Tag: IAM

How CIAM Creates a 360-Degree View of the Customer

CIAM
Each of us has multiple identities — personal, consumer, business-related, etc. To his family, a man might simply be “Sam,” but to his employer, Sam is a complex array of user IDs, passwords, and access privileges. Identity and access management (IAM) provides a disciplined approach for the creation, maintenance, and use of those digital identities. It integrates business processes...

NIST Cybersecurity Framework Gets an Update

Security
Organizations are facing a “triple threat” when it comes to cybersecurity. Growing numbers of vulnerabilities and increasingly sophisticated attacks have made cybersecurity breaches virtually inevitable. However, many organizations lack the skilled personnel needed to combat these attacks, and open positions for security specialists tend to go unfilled due to the limited number of professionals in the marketplace. As a...

FIDO Alliance Specifications Enable Standards-Based Approach to MFA

password
In our last post, we discussed how so-called “aftershock” attacks are driving the need for multifactor authentication (MFA). Because most users rely on a handful of slightly varied passwords to access multiple sites and accounts, cybercriminals often use stolen passwords in hacking attempts. MFA adds an extra layer of protection by requiring more than a password for authentication. Traditionally,...

Federated Identity Management Extends Control Across Hybrid Environments

ID Management
The continued adoption of Software-as-a-Service (SaaS) solutions and other cloud-based services has blurred the concept of the network perimeter. At the same time, organizations have become increasingly dependent on partners who span supply chains, brokers, and other networks. These distributed computing models have created new challenges for identity and access management (IAM) solutions, which provide a framework for managing...

The Cloud Demands a Centralized Approach to Identity and Access Management

IAM 2
Ever-increasing numbers of users, both inside and outside organizations, need convenient access to corporate IT resources that exist both on-premises and in the cloud. The result is a porous network perimeter that relies heavily on user authentication to prevent unauthorized access. However, many organizations are finding that their identity and access management (IAM) platforms are inadequate. Growing security threats...

How Do We Optimize Access Control Performance?

DIT IAM
In a perfect world, the lifecycle of any identity is readily tracked and managed. The policies that determine basic access are derived from the relevant characteristics of the identity – role, function, business unit, project team, location, certifications, etc. Additional access rights may require a resource owner’s permission. All of these inputs and controls are effectively managed in a...

Data Manipulation: A More Troubling Problem than Data Theft

Many people are concerned about the theft of sensitive information, and rightfully so. According to the 2016 Identity Fraud study by Javelin Strategy and Research, identity theft cost U.S. consumers $15 billion in 2015. Businesses also fall victim to identity theft, to the tune of $221 billion worldwide each year. But a more insidious data security problem is gaining...

Why the IoT Needs IAM, Part 2: The Complexity of Controlling Access

DDOS
In a previous post Why the IoT Needs IAM, Part 1: Rise of the Botnets, we discussed the growth of the Internet of Things (IoT) and the enormous attack surface created by billions of Internet-connected devices. Many of these devices have been recruited into botnet armies that are used to launch distributed denial of service (DDoS) attacks. Others are...

Automation Helps Meet Regulatory Requirements for Privileged Accounts

Automation
Privileged account security has become a focal point of many government and industry regulations. Take, for example, the latest version of the Payment Card Industry Data Security Standard (PCI-DSS), which mandates security practices and controls that must be implemented by organizations that store, process, or transmit payment card data. PCI-DSS 3.2 requires that organizations change vendor-default passwords for privileged...