Session Tokens Vs. JWTs: Choosing Your Session Management Solution
In the world of authentication today, session tokens and JSON Web Tokens (JWTs) are the two most popular ways to manage user sessions and maintain a user’s authentication state between calls. Impassioned debates pit these solutions against each other, but each has pros and cons worth evaluating. Depending on the needs of your application, it’s […]
Why You Should Consolidate Your IAM
It’s not often you can get a win that makes your IT processes easier while simultaneously improving your cybersecurity. In fact, oftentimes making improvements in one area (for example, improving IT processes) comes at the cost of the other (cybersecurity). But there’s one area, in particular, where these improvements aren’t mutually exclusive: Identity and access […]
Dev Job Phisher Steals $540M | Patch OpenSSL NOW | Systemd Dev Joins Microsoft
In this week’s The Long View: Spear-phishing causes $540 million loss, a high severity bug in OpenSSL might be “worse than Heartbleed,” and Lennart Poettering is now working for Microsoft.
Stytch Launches New, Flexibility-First SDK
Passwordless solutions have been a trend for a while now, improving user experience (UX) while reducing exposure to common attack vectors. Now, Stytch’s new JavaScript SDK aims to make password-free authentication a bit easier by increasing customization and flexibility while offering fully baked authentication out of the box. Julianna Lamb, Stytch CTO, said the solution […]
Lapsus$ Shames Okta/Sitel | Bitcoin Nukes Climate | EU DMA E2EE FAIL
In this week’s The Long View: Okta and Sitel under fire over Lapsus$ hack, Greenpeace and others call for bitcoin change, and Europe still hates encryption.
Apple Outage Outrage | Linux Random Redo | Okta Hacked (or Not)
In this week’s The Long View: Why Apple services were down, Linux gets a huge RNG overhaul, and we wonder if Okta was hacked again.
Why the Built World Needs Standard APIs
Lately, new ESG initiatives have come front-and-center as companies seek to contextualize and limit their business’s impact on the environment. This is especially true for the built world—a term that refers to the human-made environment that provides the setting for human activity, including homes, buildings, zoning, streets, sidewalks, open spaces, transportation options and more—where monitoring […]
Infrastructure Access Management a Growing DevOps Priority
Organizations plan to address access management over the next 12 months, as the need to secure and streamline infrastructure-wide access controls serves as a prerequisite to other initiatives, like zero-trust. This was one of the key findings of a survey of 600 DevOps professionals conducted by Pollfish and sponsored by strongDM. The report also found […]
Rails 7 FTW | WFH is SOP | 586M Passwords Dumped
In this week’s The Long View: Ruby on Rails 7.0 is go, working from home is still de rigueur, and HIBP gets far, far bigger.
DevOps Teams Struggling to Keep Secrets
A growing number of organizations are suffering security incidents related to exposed secrets in DevOps CI/CD pipelines, according to a recent ThycoticCentrify report. The study paints a troubling picture: Only 5% of survey respondents said most of their development teams use the same secrets management processes and tools. The incidents run the gamut, from secrets […]
Authentication in Serverless Apps—What Are the Options?
Serverless applications are growing in popularity among DevOps engineers. They provide a convenient, predictable way to run simple processes like CI/CD builds or automation scripts with no need to stand up infrastructure. They are also commonly used to deploy microservices. However, serverless applications present unique security challenges, one of them being authentication. How can you […]
Enterprise Blockchain Adoption Hinges on DevOps
There is a lot of excitement around blockchain right now, for a good reason. Production use cases continue to emerge across sectors such as manufacturing, energy, air travel, insurance and finance. Gartner predicts that by 2023, organizations using blockchain smart contracts will see a 50% increase in their data quality. Yet, Gartner also predicts that […]
Popular iOS Apps Request Excessive User Data Permissions
Most apps require some sort of user data to function properly. Google Maps needs location data to offer routing services. Twitter needs photo library access to upload a photo, and so on. Many users are quick to allow access to personal information without hesitation. However, in recent years, it’s become apparent that many apps are […]
5 Ways to Embed Accessibility in Your SDLC
Developing an accessible software development life cycle (SDLC) requires a commitment to inclusion from everyone at the beginning of every project. By committing to developing accessible products, you will avoid costly and timely remediation prior to deployment at the end of your product roadmap. Creating An Accessible Software Development Life Cycle (SDLC) An accessible SDLC […]
Okta Adds Free Developer Edition to AppSec Service
Okta this week lowered the barrier to adoption of DevSecOps best practices by making available an Okta Starter Developer Edition to enable developers to embed Okta authentication, authorization and user management capabilities into applications at no cost for up to 15,000 monthly active users. Randall Degges, head of developer advocacy for Okta, said interest in […]
JumpCloud Brings Zero-Touch Provisioning to the Mac
JumpCloud today announced it is adding a zero-touch enrollment for Macs capability to its cloud directory platform that will also be extended over time to applications. Greg Keller, JumpCloud CTO, said this new capability extends Apple Business Manager, formerly known as Apple Device Enrollment Program (DEP), all the way down to specific users by leveraging […]
Rewind Acquires BackHub to Protect GitHub Repositories
Rewind, a provider of a software-as-a-service (SaaS) platform for backing up cloud services, today announced it has acquired BackHub to gain control of a platform for backing up GitHub repositories. Based in Germany, BackHub adds a data protection platform to a Rewind portfolio that includes offerings for backing up everything from QuickBooks to Shopify. Fresh […]
OpenAPI Specification: Perception vs. Reality
The OpenAPI Specification (OAS) (formerly known as the Swagger specification) provides a way to describe and document REST APIs and their components. It includes details on endpoints, their operations, parameters needed for the operations, expected responses for every operation, authentication methods and even annotations. OAS is an easy format to learn and read, and can […]
DevSecOps Implementation: EDR/XDR
We mentioned host intrusion detection and network intrusion detection in an earlier blog, and mentioned firewalls a couple of times in passing. Let’s delve a bit into the history to understand how these tools’ functionality has evolved over time. On the host side, we had virus detection, in one form or another, from early in […]
Quest Software Expands MDM Cloud Reach
Quest Software today extended the reach of its mobile device management (MDM) service to provide more granular control over mobile devices and applications in addition to being able to track their location. Capabilities being added to the KACE Cloud MDM service include support for a “Kiosk Mode” for Android devices that allows administrators to lock […]
Multi-Cloud Adoption: Time to Rethink Your Identity and Access Management
This may well be the decade that the data center’s reign falls, and multi-clouds prevail. A multi-cloud strategy, which incorporates cloud services from multiple vendors, promises plenty of benefits, including improved resilience and flexibility that makes it easier for enterprises to meet various application and data needs. But, there will also be operational challenges. Expect […]
5 Password Policies to Up Your Security
Complex passwords can save users from being hacked—any IT admin will tell you that. Plus, countless studies and articles on password security have been published about why password policies are vital to online security. Increasing the length of passwords, adding complexity to them and never reusing passwords more than once … these are three examples […]
SSH Key Management and Your Organization
It always starts out the same way: a few machines, a few users and a few SSH keys to manage. You manually copy their keys (and your own) to the appropriate machines. You might even say, “Screw it,” and share one key for root access. Admit it. It’s OK. Well, no, it’s not OK, but […]