Duo's Security Blog
MAY 6, 2024
The security industry has diligently battled compromised credentials, evolving from passwords to multifactor authentication (MFA) to passwordless — our most secure and phishing-resistant method to date — and one that is fully supported in Duo. This means there are serious holes in our authentication armor today.
Duo's Security Blog
OCTOBER 6, 2023
Threat actors have dramatically escalated their attacks – targeting security controls like multi-factor authentication (MFA), conducting wily social engineering attacks and extorting businesses large and small with ransomware. Since then, teams have had years to adjust to this new reality, yet the attackers have as well.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Duo's Security Blog
SEPTEMBER 4, 2023
In our recent passkey blog series , we’ve been unpacking the difference between new passkey technology and more conventional password security in light of some of the most critical authentication scenarios. They can also be used on other devices through QR code-based “hybrid” authentication.
Duo's Security Blog
MARCH 9, 2022
Together these practices — which include multi-factor authentication (MFA), restricting administrative privileges and daily backups — provide a clear framework for businesses anywhere that are looking to improve their foundational security footing , as we’ve previously noted on the Duo Blog.
Security Boulevard
APRIL 9, 2021
Remote work technologies are playing an important role to enable a healthcare telework community, and threat actors continue to target VPN vulnerabilities – a high-risk point. Endpoints can be user devices – user laptops, workstations and devices often used to access networks remotely via VPN. Webinar: Ransomware: Cyber Defense Demo.
NopSec
FEBRUARY 28, 2024
The attack chain is pretty interesting, but does require authenticated access. As it turned out all of the needed information was accessible to any authenticated user via a request to the “/ghost/api/admin/users/?include=roles” Ivanti SSL VPN CVE-2024-21888 and CVE-2024-21893 Ivanti has had a rough couple of months.
NopSec
MAY 1, 2024
Palo Alto PanOS RCE CVE-2024-3400 It feels like the first quarter of 2024 has been defined by a string of SSL VPN command execution vulnerabilities and Palo Alto has jumped on the wagon. The analysis revealed that the SSL VPN end-point was shipped without disk encryption enabled, which made filesystem access trivial.
Expert insights. Personalized for you.
93 
Let's personalize your content