Duo's Security Blog

MARCH 19, 2021

An application binds Duo's two-factor authentication system to one or more of your services or platforms, such as a local network, VPN (virtual private network), CMS (content management system), email system, or hardware device. Step 4: Setting Up an Application See the video at the blog post.

Authentication 52

Authentication Backups Mobile Accountability 52

Malwarebytes

SEPTEMBER 21, 2021

Show them these tips: Never use the same password twice. And if your child uses the same password across multiple accounts, when one gets breached they are all vulnerable. And if your child uses the same password across multiple accounts, when one gets breached they are all vulnerable. This is where a password manager comes in.

Internet 103

Internet Internet Passwords Password Management 103

Duo's Security Blog

NOVEMBER 17, 2021

According to ZDNet , Remote Desktop Protocol (RDP) is the number one exploit that threat actors leverage to gain access to Windows computers and install ransomware and other malware, followed by email phishing and VPN bug exploits. The modern workforce is more mobile than ever before.

Ransomware 52

Ransomware Education VPN Authentication 52

Thales Cloud Protection & Licensing

NOVEMBER 22, 2017

In addition, the increasing speed of technology innovation has lead to a broader diversity of payment methods in recent years with new platforms for mobile payments continuing to be deployed. Typically, something you know (such as a password) and something you have (such as code that’s been texted to you.) Happy (and safe!)

Risk 90

Risk Retail Digital transformation Authentication 90

Thales Cloud Protection & Licensing

OCTOBER 24, 2019

Help telecommuting employees : Given the rise of mobile and the cloud, organizations would do themselves a great disservice if they exclude telecommuting employees from their security training programs. That includes setting up a VPN through which remote employees can access work assets. Implement Multi-Factor Authentication.

Security Awareness 83

Security Awareness InfoSec Passwords Accountability 83

Centraleyes

FEBRUARY 25, 2024

This blog aims to dissect the nuances of cloud security risks , shedding light on the challenges commonly faced when securing digital assets in the cloud. Employee education programs should include guidelines on securing home networks, updating router passwords, and ensuring the security of connected devices.

Risk 52

Risk Encryption Social Engineering Authentication 52

Thales Cloud Protection & Licensing

NOVEMBER 6, 2019

In a previous blog post ( [link] ) we explored the relationship between GPDR and applications in the cloud. In other words, users were accessing company data either physically on site, or through a dedicated network or VPN. For instance, is the app being accessed from a mobile device, a personal tablet or a company issued computer?

Identity Theft 109

Identity Theft Authentication Passwords Accountability 109

CyberSecurity Insiders

NOVEMBER 4, 2021

This blog was written by an independent guest blogger. In perimeter-based models, the system will trust user credentials if they are, say, logged in to the corporate VPN or if they are using a pre-registered device. The zero trust approach still authenticates users based on passwords, among other traditional security procedures.

Retail 111

Retail eCommerce Cyber Attacks Authentication 111

Troy Hunt

NOVEMBER 14, 2018

Last week I wrote a couple of different pieces on passwords, firstly about why we're going to be stuck with them for a long time yet and then secondly, about how we all bear some responsibility for making good password choices. This week, I wanted to focus on going beyond passwords and talk about 2FA.

Passwords 261

Passwords Authentication Accountability Mobile 261

Duo's Security Blog

JANUARY 11, 2024

Secure Cisco VPN logins in less than an hour Authenticate users in seconds Verify user + device posture Blog unmanaged devices Mitigate modern security threats with phishing-resistant authentication Join the thousands of Cisco firewall customers who take advantage of protecting Cisco VPN logins with Cisco Duo Single Sign-On via SAML 2.0

VPN 88

VPN Authentication Firewall Risk 88

Security Affairs

SEPTEMBER 1, 2019

Hi folk, let me inform you that I suspended the newsletter service, anyway I’ll continue to provide you a list of published posts every week through the blog. Bad Packets warns of over 14,500 Pulse secure VPN endpoints vulnerable to CVE-2019-11510. Foxit Software discloses a data breach that exposed user passwords.

eCommerce 49

eCommerce Data breaches Malware Advertising 49

Krebs on Security

FEBRUARY 18, 2019

government — along with a number of leading security companies — recently warned about a series of highly complex and widespread attacks that allowed suspected Iranian hackers to siphon huge volumes of email passwords and other sensitive data from multiple governments and private companies. That changed on Jan.

