Identity & Access Management: Page

Migrate to passwordless to enhance security and UX

Transitioning to passwordless authentication enables organizations to strengthen user account and sensitive data security without adding UX friction for end users.

By Ant Allan • Dec. 13, 2024

9 identity and access management trends to watch in 2025

Identity threats continue to change and so, too, do the defenses developed to address those security challenges. Be ready for what's coming next in IAM.

By Phil Sweeney • Dec. 12, 2024

7 must-know IAM standards in 2025

Does your IAM program need OAuth or OpenID Connect? Or maybe both? Let's look at the various standards and protocols that make identity management function.

By Sean Kerner • Dec. 12, 2024

Nonhuman identity security is getting board-level attention

Has your organization addressed nonhuman identity security? NHI attacks are becoming more prevalent and need to be a part of enterprise security strategies.

By Todd Thiemann • Dec. 12, 2024

What is user authentication?

User authentication refers to the process of verifying the identity of a user attempting to gain access to a computer network, system or device. This process runs in the background and can be done through different means, such as asking the user to enter a password, provide a PIN or provide a fingerprint.

By Rahul Awati • Dec. 9, 2024

What is a session key?

A session key is an encryption and decryption key that is randomly generated to ensure the security of a communications session between a user and another computer or between two computers.

By Rahul Awati • Dec. 9, 2024

Passkey vs. password: What is the difference?

Companies are turning to passkeys as a secure login for consumers. Passkeys make it more difficult for thieves to steal information, and they are also more convenient for users.

By Amanda Hetler • Dec. 6, 2024

2025 identity security and data security predictions

From securing nonhuman identities to post-quantum cryptography to DSPM and DLP combining, here's what's in store for identity and data security in 2025.

By Todd Thiemann • Dec. 5, 2024

4 types of access control

Access management is the gatekeeper, making sure a device or person can gain entry only to the systems or applications to which they have been granted permission.

By Amy DeCarlo • Nov. 20, 2024

User provisioning and deprovisioning: Why it matters for IAM

Overprivileged and orphaned user identities pose risks. Cybersecurity teams should be sure user profiles grant only appropriate access -- and only for as long as necessary.

By Dave Shackleford • Nov. 20, 2024

What skills are needed for a successful career in IAM?

In the zero-trust era, identity management is critical to an organization's cybersecurity posture. What skills are required to transition into a career in IAM?

By Amy DeCarlo • Nov. 19, 2024

What is acceptable use policy (AUP)?

An acceptable use policy (AUP) is a document stipulating constraints and practices that a user must agree to for access to or use of a corporate network, the internet or other computing resources.

By Paul Kirvan • Nov. 18, 2024

MFA required for AWS Organizations member accounts in 2025

AWS is one of several cloud providers that will implement MFA requirements over the next year, with other relevant names including Google Cloud and Microsoft Azure.

By Alexander Culafi • Nov. 15, 2024

What is identity governance and administration (IGA)?

Identity governance and administration (IGA) is the collection of processes and practices used to manage user digital identities and their access throughout the enterprise.

By Stephen Bigelow • Nov. 14, 2024

Identity management vs. authentication: Know the difference

Learn how authentication and identity management are both intrinsic to an identity and access management framework. Learn how they differ and the role each one plays.

By Andrew Froehlich • Nov. 12, 2024

15 IAM interview questions to prep for your next career move

The job market for identity and access management positions is strong right now, but the competition could be tough. Use these 15 questions to guide your interview prep.

By Kathleen Richards • Nov. 7, 2024

What is machine identity management?

Machine identity management focuses on the machines connected to and accessing resources on a network.

By Sean Kerner • Nov. 6, 2024

Google Cloud to roll out mandatory MFA for all users

Google's three-phase plan for mandatory MFA, which will culminate in late 2025, follows similar efforts from other cloud providers such as AWS and Microsoft.

By Arielle Waldman • Nov. 5, 2024

What is authentication, authorization and accounting (AAA)?

Authentication, authorization and accounting (AAA) is a security framework for controlling and tracking user access within a computer network.

By Alexander Gillis • Oct. 28, 2024

What is two-factor authentication (2FA)?

Two-factor authentication (2FA), sometimes referred to as two-step verification or dual-factor authentication, is a security process in which users provide two different authentication factors to verify themselves.

By Peter Loshin, Paul Kirvan, Michael Cobb • Oct. 28, 2024

Cisco ASA and FTD zero day used in password spraying attacks

One day after Cisco disclosed a zero-day vulnerability discovered in its VPN software, CISA added the flaw to its Known Exploited Vulnerabilities catalog.

By Arielle Waldman • Oct. 24, 2024

FIDO unveils new specifications to transfer passkeys

The proposed FIDO Alliance specifications would enable users and organizations to securely transfer credentials from one identity provider to another.

By Arielle Waldman • Oct. 15, 2024

What is access control?

Access control is a security technique that regulates who or what can view or use resources in a computing environment.

By Ben Lutkevich, Gavin Wright • Sept. 27, 2024

What is identity threat detection and response (ITDR)?

Identity threat detection and response (ITDR) is a collection of tools and best practices aimed at defending against cyberattacks that specifically target user identities or identity and access management (IAM) infrastructure.

By Mary Pratt • Sept. 6, 2024

Halliburton cyberattack explained: What happened?

Oil field services provider Halliburton reported on Aug. 23, 2024, that it was the victim of a cyberattack, adding another to the growing list of cyberincidents.

By Sean Kerner • Aug. 28, 2024