Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Dan Conrad
Active Directory Recovery Can't Be an Afterthought
COMMENTARY Although it's decades old and used in legacy IT systems, Microsoft's Active Directory remains foundational to many large enterprises — and likely will be for the foreseeable future. Yet, despite Active Directory's role in determining who has access to which parts of on-premises enterprise networks, many businesses fail to adequately safeguard this vital piece of infrastructure from intruders. That leaves companies far too vulnerable to financial and reputational damage.
Microsoft Active Directory Archives
By Jeffrey Burt,Dan Conrad,Netsparker Security Team Using Security Assertion Markup Language (SAML), a user can use their managed account credentials to sign in to enterprise cloud applications via Single Sign-On (SSO). An Identity Provider (IdP) service provides administrators ...
Dan Conrad, Author at Hstoday
Dan Conrad is Federal CTO, Field Strategist, and Identity and Access Management Specialist at One Identity. He has been with One Identity/Quest Software since 2007 where his roles have included Systems Consultant and a Solutions Architect for Compliance Solutions. He retired from the USAF in 2004 and returned to government IT as a contractor where his primary focus was Active Directory design, migration, and sustainment.
The Master Chef (Redux) [2024]
Back in October of 2021 I covered a film called The Master Chef. Along with it I made the announcement that it was not yet available to watch–but over the course of the past three years some things have changed, including its availability. The The Master Chef (Redux) is now available for public viewing. You can find that link at the end of this review.
Password Managers: Here to stay?
Password managers have become popular solutions for businesses and individuals seeking to improve the password security of their accounts. The implementation of password management solutions within organisations has enabled security teams to securely store and manage company credentials for online and offline applications by using advanced encryption. Nevertheless, password management enterprises remain a hugely attractive target for malicious cyber actors, due to the high value of their assets.
Using Observability to Power a Smarter Cybersecurity Strategy
With an infrastructure for observability, security teams can make better decisions about access and identity-based threats. Source: Skorzewiak via Alamy Stock Photo When it comes to security, you can't protect what you can't see. That's why organizations that can visualize and understand their data are in a much better position to thwart cyberattacks and breaches. Observability is the best way for businesses to change how they detect and remediate cyberattacks — so much so that by 2026.
Blue Cross Blue Shield of North Dakota holds conference on social determinants of health in the state - InForum
The conference focused on a study done by Blue Cross Blue Shield of North Dakota and NDSU's Center for Social Research.
Guest Blog: 5 Key Takeaways from One Identity’s Identity Security Survey
Identity management is reaching a tipping point. In 2022, we commissioned a survey of over 1,000 top IT security professionals for our 2022 Identity and Security Survey.
Security considerations for passwordless authentication
With Apple, Microsoft and Google introducing passwordless authentication solutions, the end of the password is near for consumers. However, the enterprise world hasn’t followed suit despite credentials being responsible for nearly 50% of cyberattacks. Many initial passwordless offerings focused on the user experience, but now can enhance security as well. From biometrics to link-based access, there are many network access strategies security leaders can use to protect their network from threats.
Identity, access, zero trust in the age of metaverse
The growth of the metaverse brings new opportunities for innovative business practices and new ways to interact with one another in the workplace. While the metaverse brings the potential for improved workflows and virtual meeting rooms – it also brings an expanded attack surface and new ways for exploitation by bad actors.
The four As of identity-based security
In the famous words of David Byrne, there is no time for “dancing, or lovey dovey” when it comes to security. In a world where technology is constantly evolving, it is important to always stay on top of protecting confidential and sensitive information. The standard go-to for security within organisations is the account-based approach; however, this exposes the issue with specialised IT resources being so heavily involved in identity and account administration.
Protecting a high-value target: Steps needed to implement zero trust in pharma
Zero trust, Encryption The pharmaceutical sector is critical to the overall pandemic response and needed support for the health care sector. But existing vulnerabilities pose a serious risk to the supply chain.("State Public Health Laboratory in Exton Tests for COVID-19" by governortomwolf is licensed under CC BY 2.0) If you can prove the use of a security program, how frequently does training occur? Is there a tracking mechanism to see what employees were part of the program?
Identity-based zero-trust has become more than a buzzword
Zero trust Today’s columnist, Ron Rasin of Silverfort, says NIST agrees that security teams should adopt an identity-based zero-trust model for cloud applications. Credit: NIST Security pros need to refresh Active Directory Dan ConradJuly 30, 2021 Security pros need to focus on on revamping Active Directory because it's the primary way most organizations manage authentication and access.
Security pros need to refresh Active Directory
Security pros need to focus on on revamping Active Directory because it's the primary way most organizations manage authentication and access.
When zero trust principles fail: Microsoft’s Alex Weinert on what actually went wrong
Zero trust is about offering the right level of protection for a chosen technology at a chosen time, said Jim Routh, the former security chief for Aetna and Mass Mutual.
Experts Responses on Verizon DBiR Findings
There were 3.3 Billion malicious login attempts. Think about that. World population is 7.6B, 61% of breaches involved credential data. This is why we and other experts urge organizations to use passwordless authentication. You cannot attack, steal, reuse, share, write down or divulge, something you don’t have. No password means no phishing, no credential stuffing, and no human error from forgotten passwords, shared passwords, reused passwords or weak passwords. This report underscores .....
