Warning: Attackers are abusing poorly secured and managed implementations of Microsoft Windows Active Directory to hack organizations and distribute ransomware. Fewer old operating systems and greater Active Directory security knowledge are helping mitigate the threat. But experts say more must be done.
A core problem in all identity and access management (IAM) systems is how to help requesters articulate access requests. A typical business user, without a technical knowledge of how access rights are
calculated in each system or application, faces a daunting challenge in selecting just the right entitlements
from...
When it comes to drivers for implementing and maintaining privileged access management programs, Wallix's Grant Burst says that demonstrating compliance and safety remain top priorities. Another driver, he says, is the sheer interconnectedness of devices - driven by the rise of IoT.
Managing Active Directory can be painful. Native tools have limited capabilities, which leads to inefficiencies, such as managing user accounts or group membership via manual processes or scripts. To make things even more interesting, Microsoft has introduced Azure Active Directory (AAD). It's a cloud-based directory...
Aluminum giant Norsk Hydro has been hit by LockerGoga ransomware, which was apparently distributed to endpoints by hackers using the company's own Active Directory services against it. To help safeguard others, security experts have called on Hydro to release precise details of how it was hit.
Currently, nearly ninety percent of organizations worldwide are using
Active Directory (AD) for on-premises
resources (aka on-prem). That
represents 500 million organizations
and somewhere around 10 billion daily
authentications. In fact, in the world
of identity and access management
(IAM), AD has become...
The Swiss government says that online attackers used a variant of "Turla" malware - previously tied to campaigns with suspected Russian intelligence ties - to steal at least 23 GB of sensitive information from state-owned defense firm RUAG.
Backed by its own logo, Badlock refers to a set of critical Samba vulnerabilities in Windows and most Unix/Linux operating systems, which attackers could exploit to launch man-in-the-middle attacks against corporate networks.
It's been a half-year now since Art Gilliland stepped into the role of CEO at startup security company Skyport Systems. What lessons has he learned from the marketplace, and where does he expect Skyport to make its mark? Find out in this video interview.
Psychologically speaking, nothing beats the power of a well-timed deadline. And love it or hate it, Google's 90-day "Project Zero" deadline for fixing flaws - before they get publicly disclosed - has rewritten bug-patching rules.
As major cloud vendors, including Salesforce, integrate identity and access management features into their platforms, security professionals must size up the role that stand-alone IAM systems will play in the long run.
Consolidating Microsoft Active Directory isn't just a technical challenge, but a personnel one as well. Just ask Johnson Matthey's Steve Way, who had to calm dozens of administrators he labels as "masters of their own universe."
FISMA addresses security issues in a comprehensive manner, covering everything from identity management to physical building security. This white paper focuses specifically on identity and access management (IAM) issues, using the guidance provided by NIST Special Publication 800-53 recommended Security Controls for...
"Allowing systems with existing security vulnerabilities into the headquarters domain puts department data at risk of unauthorized access, removal, or destruction," a Department of Homeland Security Inspector General audit says.
As employees seek to use the latest IT on the job, it's incumbent for CISOs to figure out how to secure these technologies. NASA's Jerry Davis doesn't like to say, "no."
Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing govinfosecurity.com, you agree to our use of cookies.
