Johnson • Nov. 20, 2018

How the Microsoft Authenticator app integrates with Azure AD

Microsoft expanded the Microsoft Authenticator app to integrate with tens of thousands of Azure AD apps. Expert Dave Shackleford explains how this tool is improving security.

By Dave Shackleford • Nov. 14, 2018

How does signed software help mitigate malware?

Okta researchers found a bypass that allows macOS malware to pose as signed Apple files. Discover how this is possible and how to mitigate this attack.

By Nick Lewis • Nov. 14, 2018

How can U2F authentication end phishing attacks?

By requiring employees to use U2F authentication and physical security keys, Google eliminated phishing attacks. Learn how the combination works from expert Michael Cobb.

By Michael Cobb • Nov. 5, 2018

How to monitor AWS credentials with the new Trailblazer tool

A security researcher introduced a tool called Trailblazer, which aims to simplify monitoring AWS credentials. Expert Dave Shackleford explains how it can bolster cloud security.

By Dave Shackleford • Oct. 17, 2018

U.S. government domain officials to start using 2FA

The government domain registrar -- DotGov -- began rolling out two-factor authentication for officials managing .gov domains in order to mitigate against DNS hijacking.

By Michael Heller • Oct. 9, 2018

How was Google Firebase security bypassed?

Google Firebase's inadequate back-end development led to data leaks and vulnerabilities, including HospitalGown. Learn more about this security flaw from expert Michael Cobb.

By Michael Cobb • Oct. 9, 2018