All news with #iam tag

🔐 Microsoft Deputy CISO Ilya Grebnov outlines practical steps to make opportunistic cyberattacks harder by design. He emphasizes credential elimination using managed identities and federated tokens, paired with endpoint reduction to move services off the public internet. The article further advocates platform engineering—paved paths, policy-as-code, and centralized core services—to enforce consistent secure defaults and reduce the attack surface at scale.

🔒 AWS has automatically upgraded all AWS Managed Microsoft AD directories to the Windows functional level 2016, effective Apr 20, 2026. The update delivers enhanced authentication and improved privileged access management and enables built-in LAPS to generate unique, complex local administrator passwords stored securely in Active Directory. The upgrade is applied in all Regions where the service is available, except Middle East (UAE) and Middle East (Bahrain). See the AWS Directory Service Administration Guide for details.

🔐 AWS introduced multi-session sign-in for Amazon Quick, allowing users to access up to five Quick accounts concurrently in the same browser. The update includes the account name in all URLs so agents, spaces, flows, reports, dashboards, and other assets open in the intended account. Users add accounts via the top-right menu or a pre-populated account input on global URLs, and can sign out per tab or from all sessions.

🔐 This live webinar explains why unmanaged non-human identities—service accounts, API tokens, AI agent connections, and OAuth grants—are now a primary vector for cloud breaches. You will learn a repeatable discovery process to surface every automated credential, a framework to right-size permissions, and how to implement an automated lifecycle policy so dead credentials are revoked. Attendees receive an Identity Cleanup Checklist to apply immediately.

🔒 The article argues that the ongoing debate over the CISO reporting line persists because many organizations still view cybersecurity as a technical issue rather than a strategic leadership concern. It emphasizes that reporting relationships matter for access, authority and influence, but they are not a panacea. Effective security depends on governance, trust between the CISO and their boss, and the ability to operate across IT, legal, HR, procurement and business units. The piece rejects a universal model and urges focus on cross‑functional authority and leadership.

🔒 Curity announced Access Intelligence, an extension to its Identity Server IAM platform designed to secure rapidly proliferating autonomous AI agents. Rather than rely on static, pre-granted permissions, the company uses Token Intelligence to embed an agent's declared purpose and intent in OAuth tokens and issues short-lived, action-specific tokens at runtime. The system can require human approval for high-risk tasks, is deployed as a self-hosted microservice, and centralizes token validation to isolate unregistered or shadow agents.

🔒 This post explains how AI agents and coding assistants access AWS resources via the Model Context Protocol (MCP) and why deterministic IAM controls are required. It outlines three security principles—assume all granted permissions could be used, enforce role governance, and differentiate AI-driven from human-initiated actions—and maps them to deployment patterns. It contrasts AWS-managed MCP servers (which inject context keys) with self-managed servers (which require session tags), and provides practical IAM policy examples, monitoring guidance, and operational controls.

🔐 Microsoft has introduced a temporary fast-track to reinstate accounts suspended from the Windows Hardware Program after developers reported being locked out without prior notice. The process asks affected partners to open a support case, provide a clear business justification, and resolve outstanding compliance requirements before full access is restored. Microsoft also provided guidance on correct sign-in and alternative support contacts to address workflow issues.

🔒 The new Aurora DSQL Connector for PHP (PDO_PGSQL) simplifies building PHP applications on Aurora DSQL by automating IAM token generation, SSL configuration, and connection pooling. It removes the need for static user-managed passwords while maintaining full compatibility with existing PDO_PGSQL features. The connector also offers opt-in optimistic concurrency control (OCC) retries with exponential backoff and supports custom IAM credential providers and AWS profiles to streamline credential management and client retry logic.

🔒 AWS Private Certificate Authority now supports customer managed permissions in AWS Resource Access Manager (AWS RAM), enabling administrators to grant only the specific API operations each consuming account needs. You can choose from granular read operations (for example, DescribeCertificateAuthority, GetCertificate, GetCertificateAuthorityCertificate) and write operations (for example, IssueCertificate, RevokeCertificate). Cross-account issuers are no longer limited to a single certificate template. The feature is available in all Regions where Private CA and RAM are offered.

