Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations //

Identity & Access Management

News & Commentary
What Industrial Control System Vulnerabilities Can Teach Us About Protecting the Supply Chain
Chen Fradkin, Security Researcher at ClarotyCommentary
Older technologies used in industrial and critical infrastructure leave the sector highly vulnerable to attack, but organizations can take steps to better protect themselves.
By Chen Fradkin Security Researcher at Claroty, 6/15/2021
Comment0 comments  |  Read  |  Post a Comment
Secure Access Trade-offs for DevSecOps Teams
Ev Kontsevoy, CEO of TeleportCommentary
Thanks to recent advancements in access technologies, everyone can apply identity-based authentication and authorization and zero-trust principles for their computing resources.
By Ev Kontsevoy CEO of Teleport, 6/11/2021
Comment0 comments  |  Read  |  Post a Comment
Colonial Pipeline CEO: Ransomware Attack Started via Pilfered 'Legacy' VPN Account
Dark Reading Staff, Quick Hits
No multifactor authentication was attached to the stolen VPN password used by the attackers, Colonial Pipeline president & CEO Joseph Blount told a Senate committee today.
By Dark Reading Staff , 6/8/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft CISO Shares Remote Work Obstacles & Lessons Learned
Kelly Sheridan, Staff Editor, Dark ReadingNews
Bret Arsenault explains changes he implemented along the way as Microsoft's workforce went from 20% to 97% remote.
By Kelly Sheridan Staff Editor, Dark Reading, 6/8/2021
Comment0 comments  |  Read  |  Post a Comment
How Employees Can Keep Their 401(k)s Safe From Cybercriminals
Matt Lindley, COO and CISO at NINJIOCommentary
As retirement fund balances grow, cybercriminals are becoming more brazen in their efforts to deplete people's savings.
By Matt Lindley COO and CISO at NINJIO, 6/8/2021
Comment0 comments  |  Read  |  Post a Comment
First Known Malware Surfaces Targeting Windows Containers
Jai Vijayan, Contributing WriterNews
Siloscape is designed to create a backdoor in Kubernetes clusters to run malicious containers.
By Jai Vijayan Contributing Writer, 6/7/2021
Comment0 comments  |  Read  |  Post a Comment
Rise in Opportunistic Hacks and Info-Sharing Imperil Industrial Networks
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Security researchers at Mandiant have seen an increasing wave of relatively simplistic attacks involving ICS systems - and attackers sharing their finds with one another - since 2020.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 5/25/2021
Comment0 comments  |  Read  |  Post a Comment
The Adversary Within: Preventing Disaster From Insider Threats
Kevin Dunne, President, PathlockCommentary
Insiders are in a position of trust, and their elevated permissions provide opportunities to cause serious harm to critical business applications and processes.
By Kevin Dunne President, Pathlock, 5/25/2021
Comment0 comments  |  Read  |  Post a Comment
How to Adapt to Rising Consumer Expectations of Invisible Security
Chris Ryan, Senior Fraud Solutions Consultant at ExperianCommentary
Working from home has changed users' ideas about seamless security. Here's how to address them.
By Chris Ryan Senior Fraud Solutions Consultant at Experian, 5/19/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Adds GPS Location to Identity & Access Control in Azure AD
Dark Reading Staff, Quick Hits
New capabilities let admins restrict access to resources from privileged access workstations or regions based on GPS location.
By Dark Reading Staff , 5/13/2021
Comment1 Comment  |  Read  |  Post a Comment
Can Organizations Secure Remote Workers for the Long Haul?
Ian Pratt, Global head of Security for Personal Systems at HP Inc.Commentary
By focusing on protection instead of detection, organizations can defend against targeted attacks without compromising security or productivity.
By Ian Pratt Global head of Security for Personal Systems at HP Inc., 5/4/2021
Comment0 comments  |  Read  |  Post a Comment
Your Digital Identity's Evil Shadow
Sam Crowther, Founder, KasadaCommentary
In the wrong hands, these shady shadows are stealthy means to bypass security systems by hiding behind a proxy with legitimate IP addresses and user agents.
By Sam Crowther Founder, Kasada, 4/29/2021
Comment0 comments  |  Read  |  Post a Comment
The Challenge of Securing Non-People Identities
Eric Kedrosky, Chief Information Security Officer at Sonrai SecurityCommentary
Non-people identities, which can act intelligently and make decisions on behalf of a person's identity, are a growing cybersecurity risk.
By Eric Kedrosky Chief Information Security Officer at Sonrai Security, 4/29/2021
Comment0 comments  |  Read  |  Post a Comment
Attacks Targeting ADFS Token Signing Certificates Could Become Next Big Threat
Jai Vijayan, Contributing WriterNews
New research shows how threat actors can steal and decrypt signing certificates so SAML tokens can be forged.
By Jai Vijayan Contributing Writer, 4/28/2021
Comment0 comments  |  Read  |  Post a Comment
Name That Toon: Greetings, Earthlings
John Klossner, CartoonistCommentary
Caption time! Come up with something out of this world for Dark Reading's latest contest, and our panel of experts will reward the winner with a $25 Amazon gift card.
By John Klossner Cartoonist, 4/22/2021
Comment17 comments  |  Read  |  Post a Comment
How to Attack Yourself Better in 2021
Pavel Suprunyuk, Technical lead of the audit and consulting team, Group-IBCommentary
Social engineering pen testing is just one step in preventing employees from falling victim to cybercriminals.
By Pavel Suprunyuk Technical lead of the audit and consulting team, Group-IB, 4/21/2021
Comment0 comments  |  Read  |  Post a Comment
2020 Changed Identity Forever; What's Next?
Arthur Coviello, Venture partner at Rally Ventures, LLC and former executive chairman RSA SecurityCommentary
For all the chaos the pandemic caused, it also sparked awareness of how important an identity-centric approach is to securing today's organizations.
By Arthur Coviello Venture partner at Rally Ventures, LLC and former executive chairman RSA Security, 4/20/2021
Comment0 comments  |  Read  |  Post a Comment
Security Gaps in IoT Access Control Threaten Devices and Users
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers spot problems in how IoT vendors delegate device access across multiple clouds and users.
By Kelly Sheridan Staff Editor, Dark Reading, 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
How the Biden Administration Can Make Digital Identity a Reality
Hal Granoff, Head of US Market Development at CallsignCommentary
A digital identity framework is the answer to the US government's cybersecurity dilemma.
By Hal Granoff Head of US Market Development at Callsign, 4/16/2021
Comment0 comments  |  Read  |  Post a Comment
Thycotic & Centrify Merge to Form Cloud Identity Security Firm
Dark Reading Staff, Quick Hits
The combined entity will expand on both companies' privileged access management tools and expects to debut a new brand this year.
By Dark Reading Staff , 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24368
PUBLISHED: 2021-06-20
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-33185
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
CVE-2021-33186
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-31272
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.