DNS 267

DNS Internet Internet Government 267

SiteLock

AUGUST 27, 2021

You or your IT security department should also keep up to date on the latest security threats from external sources like: * Security blogs, such as Schneier on Security and Krebs on Security. Additionally, with the rise of mobile computing also comes an increase in related threats. Incident response reports. Learn from the past.

Cyber threats 98

Cyber threats Mobile B2B Threat Detection 98

Kali Linux

NOVEMBER 27, 2022

In Secure Kali Pi (2022) , the first blog post in the Raspberry Pi series, we set up a Raspberry Pi 4 with full disk encryption. A shortcut to generating one is to simply run wpa_passphrase SSID PASSWORD where SSID is the name of the wireless network, and PASSWORD is the passphrase (aka PSK) for the network.

Firmware 52

Firmware Wireless Passwords VPN 52

Duo's Security Blog

APRIL 20, 2023

In many rnodern phishing attacks, malicious links send employees to copies of otherwise farniliar websites—like an internal payroll portal login page where it’s quick to muscle-rnemory a username and password. Strong security practices layer to protect against phishing attacks. Additional IT service headcount ended up being unnecessary.

Phishing 77

Phishing Social Engineering Authentication Engineering 77

Krebs on Security

MARCH 23, 2022

In a blog post published Mar. ” The LAPSUS$ Telegram channel has grown to more than 45,000 subscribers, and Microsoft points to an ad LAPSUS$ posted there offering to recruit insiders at major mobile phone providers, large software and gaming companies, hosting firms and call centers. ” LAPSUS$ leader Oklaqq a.k.a.

Social Engineering 288

Social Engineering Accountability Mobile Passwords 288

Duo's Security Blog

SEPTEMBER 4, 2023

These days, users connect to company resources through a variety of endpoints: desktops, laptops, mobile phones, tablets, wearables…the list goes on. And when it comes to managing access for this plethora of devices, password security just isn’t cutting it anymore. Biometrics Passwords provide no verification of user identity.

Passwords 63

Passwords Authentication Accountability Password Management 63

Fox IT

FEBRUARY 22, 2023

The “ZK” Framework is an opensource Java framework for building enterprise web and mobile applications. This blog will describe the malicious driver that was deployed by leveraging the vulnerability and how to check if your systems are affected. If enough new data comes in a follow-up blog will be considered.

Backups 69

Backups Software Authentication Internet 69

Security Affairs

SEPTEMBER 29, 2019

Hi folk, let me inform you that I suspended the newsletter service, anyway I’ll continue to provide you a list of published posts every week through the blog. Privilege Escalation flaw found in Forcepoint VPN Client for Windows. Thinkful forces a password reset for all users after a data breach. Once again thank you!

Data breaches 52

Data breaches Advertising Malware VPN 52

Krebs on Security

APRIL 6, 2022

Microsoft blogged about its attack at the hands of LAPSUS$, and about the group targeting its customers. “They were calling up consumer service and tech support personnel, instructing them to reset their passwords. Most targeted employees are working from home or can be reached on a mobile device. “vishing”).

Social Engineering 243

Social Engineering Phishing Engineering Accountability 243

Troy Hunt

APRIL 17, 2018

In the case above, HostGator was being taken to task for storing passwords in a retrievable fashion (i.e. When this blog post is later shared in the wake of subsequent thread-hijacking behaviour from other accounts, I want it to be clear that this is the sort of company spammers will be keeping.

Media 212

Media Advertising Accountability Marketing 212

Thales Cloud Protection & Licensing

MAY 13, 2024

Employees, suppliers or consumers are completely overwhelmed by the proliferation of passwords to access the online services. Moving from passwords to more modern authentication methods is becoming essential for organizations to protect themselves against cyber threats, improve the user experience and reduce password costs.

Authentication 62

Authentication Phishing Marketing Cloud Migration 62

Krebs on Security

OCTOBER 21, 2019

Antivirus and security giant Avast and virtual private networking (VPN) software provider NordVPN each today disclosed months-long network intrusions that — while otherwise unrelated — shared a common cause: Forgotten or unknown user accounts that granted remote access to internal systems with little more than a password.

Accountability 131

Accountability VPN Software Antivirus 131

Krebs on Security

JULY 8, 2019

That domain registration record included the Russian phone number +7-951-7805896 , which mail.ru’s password recovery function says is indeed the phone number used to register the hottabych_k2 email account. ” Dedserver also heavily promoted a virtual private networking (VPN) service called vpn-service[.]us

Ransomware 254

Ransomware Accountability Cybercrime Passwords 254

NopSec

JULY 18, 2017

With that in mind, in this blog post we’re covering 13 out of the 20 controls. CSC12 – Boundary Defense How Unified VRM Helps: Port scanning, fingerprinting as well as VPN connections vulnerability identification are all steps performed in a vulnerability scans, both embedded and as a import.

