Category: News

Many Federal Agencies Are Struggling to Meet ICAM Requirements

In 2009, the federal government began development of the Identity, Credential, and Access Management (ICAM) architecture to address security weaknesses across agencies in the areas of user identification and authentication. Established by the Office of Management and Budget (OMB), the federal ICAM program provides guidance on IT policies, systems, and standards that help agencies monitor, manage, and secure access...

CyberArk Privileged Session Manager: The Modern “Jump Server”

In our last post, we discussed how multifactor authentication (MFA) can help secure privileged accounts. Adding a second factor of authentication, such as a physical ID card or fingerprint, can prevent hackers from using a stolen username and password to gain access to a privileged account. That’s why security experts recommend MFA and many government and industry regulations require...

New Study Highlights Security Risks of Digital Transformation

Organizations are rethinking their operational models, finding new solutions to problems, and enhancing the customer experience by integrating technology into everything they do. That’s the essence of digital transformation (DX). Rather than simply building on what you have with new technology, DX is intended to drive innovation and reinvent internal processes and the external markets you serve. The problem...

Automating Access Certification Reduces Risk and Improves Compliance

Access certification requires that managers regularly review their employees’ access to financial systems to validate that access privileges align with the employee’s job requirements. Many organizations have implemented access certification processes to comply with the Sarbanes-Oxley Act (SOX) of 2002. Because SOX mandates an annual evaluation of internal controls and procedures for maintaining the integrity of financial reporting, organizations...

Report: Billions of Malicious Login Attempts Each Month — and Growing

Intuit recently notified users of its TurboTax software that their accounts might have been compromised using username/password combinations obtained from another source — what’s known as a credential-stuffing attack. The company said the hackers might have obtained the names, Social Security numbers, dates of birth, driver’s license numbers, and financial information of those affected. In credential stuffing, hackers use...

How to Avoid a Catastrophic Active Directory Breach

A 2017 study by the University of Maryland’s Clark School of Engineering found that, on average, there’s a hacker attack on Internet-connected computers every 39 seconds. Many of these are brute-force attacks that attempt to gain access using common, weak credentials. If one of these attacks were to breach a corporate user’s machine, the hacker could potentially gain higher-level...

PIM vs. PAM: What’s the Difference and Does It Matter?

Any organization seeking to improve the security of its privileged accounts will soon run into a pair of acronyms: PIM (privileged identity management) and PAM (privileged access management). The two terms are closely related and often used interchangeably, but there are distinct differences. Let’s start by defining what “privileged” means. A privileged account allows a user to take administrator-level...

Why SaaS Requires Strong Privileged Access Management

Software-as-a-Service (SaaS) delivers real business benefits, including reduced capital and operational overhead, continuous software updates, and simplified remote access. However, many IT decision-makers are concerned their organizations aren’t doing enough to secure cloud-based solutions. In a recent study conducted by Vanson Bourne, 64 percent of IT decision-makers said their “organization’s SaaS adoption is outpacing their ability to secure it.”...

Research Digs into Privileged Access Management Capabilities and Challenges

Traditionally, workers relied on IT teams to provide privileged access to the resources needed to perform tasks. Today, workers demand unprecedented rights to perform tasks on servers, applications, data, and other IT resources. While privileged access can increase user freedom and productivity and reduce administrative efforts and costs, security requirements are rarely a consideration. The key is to determine...

Why Identity Governance Is Ripe for a “Shift Left” Approach

As organizations seek to bolster security and improve the user experience, the “Shift Left” movement is gaining steam. The term actually has a number of definitions, depending on context. In software development, where it originated, Shift Left refers to an approach in which testing is done earlier in the process — that is, it is shifted left on the...