All news with #iam tag

🔐 AI agents—custom GPTs, copilots, coding agents and other autonomous tooling—are proliferating in production while remaining largely outside traditional IAM, PAM, and IGA controls. The piece argues for treating agents as a distinct identity class and applying continuous identity lifecycle management to ensure visibility, ownership, dynamic least privilege, and auditability. Rather than slowing adoption, this approach positions identity as the control plane for balancing innovation and security.

🔒 Early agentic AI experiments have exposed a rapidly expanding cybersecurity problem: enterprises are accumulating vast numbers of non-human identities (NHIs)—service accounts, tokens, API keys and automation credentials—that security teams largely cannot see or govern. Analysts predict counts will jump from millions to tens of millions within months, driving visibility into these assets into the single digits. Experts recommend containment and segmentation of legacy NHIs, strict ownership, and a clean-slate approach to provisioning future agents rather than attempting perfect retroactive inventories.

🔐 AWS Security Token Service (STS) now validates select identity-provider-specific claims from Google, GitHub, CircleCI, and Oracle Cloud Infrastructure for OIDC federation via the AssumeRoleWithWebIdentity API. You can reference these custom claims as condition keys in IAM role trust policies and resource control policies to enforce finer-grained access control and establish data perimeters. This enhancement builds on IAM's OIDC federation capabilities and is available in all AWS Commercial Regions.

🔐 Non-human identities — service accounts, API keys, automation credentials and AI agents — are proliferating across cloud environments and often sit outside governance, creating high-risk blind spots. The author recounts finding a dormant Azure service account with owner-level access and dozens of similar accounts, and cites industry data showing machine-to-human ratios of up to 500:1. He recommends continuous discovery, strict least-privilege defaults, elimination of static credentials and automated rotation to reduce this primary breach vector.

🔐 Amazon Cognito introduces inbound federation Lambda triggers that let you transform and customize federated user attributes during authentication. You can modify responses from external SAML and OIDC providers — adding, overriding, or suppressing attributes — before they are stored in your user pool to avoid issues such as Cognito's 2,048-character limit per attribute. The trigger is available via hosted UI (classic) and managed login in all AWS Regions and is configurable through the Console, CLI, SDKs, CDK, or CloudFormation.

🔒 France Travail has been fined €5 million by the CNIL after a March 2024 cyber-attack that potentially exposed personal data for an estimated 43 million jobseekers. The regulator found failures including weak authentication for Cap Emploi advisors, insufficient logging and monitoring, and overly broad access permissions, breaching Article 32 of the GDPR. France Travail must provide evidence of corrective measures on a strict timeline or face a €5,000 daily fine.

🔐 Near-identical password reuse—small, predictable modifications to existing credentials—regularly bypasses standard complexity and password-history checks, creating a persistent attack vector even in well-managed environments. Attackers weaponize breached credential lists with automated transformations to infer updated passwords quickly. Users favor these tweaks because they are memorable and compliant on the surface. Implement continuous breach monitoring, similarity analysis, and centralized controls such as Specops Password Policy to detect and block overly similar replacements.

🔐 Privileged accounts frequently remain active across enterprises, with a reported 91% of end-users operating at their highest privilege. Analysts link this to legacy governance, fragile integrations, and cumbersome PAM tooling that drives users to bypass controls. The growth of non-human identities—service accounts, APIs, CI/CD pipelines—exacerbates the issue because they authenticate programmatically and rarely expire. That standing access raises risks from accidental outages and data exposure to lateral attacker movement and weakened compliance.

🔒 Amazon Connect Cases now supports tag-based access control, enabling administrators to attach tags to case templates and restrict which users can view or manage cases based on security profiles. For example, teams can tag fraud cases and limit view/edit rights to users assigned to a fraud security profile. This capability strengthens enforcement of internal controls and data access policies, simplifies segmentation of sensitive workflows, and reduces the risk of unauthorized access across supported AWS regions.

🛡️ AWS IAM Identity Center now supports native IPv6 via new dual-stack endpoints that accept both IPv4 and IPv6 clients, enabling direct IPv6 access without network address translation. Administrators should update external IdP configurations (ACS and SCIM URLs), adjust firewalls and gateways, and share the dual-stack app URL with users. You can monitor adoption through CloudTrail by inspecting clientProvidedHostHeader to distinguish IPv4-only and dual-stack usage.