🔍 Orchid Security warns that modern IAM estates harbor extensive "identity dark matter," with roughly 46% of identity activity operating outside centralized visibility. The article positions Gartner's Identity Visibility and Intelligence Platform (IVIP) as a necessary observability layer that unifies telemetry from managed and unmanaged systems, applies AI to infer intent and risky behavior, and enables automated remediation to reduce exposure.

🛡️ The Hacker News highlights that while headline breaches attract investment, recurring credential incidents—account lockouts, reused or exposed passwords, and frequent resets—impose persistent operational costs. Forrester estimates resets can account for up to 30% of helpdesk tickets, at roughly $70 each, and IBM’s 2025 report cites a $4.4M average breach cost. Poorly designed password policies and mandatory periodic resets often make the problem worse by prompting insecure user behavior. Practical measures include user-friendly, robust policies, breached-password screening, and shifting away from arbitrary expiration windows; vendors such as Specops Password Policy are presented as tools that detect exposed credentials and reduce incident volume.

🔒 Cloudflare has introduced Organizations in public beta to help enterprise customers manage multiple Cloudflare Accounts centrally. The feature creates an organization layer for account grouping, introduces an Org Super Administrator role, and provides aggregated analytics and shared policy sets. Initial rollout targets enterprise plans with staged expansion to other customers and partners. There is no additional fee for Organizations during beta.

🔑 AWS has added support for policy store aliases along with named policies and policy templates in Amazon Verified Permissions. Developers can now assign human-readable aliases to tenant policy stores and reference policies by meaningful names instead of system-generated IDs. This removes the need for separate mapping tables and simplifies multi-tenant deployments and everyday policy management. These capabilities are available in all Regions where the service operates.

🔐 The new Aurora DSQL connectors for .NET (Npgsql) and Rust (SQLx) simplify secure application access by automating IAM token generation, SSL setup, and connection pooling. They remove reliance on static user passwords while remaining fully compatible with existing driver features. The connectors also provide opt-in optimistic concurrency control retries with exponential backoff, custom IAM credential providers, and AWS profile support to ease credential management.

🔒 Amazon Connect now applies tag-based access control (TBAC) to quick response assignments for routing profiles. Administrators can restrict which routing profiles receive specific quick responses based on their TBAC permissions, so agents only see templates relevant to their assigned profiles. This change aligns quick responses with existing Amazon Connect resource access controls and supports compliance and localized disclosure workflows. The update is available in multiple AWS Regions.

🔒 The new Aurora DSQL Connector for Ruby (pg gem) simplifies building Ruby applications on Aurora DSQL by automating IAM token generation, SSL configuration, and connection pooling. It removes the need for persistent user-generated passwords while preserving full compatibility with existing pg gem features. The connector also provides optional optimistic concurrency control (OCC) retry with exponential backoff and supports custom IAM credential providers and AWS profiles.

🔍 Many organizations treat the cybersecurity skills gap as a supply problem, but the 2025 Cybersecurity Skills Gap Global Research Report shows restrictive hiring definitions are a major cause. Rigid filters like four-year degrees exclude candidates with military, technical, or vendor-certified experience who already possess relevant, hands-on capabilities. Adopting a skills-first approach and mapping role-aligned certifications to job requirements expands the qualified pool, shortens onboarding, and reduces operational risk. Fortinet emphasizes partnerships and free, scalable training as practical ways to build and certify talent at scale.

🔐 Amazon Route 53 Profiles now supports granular AWS Identity and Access Management (IAM) permissions. Administrators can create IAM policies that restrict users to specific operations—associate, disassociate, or update—on resource types such as private hosted zones, Resolver rules, and DNS Firewall rule groups. Permissions may be scoped by resource ARN, hosted zone name, Resolver rule domain name, DNS Firewall rule group priority range, or specific VPC associations to enable precise delegation.

🔐 The IAM market is shifting from traditional login and MFA toward treating identity as a security control plane, driven by demand for phishing-resistant authentication and stronger governance for non-human accounts. Buyers are prioritizing FIDO2/passkeys, biometrics, and controls for service accounts, API keys, and AI agents. Regulatory change, managed services, and vendor consolidation are reshaping architectures and procurement decisions.