Identity & Access Management: Page

Golden SAML: How can it abuse SAML authentication protocol?

CyberArk researchers created an attack called Golden SAML that uses Mimikatz techniques and applied it to a federated environment. Learn more about the attack with Nick Lewis.

By Nick Lewis • June 14, 2018

How does a SAML vulnerability affect single sign-on systems?

Researchers at Duo Security discovered a SAML vulnerability that enabled attackers to dupe single sign-on systems. Expert Michael Cobb explains how the exploit works.

By Michael Cobb • June 7, 2018

How will the new WPA3 protocol strengthen password security?

The development of WPA3 helps advance Wi-Fi protocol, as the next generation of Wi-Fi-enabled devices begins to demand more. Expert Michael Cobb explains how it differs from WPA2.

By Michael Cobb • May 4, 2018

Sexy, but stupid: Biometrics security requires balancing risks

When it comes to biometrics, security coexists with stupidity, unless implementers take the time to understand the limits, according to Adam Englander at RSAC 2018.

By Peter Loshin • April 27, 2018

Akamai touts network perimeter security shifts, zero-trust model

As network perimeter security grows less practical, Akamai talks at RSA Conference about moving beyond firewalls to improve authentication with a zero-trust model.

By Peter Loshin • April 24, 2018

Self-sovereign identity: How will regulations affect it?

Will laws like GDPR and PSD2 force enterprises to change their identity management strategies? Expert Bianca Lopes talks regulations, self-sovereign identity and blockchain.

By Rob Wright • April 20, 2018

SSH announces new key and certificate management service

A new key and certificate management service is now offered by SSH, which teamed up with AppViewX to provide a way to administer cryptographic keys and digital certificates.

By Peter Loshin • April 16, 2018

Will biometric authentication systems replace passwords?

Biometric authentication systems have gained traction on mobile devices, but when will they become dominant within the enterprise? Expert Bianca Lopes weighs in on the topic.

By Rob Wright • April 12, 2018

How TLS mutual authentication for cloud APIs bolsters security

Secure access to cloud APIs is necessary but challenging. One viable option to combat that is TLS mutual authentication, according to expert Ed Moyle.

By Ed Moyle • April 11, 2018

SAP CSO Justin Somaini on using blockchain for security

Blockchain has generated both hype and skepticism, but SAP CSO Justin Somaini believes the technology has applications for security that can improve open source software.

By Rob Wright • March 22, 2018

Firefox bug exposes passwords to brute force -- for nine years

A Firefox bug exposing the browser's master password to a simple brute force attack against inadequate SHA-1 hashing is still on the books after nearly nine years.

By Peter Loshin • March 21, 2018

How can improper certificate pinning be stopped by the Spinner tool?

Researchers developed a tool to help prevent improper certificate pinning that causes security issues. Expert Michael Cobb reviews the issue and the Spinner tool.

By Michael Cobb • March 9, 2018

23,000 Symantec certificates revoked following leak of private keys

DigiCert revoked 23,000 Symantec SSL certificates amid a public spat between the company and former reseller partner Trustico, which claimed the certificates were 'compromised.'

By Rob Wright • March 2, 2018

Single sign-on best practices: How can enterprises get SSO right?

Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good start. Here's how to do it.

By Linda Rosencrance, Joel Dubin • Feb. 28, 2018

New SAML vulnerability enables abuse of single sign-on

Duo Security discovered a new SAML flaw affecting several single sign-on vendors that allows attackers to fool SSO systems and log in as other users without their passwords.

By Rob Wright • Feb. 27, 2018

Bypassing facial recognition: The means, motive and opportunity

Researchers bypassed Apple's facial recognition authentication program, Face ID, in under a week. Expert Michael Cobb explains why it's not a major cause for concern for users.

By Michael Cobb • Feb. 1, 2018

How does credential stuffing enable account takeover attacks?

Credential stuffing activity is outpacing the growth of other cyberattacks and enabling account takeover attacks. Akamai Technologies' Patrick Sullivan explains the threat.

By Patrick Sullivan • Jan. 26, 2018

Comodo calls out Symantec certificate issues, applauds Google

Bill Conner and Bill Holtz, who recently joined Comodo CA as chairman and CEO, respectively, discuss Symantec's certificate issues and their effect on the certificate market.

By Rob Wright • Jan. 25, 2018

Public key pinning: Why is Google switching to a new approach?

After introducing HTTP Public Key Pinning to the internet two years ago, the upcoming Chrome will replace it with the Expect-CT header. Matt Pascucci explains the switch.

By Matthew Pascucci • Jan. 18, 2018

Canvas fingerprinting: How does it compromise security?

Mozilla recently decided to pull the HTML canvas element from the Firefox browser. Learn from expert Matt Pascucci what this means for the security and privacy of users.

By Matthew Pascucci • Jan. 15, 2018

Browser login managers allow tracking scripts to steal credentials

News roundup: Login managers enable the exposure of user credentials in over 1,000 websites. Plus, Mozilla patched a critical vulnerability in Thunderbird, and more.

By Madelyn Bacon • Dec. 29, 2017

CISSP Domain 5 quiz: Types of access control systems

Get ready for the CISSP exam with this 10-question practice quiz covering key concepts in Domain 5, including access control, identity, authentication and more.

By (ISC) 2 • Dec. 8, 2017

How machine learning-powered password guessing impacts security

A new password guessing technique takes advantage of machine learning technologies. Expert Michael Cobb discusses how much of a threat this is to enterprise security.

By Michael Cobb • Dec. 7, 2017

How can Windows digital signature check be defeated?

A security researcher discovered that editing two registry keys can alter a Windows digital signature check. Matt Pascucci explains what that means for digital signatures.

By Matthew Pascucci • Dec. 6, 2017

Use caution with OAuth 2.0 protocol for enterprise logins

Many apps are using the OAuth 2.0 protocol for both authentication and authorization, but technically it's only a specification for delegated authorization, not for authentication.

By Michael Cobb • Nov. 30, 2017