🔐 Identity providers like Okta are central to modern SaaS security, and subtle configuration gaps can create serious exposure. This article highlights six fundamental settings—password policies, phishing‑resistant MFA, ThreatInsight, admin session ASN binding, session lifetimes, and behavior rules—that reduce the risk of account takeovers and session hijacking. Complementing these controls with continuous monitoring from Nudge Security helps detect drift and remediate misconfigurations before they’re exploited.

🔐 AI agents are accelerating enterprise work but create new ownership and approval gaps for security teams. Unlike human users or traditional service accounts, agents often operate autonomously, persistently, and with delegated authority, which can expand access beyond any single user's permissions. The article separates agents into personal, third-party, and organizational categories and highlights that organizational agents carry the greatest systemic risk. It recommends treating agents as distinct identities with defined owners, mapping user→agent interactions, and continuously reviewing agent access.

🔒 EC2 Auto Scaling introduces the condition key autoscaling:ForceDelete and group-level deletion protection to reduce accidental Auto Scaling group (ASG) deletions. Use the new autoscaling:ForceDelete condition in IAM policies to control whether the ForceDelete parameter can be used with DeleteAutoScalingGroup. Set deletion protection on ASGs at creation or update to add layered safeguards for critical workloads. Available in all AWS Regions and AWS GovCloud (US).

🔒 Hybrid work has driven a sharp rise in Active Directory password resets as cached credentials, inconsistent network connectivity, and stricter rotation policies cause more account lockouts. IT helpdesks supporting distributed employees are inundated with routine tickets that drain resources and reduce productivity. Forrester estimates a $70 cost per reset, and Specops data shows an average organization handles 923 resets annually. Implementing self‑service password reset solutions like Specops uReset can reduce wait times and restore access quickly.

🛡️Foundry’s Security Priorities Study finds 73% of security decision-makers are now more likely to consider a security solution that uses artificial intelligence, up from 59% a year earlier. CISOs plan to deploy AI for malware and threat detection, anomaly detection, real-time risk prediction, IAM, DLP, automation of responses, and improved visibility. Respondents cited faster detection of unknown threats, accelerated response times, and lower analyst workload. Experts caution against vendor hype, data-quality issues, hallucinations, and governance gaps, and recommend building AI-ready security data platforms.

🔒 New research from Pentera Labs shows that internal testing, demo, and training applications left in default or misconfigured states are being used as entry points into enterprise cloud environments. The team found popular vulnerable apps such as Hackazon, DVWA, and OWASP Juice Shop exposed on major cloud platforms and sometimes tied to overly permissive IAM roles. Attackers have leveraged these exposures to deploy crypto miners, webshells, and persistence mechanisms; Pentera recommends inventorying assets, enforcing least privilege, isolating labs from production, and expiring temporary test environments.

🔁 Amazon SageMaker Unified Studio now supports cross-Region subscriptions and IAM role-based subscriptions, enabling teams to subscribe to AWS Glue and Amazon Redshift tables and views published in different AWS Regions. Cross-Region support helps break down data silos and removes the need for manual replication. IAM role-based subscriptions let users request access without creating a SageMaker project, simplifying governance. These APIs are available via the SageMaker console, Amazon DataZone API, SDK, and AWS CLI.

🔐 Identity-focused attacks are now the dominant threat, and organizations must pair prevention with deep visibility. Identity Threat Detection & Response (ITDR) provides centralized logging, behavioral analytics, and alerts that reveal suspicious logins, anomalous account activity, and insider risk. tenfold combines Identity Governance and Event Auditing in one platform with lifecycle automation, access reviews, and centralized investigation tools. Book a personalized demo to evaluate capabilities and deployment speed.

🔒 Orphan accounts — abandoned human, service, and AI‑agent identities — create persistent, unseen access across applications, platforms, assets, and cloud consoles. These dormant accounts often evade traditional IAM and IGA tools due to integration gaps, unclear ownership, and proliferation of non‑human identities. Continuous identity audit using application telemetry and a unified audit trail can detect, flag, and automatically remediate or decommission orphaned accounts. Orchid positions its Identity Audit as connective evidence to inform IAM decisions.

🔒 Modern security must treat identity as the perimeter rather than the network. As remote work and cloud adoption dissolved traditional edges, attackers increasingly target credentials — a trend underscored by reports from Verizon, Microsoft and Okta — making identity the primary attack surface. Organizations must adopt Zero Trust identity controls such as MFA, SSO, RBAC, PAM, device trust and continuous, adaptive monitoring, and treat identity lifecycle and privilege management as core infrastructure.