Tag: authentication

Stopping AiTM attacks: The defenses that actually work after authentication succeeds

Apr 28, 2026 11:39 AM

Tags: 2fa, access, attack, authentication, awareness, breach, communications, compliance, control, credentials, data, defense, detection, email, finance, framework, identity, incident response, login, mfa, microsoft, monitoring, nist, passkey, phishing, risk, service, threat, tool, training

The 3 controls that close the gap: Control #1: Bind sessions to managed devices The most impactful single control for session security is requiring managed, compliant devices as a condition of accessing sensitive resources. When access policies, such as Microsoft Entra Conditional Access, require that the device presenting a session token is enrolled, managed and…
Beyond the perimeter: Why identity and cyber security are one single story

Apr 28, 2026 11:39 AM

Tags: access, authentication, cyber, identity, monitoring, network, threat

By James Odom, Director of Cyber, and Jim Small, Director of Identity at Hippo Digital For years, identity and cyber security have been treated as separate disciplines, with identity focusing on authentication, onboarding and access and cyber security focusing on networks, monitoring and threat response. That separation made sense when systems had clearer boundaries. The…
Critical LiteLLM Flaw Enables Database Attacks Through SQL Injection

Apr 28, 2026 9:39 AM

Tags: access, api, attack, authentication, cve, cyber, cybercrime, exploit, flaw, injection, sql, vulnerability

A critical pre-authentication SQL injection vulnerability, identified as CVE-2026-42208, has been discovered in the popular LiteLLM gateway, allowing attackers to access databases without credentials. Cybercriminals have already been observed exploiting this flaw to target high-value secrets such as API keys and provider credentials. Overview of the Vulnerability CVE-2026-42208 is a critical flaw in LiteLLM, an…
Why Email Deliverability Matters in Multi-Factor Authentication (MFA) Workflows

Apr 28, 2026 7:39 AM

Tags: authentication, email, mfa

Learn why email deliverability is critical in MFA workflows to ensure reliable OTP delivery, improve security, and enhance user experience. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/why-email-deliverability-matters-in-multi-factor-authentication-mfa-workflows/
How Email Infrastructure Impacts OTP and Magic Link Authentication Success Rates

Apr 28, 2026 6:39 AM

Tags: authentication, email, infrastructure

Learn how email infrastructure impacts OTP and magic link authentication success rates, improving deliverability, security, and user experience. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/how-email-infrastructure-impacts-otp-and-magic-link-authentication-success-rates/
How Email Infrastructure Impacts OTP and Magic Link Authentication Success Rates

Apr 28, 2026 6:39 AM

Tags: authentication, email, infrastructure

Learn how email infrastructure impacts OTP and magic link authentication success rates, improving deliverability, security, and user experience. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/how-email-infrastructure-impacts-otp-and-magic-link-authentication-success-rates/
How Authentication Systems Help Build Trust in Online Education Platforms

Apr 28, 2026 6:39 AM

Tags: authentication, data

Learn how authentication systems help build trust in online education platforms by improving security, protecting data, and ensuring safe access. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/how-authentication-systems-help-build-trust-in-online-education-platforms/
AI is reshaping DevSecOps to bring security closer to the code

Apr 27, 2026 11:38 AM

Tags: access, ai, api, application-security, attack, authentication, automation, breach, business, cloud, communications, compliance, container, control, data, data-breach, detection, exploit, governance, infrastructure, injection, least-privilege, risk, service, skills, software, sql, strategy, supply-chain, threat, tool, training, vulnerability

Explicit security requirements elevate AI benefits: While deploying AI with DevSecOps is helping to shift the emphasis on security to earlier in the development lifecycle, this requires “explicit instruction to do it right,” says Noe Ramos, vice president of AI operations at business software provider Agiloft.”AI coding assistants accelerate development meaningfully, but they optimize for…
9 Identity-Based Threats Redefining Cybersecurity in 2026 (Beyond Credential Stuffing)

Apr 25, 2026 9:39 AM

Tags: ai, attack, authentication, credentials, cybersecurity, deep-fake, identity, mfa, phishing, threat

Discover the 9 most dangerous identity-based threats in 2026, from AI phishing attacks and deepfake authentication bypass to MFA fatigue and harvest-now-decrypt-later quantum threats. Learn why legacy authentication fails against each one and how phishing-resistant, passwordless authentication changes the equation. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/9-identity-based-threats-redefining-cybersecurity-in-2026-beyond-credential-stuffing/
9 Identity-Based Threats Redefining Cybersecurity in 2026 (Beyond Credential Stuffing)