Wireless 40

Wireless Penetration Testing Software Authentication 40

Duo's Security Blog

AUGUST 1, 2022

There are three accepted multi-authentication methods including a) something you know (like a password), b) something you have (like a mobile phone) and c) something you are (like a biometric). Passwords for accounts used by applications and systems must be changed at least every 12 months and upon suspicion of compromise.

Authentication 97

Authentication Passwords Accountability VPN 97

Security Boulevard

APRIL 16, 2021

This blog post was originally created by Jeremy Rasmussan, Chief Technology Officer at Abacode. Read the original blog here. . RDP client software is available for most flavors of Windows (including Windows Mobile), Linux, Unix, macOS, iOS, Android, and other operating systems. MFA/Password Security. Once is a fluke.

Firewall 71

Firewall Passwords Authentication Accountability 71

Duo's Security Blog

MAY 5, 2022

Do you remember all the passwords to your various accounts and profiles? How many times have you forgotten your login details, attempted to reset your password, and faced the painful reminder, ‘your new password cannot be the same as previous’?

Passwords 95

Passwords Password Management Authentication Risk 95

Hackology

DECEMBER 26, 2023

After allowing password sharing for years, Netflix has recently changed its policy. The password sharing is now only allowed for a single physical household. Since its initial years, Netflix encouraged password sharing with your friends and family, which allowed them to generate a strong user base. What is Tailscale VPN?

VPN 64

VPN Accountability Internet Internet 64

BH Consulting

JUNE 20, 2023

One may know what the term VPN means, but what about when a VPN should be used and more importantly – not used, and what are the risks of using a VPN versus the benefits. For the purpose of this blog – we are going to use the term information security to mean both cyber and information security.

Cybersecurity 52

Cybersecurity Information Security VPN Authentication 52

Duo's Security Blog

NOVEMBER 30, 2022

Supporting OIDC allows us to protect more of the applications that our customers are adopting as we all move towards a mobile-first world and integrate stronger and modern authentication methods (e.g. We use Duo SSO for securing access to Microsoft 365, Cisco AnyConnect VPN, and IFS Aurena, our ERP system. biometrics). What is OIDC?

B2C 99

B2C B2B Authentication Mobile 99

Duo's Security Blog

AUGUST 3, 2023

By reducing login credentials and offering self-service, SSO helps save time and cost for onboarding to applications, password resets, device management and more. based and mobile-first OpenID Connect (OIDC) applications. Duo Security’s passwordless authentication enhances PAM by removing the reliance on traditional passwords.

Authentication 97

Authentication Risk Passwords Insurance 97

Duo's Security Blog

DECEMBER 7, 2021

See the video at the blog post. The second is an authentication problem — what technology do I use to verify identities without relying on a password? Passwordless is simply another incentive to move that RADIUS-based VPN to SAML. Learn More About Duo’s Passwordless Solution See the video at the blog post.

Authentication 97

Authentication Technology VPN Mobile 97

Troy Hunt

JANUARY 10, 2018

Blocking legitimate users is part of that problem, blocking users wanting to protect their traffic with a VPN is another: This has been there for the past year now. They also blacklist vpn IP addresses. Much of what I'm going to cover in the remainder of this blog post will focus on the site at uidai.gov.in

Hacking 279

Hacking Government Risk Encryption 279

Duo's Security Blog

JANUARY 27, 2022

For mobile authenticators, confirm if there is any per-device cost for soft tokens, or if an unlimited number of enrolled devices is permitted for each user license. Gartner estimates that password reset inquiries comprise anywhere between 30% to 50% of all helpdesk calls. Estimate that cost and factor it into your budget.

Authentication 87

Authentication Software Mobile Passwords 87

Cisco Security

AUGUST 28, 2023

XDR (eXtended Detection and Response) Integrations At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider. Cleartext passwords and usernames disclosed in traffic. Base64 credentials used by Urban VPN to get configuration files.

Wireless 68

Wireless DNS Mobile Technology 68

The Last Watchdog

JUNE 22, 2020

No one enforced the use of passwords, nor insisted on strict teacher control of those lessons. To Zoom’s credit, password protection and a “waiting room” feature, which allows the host to control when a participant joins the meeting, are the default settings for its free and single license paid accounts.

Mobile 276

Mobile Passwords Technology VPN 276