Identity & Access Management: Page

CISSP online training: Inside the access control domain

Spotlight article: Shon Harris discusses the main topics covered in the CISSP domain on access control, including authorization, authentication, identity management and more.

By Shon Harris • Sept. 19, 2014

When single sign-on fails, is a second SSO implementation worthwhile?

After a failed SSO implementation, is there any benefit to an enterprise trying again? Expert Michele Chubirka discusses.

By Michele Chubirka • May 15, 2014

Preventing plaintext password problems in Google Chrome

Plaintext passwords are risky business. Michael Cobb discusses what Google says about the Chrome password vulnerability and potential exploits.

By Michael Cobb • Jan. 30, 2014

Understanding IDaaS: The benefits and risks of Identity as a Service

Are identities safe in the cloud? Experts say enterprises must carefully weigh the risks vs. rewards of identity management as a service.

By Crystal Bedell • Nov. 26, 2012

OAuth 2.0: Pros and cons of using the federation protocol

Learn the advantages and disadvantages of using Open Authorization for Web application authentication.

By Michael Cobb • Nov. 9, 2011

How MAC and HMAC use hash function encryption for authentication

Hash function encryption is the key for MAC and HMAC message authentication. See how this differs from other message authentication tools from expert Michael Cobb.

By Michael Cobb • Aug. 30, 2011

User provisioning best practices: Access recertification

User access recertification is the process of continually auditing users' permissions to make sure they have access only to what they need. Implementing recertification, however, can be challenging. Get best practices on creating a recertification process in this tip from IAM expert Randall Gamby.

By Randall Gamby • Nov. 9, 2010

What is an encryption collision?

Michael Cobb reviews how encryption collision attacks on cryptographic hash functions could compromise the security of all kinds of digital systems.

By Michael Cobb • Oct. 23, 2009

Five steps to eliminate rogue wireless access

Unauthorized wireless access points aren't always malicious. Learn how to distinguish between them and mitigate threats posed by rogue APs.

By Lisa Phifer • May 1, 2009

ID and password authentication: Keeping data safe with management and policies

Learn how to improve authentication and avoid password hacking with management policies that enforce password expiration, length and complexity requirements.

By SearchSecurity.com • Nov. 11, 2008

Key management challenges and best practices

Key management is essential to a successful encryption project. In this tip, expert Randy Nash explains the challenges financial organizations face when implementing key management and some of the best practices to overcome them.

By Randy Nash, Contributor • July 24, 2008

Ophcrack: Password cracking made easy

Scott Sidel examines the open source security tool Ophcrack, a password cracking tool aimed at ensuring the strength of corporate passwords.

By Scott Sidel • May 19, 2008

What is the purpose of RFID identification?

RFID identification can be used to keep track of everything from credit cards to livestock. But what security risks are involved?

By Joel Dubin • March 20, 2008

What are the pros and cons of using stand-alone authentication that is not Active Directory-based?

Password managment tools other than Active Directory are available, though they may not be the best access control coordinators.

By Joel Dubin • Jan. 13, 2008

How can root and administrator privileges of different systems be delegated on one account?

In this expert response, Joel Dubin discusses how corporations can manage "superuser" accounts by delegating root and administrator privileges.

By Joel Dubin • Nov. 28, 2007

Choosing from the top PKI products and vendors

In this expert response, security pro Joel Dubin discusses the best ways to compare PKI products and vendors for enterprise implementation of PKI.

By Joel Dubin • Oct. 1, 2007

How secure is the Windows registry?

In this SearchSecurity.com Q&A, platform security expert Michael Cobb explains the weaknesses of the Windows registry and explores other OS alternatives.

By Michael Cobb • July 26, 2007

Is the use of digital certificates with passwords considered two-factor authentication?

In this SearchSecurity.com Q&A identity management and access control expert Joel Dubin identifies the factors that contribute to two-factor authentication, such as smart cards and digital certificates.

By Joel Dubin • June 4, 2007

How to test an enterprise single sign-on login

In this SearchSecurity.com Q&A, identity management and access control expert Joel Dubin examines the best ways to test an enterprise single sign-on (SSO) login.

By Joel Dubin • June 1, 2007

How to verify 140-2 (FIPS 140-2) compliance

In this SearchSecurity.com Q&A, identity management and access control expert, Joel Dubin, discuses several ways to verify that Federal Information Processing Standard 140-2 is being enforced.

By Joel Dubin • April 18, 2007

Will biometric authentication replace the password?

Some security observers say user IDs and passwords are obsolete and can be easily cracked, but that doesn't mean you should fire up biometric authentication projects just yet. In this SearchSecurity.com Q&A, identity management and access control expert Joel Dubin explains why enterprises are still holding back on biometrics.

By Joel Dubin • Feb. 8, 2007

Can single sign-on (SSO) provide authentication for remote logons?

If you're accessing multiple applications through a remote Citrix server, you have two options. Identity management and access control expert Joel Dubin explains both in this SearchSecurity.com Q&A.

By Joel Dubin • Feb. 7, 2007