Apr 25, 2026 9:39 AM

Tags: ai, attack, authentication, credentials, cybersecurity, deep-fake, identity, mfa, phishing, threat

Discover the 9 most dangerous identity-based threats in 2026, from AI phishing attacks and deepfake authentication bypass to MFA fatigue and harvest-now-decrypt-later quantum threats. Learn why legacy authentication fails against each one and how phishing-resistant, passwordless authentication changes the equation. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/9-identity-based-threats-redefining-cybersecurity-in-2026-beyond-credential-stuffing/
13 Hidden Costs of Password-Based Authentication (With Real ROI Math)

Apr 25, 2026 9:39 AM

Tags: authentication, breach, business, password

Discover the 13 hidden costs of password-based authentication, from $70-per-reset help desk overhead to SMS OTP fees and breach exposure. Includes a simple ROI worksheet formula to calculate your organization’s annual password tax and build the business case for passwordless authentication First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/13-hidden-costs-of-password-based-authentication-with-real-roi-math/
10 Warning Signs Your Current Authentication Stack Is a Breach Waiting to Happen

Apr 25, 2026 9:39 AM

Tags: authentication, breach, detection, risk

Run a quick self-audit against 10 warning signs that your authentication stack has critical vulnerabilities. Each sign includes a diagnostic check, an explanation of why it’s dangerous, and a concrete fix. Covers SMS OTP risk, bot detection gaps, session management failures, and more. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/10-warning-signs-your-current-authentication-stack-is-a-breach-waiting-to-happen/
15 Costliest Credential Stuffing Attack Examples of the Decade (and the Authentication Lessons They Teach)

Apr 25, 2026 7:39 AM

Tags: attack, authentication, business, credentials

Explore the 15 most expensive credential stuffing attacks of the decade. Learn the critical authentication lessons to protect your business from account takeover. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/15-costliest-credential-stuffing-attack-examples-of-the-decade-and-the-authentication-lessons-they-teach/
Microsoft to roll out Entra passkeys on Windows in late April

Apr 24, 2026 8:39 PM

Tags: authentication, microsoft, passkey, phishing, windows

Microsoft will roll out passkey support for phishing-resistant passwordless authentication to Microsoft Entra”‘protected resources from Windows devices starting late April. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-to-roll-out-entra-passkeys-on-windows-in-late-april/
DORA and operational resilience: Credential management as a financial risk control

Apr 24, 2026 5:39 PM

Tags: access, authentication, breach, control, credentials, dora, finance, regulation, resilience, risk

Article 9 of DORA makes authentication and access control a legal obligation for EU financial entities. Here is what the regulation requires, and what a breach looks like when those controls are missing. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/dora-and-operational-resilience-credential-management-as-a-financial-risk-control/
DANE Authentication for Enterprise Email Security

Apr 24, 2026 5:39 PM

Tags: authentication, email

Learn how DANE authentication helps secure email in transit, why DNSSEC is essential, and where deployment can become operationally complex. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/dane-authentication-for-enterprise-email-security/
Xiongmai IP Camera Flaw Lets Attackers Bypass Authentication

Apr 24, 2026 12:39 PM

Tags: access, authentication, cctv, cyber, cybersecurity, flaw, infrastructure, technology, vulnerability

A critical security vulnerability has been identified in Hangzhou Xiongmai Technology’s XM530 IP Cameras, putting countless commercial facilities at risk. This severe flaw allows remote attackers to bypass authentication protocols and access sensitive device information easily. The Cybersecurity and Infrastructure Security Agency (CISA) published an official alert regarding the issue on April 23, 2026. Critical…
Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Apr 23, 2026 8:39 PM

Tags: access, api, attack, authentication, automation, breach, control, credentials, crypto, data, data-breach, endpoint, exploit, intelligence, malicious, malware, open-source, pypi, risk, service, software, supply-chain, theft, threat, unauthorized, worm

<div cla TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the malware immediately, examine…
How Branded SSO Interfaces Improve User Trust And Experience

Apr 23, 2026 4:39 PM

Tags: authentication

Learn how branded SSO interfaces improve user trust and experience by creating seamless, secure, and consistent authentication flows. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/how-branded-sso-interfaces-improve-user-trust-and-experience/
Offer customers passkeys by default, UK’s NCSC tells enterprises

Apr 23, 2026 4:39 PM

Tags: attack, authentication, credentials, cyber, identity, login, mfa, passkey, password, phishing, risk, service, strategy, theft

