All news with #identity security tag

🔐Agentic AI introduces a new class of identity that behaves with humanlike intent yet scales and persists like machines. Traditional IAM and PAM were designed for employees and predictable workloads; AI agents are decentralized, easy to create, cross‑platform, and often granted broad privileges, creating serious blind spots. CISOs should apply lifecycle management: assign clear ownership tied to the identity provider, define explicit measurable purpose and scope, enforce least privilege, maintain continuous visibility to detect privilege drift, and automate revocation when agents go idle.

🔒 As AI hype settles, CISOs are refocusing 2026 priorities on resilience, rapid detection, and measurable outcomes. They favor engineering-driven architecture for cloud stability, AI-enabled orchestration to cut dwell time, and broad identity and privilege governance for human and non-human accounts. Visibility and SaaS discovery will curb shadow AI use, while security baked into agentic AI and post-quantum preparedness (cryptographic inventories and vendor roadmaps) become essential. Turning security into a visible trust signal and linking spend to ROI rounds out the agenda.

🔐 Federated Identity Management (FIM) enables a single authentication to span multiple applications or organizations, letting users sign in once and reuse identity assertions across services. It improves user experience and resilience while introducing architectural complexity, potential vendor lock-in, and additional service costs. Implementations commonly rely on cloud identity providers such as Google, Microsoft, or Okta and use protocols like SAML, OAuth 2.0, and OpenID Connect.

🔒 Many enterprise CISOs continue to struggle to abandon passwords despite decades of effort and mounting security risks. RSA’s ID IQ Report 2026, based on a survey of 2,000 security professionals, finds that 90% of respondents report problems with passwordless deployments. Technical complexity across hybrid environments, legacy systems, OT/IoT devices, and inconsistent platform support creates gaps that often force organizations to retain insecure fallbacks. Experts recommend sequencing rollouts to secure privileged users first, using reverse proxies or VPN-enforced SSO for legacy apps, and ensuring end-to-end phishing-resistant enrollment and recovery.

🔒 Many enterprises are racing to deploy autonomous agentic AI without establishing robust identity and authentication controls, creating an identity crisis for CISOs. Experts warn that fewer than 5–10% of organizations assign formal agent identities (for example via PKI) before wider release, leaving deployments vulnerable to hijacking and prompt-injection. Because agents routinely communicate with one another, a compromised agent can cascade malicious instructions across legitimate agents before revocation, and current vendor solutions and kill switches are incomplete or absent.

🔒 AWS Wickr now provides a suite of admin APIs that let administrators programmatically manage secure communication networks at scale. The APIs automate critical workflows — including user lifecycle management, network creation and deletion, retention and federation policy pushes, and security group placement based on directory attributes — and integrate with identity systems, policy frameworks, and automation pipelines. They are available today in all supported AWS regions, including AWS GovCloud (US-West), via AWS SDKs, the AWS CLI, or direct REST calls.

🔐 The EU's NIS2 Directive requires organizations in critical sectors to strengthen identity and access controls, with Article 21 explicitly calling for access policies and practical protections. Modern password hygiene favours long passphrases (e.g., 15+ characters), breach screening, and avoiding routine rotations unless compromise is suspected, alongside user-friendly measures like password managers. While NIS2 doesn't always explicitly mandate MFA, national guidance and ENISA expect phishing‑resistant MFA for privileged and critical accounts.

🔐 The article introduces Access Fabric as a unified, adaptive approach that links identity, device, and network signals to make real-time, risk-based access decisions throughout every session. It warns that fragmented identity and network tools create visibility gaps that AI-empowered attackers can exploit. By being contextual, connected, and continuous, an Access Fabric closes seams, reduces complexity, and enforces consistent policies for users, devices, and AI agents.

🔒 Sponsored content from Token presents wireless biometric passwordless authentication as a way to transform MFA from a persistent cost center into a measurable productivity gain. By replacing passwords and authenticator apps with proximity-bound biometric hardware such as Token Ring and Token BioStick, Token says average login time falls from 22 seconds to 2 seconds. The vendor asserts this yields roughly $1,466.67 per employee per year in recovered productivity while also reducing password resets and blocking phishing, session relay, and social-engineering attacks.

🔔 AWS has expanded IAM Identity Center to 37 AWS Regions with official availability in Asia Pacific (Taipei). The service is the recommended way to manage workforce access, offering single sign-on, centralized multi-account access, and integration with existing identity sources. It powers personalized experiences in AWS applications such as Amazon Q and supports user-aware data access controls for services like Amazon Redshift. IAM Identity Center is available at no additional cost in supported regions.

