Identity & Access Management: Page

DigiCert, Gemalto and ISARA to provide quantum-proof certificates

Quantum computing threats are on the horizon, but DigiCert, Gemalto and ISARA have teamed up to develop new quantum-proof digital certificates and remake the PKI industry.

By Robert Richardson • Oct. 3, 2018

Microsoft wants to eliminate passwords -- and there’s an app for that

At its Ignite 2018 conference, Microsoft declared an end to the password era and extended support for its Microsoft Authenticator app to Azure AD-connected apps.

By Rob Wright • Sept. 27, 2018

Google Chrome sign-in changes cause confusion and concern

Google Chrome sign-in changes are being criticized by experts, and poor communication from Google has led to more confusion about user privacy and consent.

By Michael Heller • Sept. 25, 2018

Hardcoded credentials continue to bedevil Cisco

Cisco hit by yet another new hardcoded credentials flaw, the latest in a long line of such flaws since last year, this time in its video surveillance manager appliance.

By Peter Loshin • Sept. 25, 2018

PulseNet: How do improper authentication flaws affect it?

GE reported an improper authentication flaw in its PulseNet network management software for critical infrastructures. Discover how this flaw works with Judith Myerson.

By Judith Myerson • Sept. 21, 2018

Securing remote access for cloud-based systems

Don't believe the hype: Access control in the cloud is not a lost cause. Read these tips to learn how you can better secure remote access to your cloud-based systems.

By (ISC) 2 • Sept. 20, 2018

How does a WDC vulnerability put hardcoded passwords at risk?

Several vulnerabilities were found in Western Digital's My Cloud, including one that affects the default hardcoded password. Learn how to avoid such risks with expert Nick Lewis.

By Nick Lewis • Sept. 7, 2018

How Azure AD uses cloud access control to protect credentials

Features such as Microsoft Azure AD Smart Lockout and Password Protection add security via trusted authentication. Learn more about cloud access control from expert Ed Moyle.

By Ed Moyle • Sept. 5, 2018

How hard-coded credentials threaten ICS security

Hard-coded credentials open industrial control systems up to unauthorized access by malicious actors and threaten ICS security. Expert Ernie Hayden explains the threat and what enterprises can do about it.

By Ernie Hayden • Aug. 30, 2018

Weighing privileged identity management tools’ pros and cons

Products that help security pros manage access privileges are essential to IT security. Learn how to evaluate market offerings and acquire the best for your company.

By Michael Cobb • Aug. 24, 2018

OneLogin security chief delivers new security model

How did cloud identity and access management vendor OneLogin rebuild its security after a breach? We ask OneLogin security chief Justin Calmus.

By Kathleen Richards • Aug. 16, 2018

How to mitigate the Efail flaws in OpenPGP and S/MIME

Efail exploits vulnerabilities in the OpenPGP and S/MIME standards to reveal the plaintext in encrypted emails. Learn more about the Efail vulnerabilities from expert Michael Cobb.

By Michael Cobb • Aug. 16, 2018

With Pwned Passwords API, annoying password policies can finally go away

Update password policies at your company by following the 2017 NIST regulations—improving user experience drastically, and the Pwned Passwords API can help.

By Kyle Johnson • Aug. 15, 2018

10 unified access management questions for OneLogin CSO Justin Calmus

Enterprise security veteran Justin Calmus, who describes himself as an avid hacker, joined OneLogin as the CSO earlier this year. After last year's breach, who would want this job?

By Kathleen Richards • Aug. 13, 2018

Reddit breach sparks debate over SMS 2FA

Using two-factor authentication with one-time passwords sent via SMS has come under question again after a Reddit breach was blamed on the faulty 2FA method.

By Michael Heller • Aug. 3, 2018

Anonymity tools: Why the cloud might be the best option

The cloud might be the best of the available anonymity tools. Expert Frank Siemons explains the other options for anonymity for security and why the cloud is the best for privacy.

By Frank Siemons • July 25, 2018

Physical security keys eliminate phishing at Google

Successful phishing attempts have been eliminated among Google employees following a requirement to use physical security keys in order to gain access to all Google accounts.

By Michael Heller • July 24, 2018

As AI identity management takes shape, are enterprises ready?

Experts at the Identiverse 2018 conference discussed how artificial intelligence and machine learning are poised to reshape the identity and access management market.

By Rob Wright • July 20, 2018

The threat of shadow admins in the cloud to enterprises

Having shadow admins in the cloud means unauthorized users can access everything a legitimate administrator can. Expert Ed Moyle explains how this works and how to stop it.

By Ed Moyle • July 11, 2018

How did an old, unpatched Firefox bug expose master passwords?

A Firefox bug went undetected for nine years. Expert Michael Cobb explains how it enabled attackers to access the browser's master password and what's being done to mitigate it.

By Michael Cobb • July 9, 2018

Why a zero-trust network with authentication is essential

Zero-trust networks are often deemed compromised and untrusted, making authentication variables essential to security. Expert Matthew Pascucci explains a zero-trust security model.

By Matthew Pascucci • July 3, 2018

Yubikey is hot in the security space, so we tested the consumer experience

How easy is it to use Yubikey and would I recommend it?

By Kyle Johnson • July 2, 2018

How can a text editor plug-in enable privilege escalation?

Developers use text editors to enhance efficiency in the workplace even though they require vulnerable third-party plug-ins. Discover these vulnerabilities with Judith Myerson.

By Judith Myerson • June 28, 2018

How can a hardcoded password vulnerability affect Cisco PCP?

Cisco patched a hardcoded password vulnerability found in their PCP software. Learn how the software works and how attackers can exploit this vulnerability with Judith Myerson.

By Judith Myerson • June 26, 2018

How does UBoatRAT use Google services and GitHub to spread?

A new remote access Trojan called UBoatRAT was found spreading via Google services and GitHub. Learn how spotting command-and-control systems can protect enterprises with Nick Lewis.

By Nick Lewis • June 15, 2018