How passkeys change the attack model: The NCSC added that passkeys reduce risk by removing reliance on shared secrets and binding authentication to the legitimate service.According to the agency, this prevents credential reuse and relay attacks, as authentication cannot be intercepted and reused by an attacker.Passkeys use cryptographic key pairs stored on a user’s device,…
UK’s NCSC calls passkeys the default, says passwords are no longer fit for the purpose

Apr 23, 2026 3:39 PM

Tags: attack, authentication, credentials, cyber, identity, login, mfa, passkey, password, phishing, risk, service, strategy, theft

How passkeys change the attack model: The NCSC added that passkeys reduce risk by removing reliance on shared secrets and binding authentication to the legitimate service.According to the agency, this prevents credential reuse and relay attacks, as authentication cannot be intercepted and reused by an attacker.Passkeys use cryptographic key pairs stored on a user’s device,…
CNAPP ein Kaufratgeber

Apr 23, 2026 6:39 AM

Tags: access, ai, application-security, attack, authentication, cloud, container, detection, edr, encryption, framework, group, ibm, infrastructure, intelligence, kubernetes, linux, ml, monitoring, network, open-source, risk-management, saas, soar, software, supply-chain, threat, tool, vmware

Cloud Security bleibt ein diffiziles Thema und die Tools, mit denen sie sich gewährleisten lässt, werden zunehmend komplexer und schwieriger zu durchschauen auch dank der ungebrochenen Liebe der Branche zu Akronymen. Mit CNAPP kommt nun ein weiteres hinzu. Die Abkürzung steht für Cloud-Native Application Protection Platform und kombiniert die Funktionen von vier separaten Cloud-Security-Werkzeugen: Cloud…
Riddled with flaws, serialEthernet converters endanger critical infrastructure

Apr 23, 2026 5:39 AM

Tags: access, authentication, control, credentials, data, data-breach, exploit, firmware, flaw, infrastructure, malicious, network, open-source, password, rce, remote-code-execution, risk, service, threat, update, vulnerability

New RCE and other vulnerabilities: Aside from all the known vulnerabilities from open-source components, the Forescout researchers also performed manual security analysis and identified previously unknown flaws in the firmware of three specific devices from two vendors: Lantronix EDS3000PS Series, Lantronix EDS5000 Series, and Silex SD330-AC.The web-based management interface of the Lantronix EDS5000 had five…
Riddled with flaws, serialEthernet converters endanger critical infrastructure

Apr 23, 2026 5:39 AM

Tags: access, authentication, control, credentials, data, data-breach, exploit, firmware, flaw, infrastructure, malicious, network, open-source, password, rce, remote-code-execution, risk, service, threat, update, vulnerability

New RCE and other vulnerabilities: Aside from all the known vulnerabilities from open-source components, the Forescout researchers also performed manual security analysis and identified previously unknown flaws in the firmware of three specific devices from two vendors: Lantronix EDS3000PS Series, Lantronix EDS5000 Series, and Silex SD330-AC.The web-based management interface of the Lantronix EDS5000 had five…
NCSC heralds end of passwords for consumers and pushes secure passkeys

Apr 23, 2026 5:39 AM

Tags: authentication, cyber, mfa, passkey, password

UK National Cyber Security Centre is urging consumers to replace passwords and two-factor authentication with passkeys, following a technical study that shows they are more secure and easier to use First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366642156/NCSC-heralds-end-of-passwords-for-consumers-and-pushes-secure-passkeys
Why Cisco Is Eyeing Buy of Non-Human Identity Startup Astrix

Apr 23, 2026 1:39 AM

Tags: authentication, cisco, cyber, identity, startup

Deal Would Help Cisco Expand Footprint Beyond Authentication, ITDR and ISPM Cisco’s cyber M&A dry spell could soon come to an end, with the company reportedly in talks to acquire New York-based non-human identity startup Astrix Security for between $250 million and $350 million. That would represent at least a 25% premium to the startup’s…
Microsoft issues emergency update for macOS and Linux ASP.NET threat

Apr 22, 2026 10:39 PM

Tags: authentication, linux, macOS, microsoft, threat, update

When authentication fails, things can go very, very wrong. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/04/microsoft-issues-emergency-update-for-macos-and-linux-asp-net-threat/
Microsoft issues emergency update for macOS and Linux ASP.NET threat

Apr 22, 2026 10:39 PM

Tags: authentication, linux, macOS, microsoft, threat, update

When authentication fails, things can go very, very wrong. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/04/microsoft-issues-emergency-update-for-macos-and-linux-asp-net-threat/