🔒Amazon Cognito identity pools now support AWS PrivateLink, enabling private connectivity between your VPC and Cognito to exchange federated identities for temporary AWS credentials. This removes the need to route authentication traffic over the public internet and reduces exposure of auth flows. PrivateLink endpoints are available in all Regions where Cognito identity pools operate except AWS China (Beijing) and AWS GovCloud (US); standard PrivateLink charges apply.

🔐 This guide shows how to operationalize the Shared Signals Framework (SSF) to deliver continuous device posture signals into identity platforms. It details a proof‑of‑concept workflow using Tines to receive webhooks from Kolide, enrich and map device data, generate and sign Security Event Tokens (SETs), and forward them to Okta as CAEP events. The approach enables real‑time policy enforcement and simplifies SSF adoption when endpoints lack native support. Steps and required credentials are summarized for quick deployment.

🔒 In this Deputy CISO blog, Damon Becknel, Microsoft’s VP and Deputy CISO for Regulated Industries, outlines four immediate priorities organizations should act on now. He emphasizes reinforcing essential cyber hygiene—accurate asset inventories, network segmentation, timely patching, MFA, EDR, and proxying email and web traffic—as the most effective means to reduce common intrusions. Becknel also urges adoption of modern standards like phishing-resistant MFA, secure DNS and DMARC, deployment of fingerprinting to track bad actors, and active cross-industry collaboration to share threat signals and raise the cost of attack.

🔐 ServiceNow is reportedly in advanced talks to acquire identity-security startup Veza for more than $1 billion, a deal that could be announced next week. The move would pair ServiceNow's recent AI automation capabilities from Moveworks with Veza's Authorization Graph to map and govern permissions for human and machine identities. For customers, the acquisition aims to close trust and governance gaps around AI agents and non-human accounts, though integration, licensing, and standalone availability questions remain.

🔐 Multicloud adoption improves flexibility but introduces security and visibility risks unless managed centrally. Establish a central authority to define strategy, enforce policies and select cross-cloud tools, while implementing unified governance backed by identity management and automation. Treat every environment as a single trust boundary, enforce least privilege, and correlate telemetry for a unified detection-and-response posture. Limit access with short-lived sessions, recording and DLP to reduce attack surface and support auditability.

🔐 Amazon Redshift now supports federated permissions to centralize and enforce data access policies across multiple Redshift warehouses, reducing governance overhead for multi-warehouse deployments. Registered warehouses are auto-mounted account-wide and can be queried using existing workforce identities via AWS IAM Identity Center or IAM roles. Row-level, column-level, and masking controls are applied automatically, ensuring consistent fine-grained access control regardless of query location.

🔒 Samsung Galaxy devices with Knox Suite combine hardware-rooted protections and centralized management to help IT secure corporate data without slowing users. Built-in at manufacture, Knox delivers multi-layered defenses—secure boot, trusted execution environments, and integrated malware protections—while fitting into existing EMM workflows. Native Zero Trust support, ZTNA and near-real-time telemetry from Knox Asset Intelligence feed SIEMs so mobile threats are visible alongside other alerts.

🔐 The new aws login CLI command lets developers obtain temporary programmatic credentials using the same sign-in method as the AWS Management Console, eliminating the need to create and manage long-term access keys. The command opens a browser-based OAuth2 flow and supports root/IAM user sign-in as well as federated identity providers. Issued credentials auto-rotate every 15 minutes and remain valid up to the IAM session duration (maximum 12 hours). Aws login integrates with profiles, remote development workflows, AWS SDKs, AWS Tools for PowerShell, and legacy SDKs via credential_process.

🔐 AWS Identity and Access Management (IAM) now supports outbound identity federation, enabling customers to exchange AWS credentials for short‑lived, cryptographically signed JSON Web Tokens (JWTs) to authenticate workloads with third‑party clouds, SaaS providers, and self‑hosted applications. Tokens include workload context so external services can enforce fine‑grained access control. Administrators can restrict who can generate tokens and configure token properties such as lifetime, audience, and signing algorithm via IAM policies, and audit issuance and usage through CloudTrail. The capability is available in all AWS commercial Regions, AWS GovCloud (US) Regions, and China Regions.

🔐 This post explains how to centrally manage AWS Systems Manager Session Manager preferences across multiple accounts and Regions using CloudFormation StackSets and an AWS Lambda function. The solution automates updates to the SSM-SessionManagerRunShell document, provisions optional logging destinations (Amazon S3 or CloudWatch Logs), and can create KMS keys for session and log encryption. It aims to reduce manual configuration errors and ensure consistent security and compliance at scale.