According to analysts, IT-security spending is expected to grow at least twice faster than IT-spending this year (2019). This is both an acknowledgement that the environment is increasingly risky and a realization that investments in IT-security have been too weak until recently. If you’re an IT-security professional, this is certainly a good news since your organization acknowledges in its budget the importance of your work. But don’t dream too high, you will still need to prioritize security projects for the years to come. Read More
Recently, a series of articles and reports has cast doubts on the efficiency of 2FA (2-factor authentication). Their conclusions differ, ranging from “You’re stuck” (sensation news reporting that “Researchers have broken 2FA”), to “Switch to cryptography-based MFA now!” (FIDO Alliance-commissioned report by Javelin Group), to the more nuanced “2FA is probably better than nothing but we wish we knew more” (Josephine Wolff’s Opinion in the NYT). Their starting point, however, is the same: something is broken with 2FA… Read More
Open Banking is coming up. Starting September 2019, Account Servicing Payment Service Providers in the SEPA zone (aka “ASPSPs” or … banks) must provide Payment Initiation Service Providers (aka “PISPs” or … Fintechs) with an API to access accounts data and initiate payments. As a consequence, Strong Customer Authentication (“SCA”) must be enforced on this API. Read More
If there is anything to be learned from 2017’s array of massive data breaches, it’s that single-password authentication is no longer enough to warrant security. Deloitte, one of the world’s top accounting firms, learned this the hard way. Last year, the company was hit with a massive hack that compromised private emails as well as confidential information of some its blue-chip clients. Sources told The Guardian that the breach occurred through an administrator’s account, which gave hackers unrestricted access to everything else. The account in question required a single password, with no two-step verification. Read More
The selection of the “right” MFA solution can be tricky. First, because there’s a constant flow of innovation in the authentication industry, resulting in numerous and diverse technologies even for solutions supposedly following a standard. Second, because the applications and environments needing MFA are also very different (cloud vs. onprem, legacy vs. web, ldap vs. radius, SAML, or OIDC, etc.). Lastly because not all solutions have the same objectives or protect against the same risks. Read More
As we should all know by now, 1/ everything is getting connected, the Internet is no longer about computers and servers only but also about billions of objects that once belonged to distinct categories, such as consumer electronics, automotive, medical devices, industrial and infrastructure systems etc. And 2/, security issues are going to be even larger and scarier in the era of the Internet of Things.
This raises a few questions for the cybersecurity industry, such as: Are we ready to address this challenge? Have we developed the right tools yet? The short answer is no. Read More
One of the main new features presented during Apple keynote this September is a face recognition mechanism that will be part of the iPhone X. FaceID, how that mechanism is called, will initially be used as a way to unlock the phone screen, which is also how TouchID was introduced on the iPhone 5s in 2013. Read More
Passwords are prehistory. Passwords are dead. We’re going to end passwords. Sounds familiar? Google probably has millions of results for each of these searches. Yet, for as long as I can remember – since the rise of the World Wide Web at least – passwords have been fingerpointed as the flaw in this otherwise amazingly well engineered system. Read More
It was supposed to be a nice weekend, but for many people working in IT and security organizations, last weekend turned out to be a nightmare. A self-replicating ransomware going by the name of WannaCry hit several hundreds of thousands of computers worldwide, many of them in large organizations – the NHS, Renault, and Telefonica have been mentioned in the news. Every time such an attack makes it to the headlines, the priority for IT and security people is to manage the crisis: contain the spread, eradicate the worm, and resume normal business operations. This can take hours or days (and nights), sometimes longer, but hopefully everything is back to normal before the next one hits.
Multi-factor authentication (MFA) has become so commoditized in the recent years that it’s easy to forget that it’s a service running on servers. And as such, that it can suffer interruptions and hacks. Recognizing this has consequences on how to pick and to use an MFA service.