What a Passwordless Future Looks Like for Federal Agencies
The World Economic Forum reported a rise in cybercriminal activity during the COVID-19 pandemic as more people become dependent on digital infrastructure. Federal agencies are more vulnerable than ever as the systems providing citizens services and holding their data become the target for attack. Stolen credentials, especially passwords, are still one of the easiest ways for bad actors to access a government system.
Ein neues Zeitalter beim Systemmanagement? AD/AAD in hybriden Umgebungen
Unternehmen kaufen inzwischen im Rahmen ihrer BYOD-Richtlinien eine Vielzahl unterschiedlicher Geräte für den professionellen Einsatz. Für die Belegschaft hat das in der Regel Vorteile, während IT-Abteilungen die Entwicklung eher mit Sorge betrachten. Sie sind gezwungen, sehr viel mehr Geräte mit aktuellen mobilen Technologien im Auge zu behalten als jemals zuvor.
How to Implement implement zero trust without impacting productivity
INDUSTRY INSIGHT How to Implement implement zero trust without impacting productivity By Dan Conrad Oct 12, 2020 In the early days of cybersecurity, agency IT leaders were protecting an environment where federal employees worked in a physical location and accessed a network protected by firewalls. Today, these defenses are outdated and insufficient.
The Twitter hack exposed the need for more effective PAM security
The Twitter hack last summer highlighted the need for more effective privileged access management at organizations. Today’s columnist, Dan Conrad of One Identity, outlines how in today’s work-from-home period, identity has become the new perimeter and offers tips for companies to sharpen their PAM policies.
Supreme Court ruling on pension case sets limits on participant lawsuits
News Underfunded plans may still be vulnerable to participant lawsuits. (Photo: Shutterstock) A recent Supreme Court ruling on Thole vs. US Bank passed under the radar of most Americans, but it is significant. On the one hand it limits the right of pension plan participants to sue plans; on the other, it protects fiduciaries from frivolous lawsuits. And no matter which side of the courtroom you’re on, it will have an effect on future litigation.
Why you should be rushing to deploy multi-factor authentication to support remote work
With a third of the population currently working remotely and great uncertainty regarding when this situation is going to change, organizations must shift their business operations to support long-term remote working. According to a recent Gartner survey, the biggest barrier to effective remote work is poor technology and/or infrastructure for remote work.
Federal outlook: ICAM access and automation
INDUSTRY INSIGHT Federal outlook: ICAM access and automation By Dan Conrad Mar 06, 2020 News about agencies failing to meet federal cybersecurity standards should set off alarm bells, but instead, it has become a recurring headline. Recently, the Office of Personnel Management’s inspector general released an audit on that agency’s security program and practices based on the National Institute of Standards and Technology's Cybersecurity Framework.
Combat the insider threat with next-gen privileged access management
INDUSTRY INSIGHT Combat the insider threat with next-gen privileged access management By Dan Conrad Sep 23, 2019 Insider threats have the potential to cause great harm to national security. Fortunately, government continues to prioritize the insider threat, with the Center for Development of Security Excellence laying out new frameworks and even going as far as declaring September National Insider Threat Awareness Month.
Passwords and Badges Are No Longer Enough
Imagine a military ship’s network is hijacked, and the intruders want access to sensitive ship navigation technology, data or command-and-control systems. Because the ship’s network authentication is based on static elements such as passwords, logins or IDs, the hijackers can hack in and gain access undetected, thereby compromising the safety of troops and national security.
What’s next for multifactor authentication in the Defense Department
A recent Defense Department IG audit found that the Army, Navy and Missile Defense Agency aren’t taking basic cybersecurity steps to protect networks and systems from unauthorized use and access. Some facilities even failed to use common access card, and single-factor authentication was a common practice. Additionally, a recent audit of the Navy’s stance on cyber readiness found that the organization does not have the resources it needs to detect and protect threats to its data.
Leveraging Identity to Tackle Insider Threats in Government
In a recent poll of federal IT security professionals, the most frequently cited identity management nightmare was a disgruntled employee as the biggest threat when it comes to leaking information. The scarier bit is that 84 percent of respondents said this nightmare could easily become a reality: They felt they could easily steal data if they wanted to and the only thing holding them back was morals. These findings indicate a need for greater resources dedicated to mitigating insider threats.
Better identity and access management
Agencies are making strides in identity and access management. In fact, a May Office of Management and Budget report found that 93 percent of civilian users have enforced usage of personal identification verification cards. Yet this alone is not enough to keep an agency safe. Multifactor authentication is just one piece of the IAM puzzle, which should also take into account authentication, authorization, administration and auditing to ensure security without sacrificing usability.
The elements that make security an enabler rather than a hindrance
As agencies enhance IAM efforts, they must also consider the role of privileged accounts. Privileged accounts allow access to a broad range of sensitive information and are frequently the cause of notable security breaches. Rather than providing a standard password that can be shared from administrator to administrator, privileged user access should be temporarily granted and the actions they can take on the system should be limited and monitored.
With federal data security, it’s time to finish what we started
In recent years, federal cybersecurity initiatives seem to have generated measurable security improvements. Yet there is a disconnect between progress on cybersecurity mandates and actual security itself. Agencies have not fully implemented existing federal cyber mandates or initiatives, and the small percent left undone may become government’s next big breach.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Dan
Contact Dan, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack