02.18.2019 - Mergers, Acquisitions and Divestitures – How to Unite Your Active Directories

CIOs that are under pressure to bring two companies’ IT systems and applications together after a merger or acquisition can unify their directory services quickly and inexpensively with a Virtual Identity Server. This paper looks at three of the leading approaches to bridging disparate sets of directory services into one seamless directory following a merger or acquisition. Conversely, we’ll look at the aspect of a divestiture, in which one company must entirely split out from another. Here, too, directory services play a role in a clean and quick divestiture or spin-off. ...

02.6.2019 - European Identity & Cloud Conference Ticket Giveaway

Optimal IdM is giving away tickets to the conference! Win one of three free tickets to the entire conference and workshop sessions. Participation is free of charge and the closing date for entries is April 19, 2019. Winners will be notified by e-mail and/or by phone. Ticket value is €2500.00 Location: Munich, Germany Date: May 14-17, 2019 Fill out the form with your name, company, e-mail and phone for your chance to win. Or get additional information on the event before submitting. ...

01.17.2019 - Typing Biometrics and Other Multi-Factor Authentication Methods: When Passwords Are Not Enough

81% of data breaches are from weak, default or stolen passwords. Leveraging MFA when it’s offered lessens the attack vector for digital identity impersonation attempts. This paper looks at existing MFA options, including biometric typing technology, examines decision factors for MFA and discusses the difference between various authentication methodologies.   ...

11.30.2018 - HTTP Header Session Protection

The HTTP protocol was designed as a transport protocol to fetch and return content and to display HTML or other functions. But, HTTP wasn’t designed with authentication security top of mind. Approximately 40% of data breaches originate from attacks on web apps. And many of these breaches are preventable. HTTP header session protection as a part of your SSO solution should be at the forefront of your mind. Access to web/SaaS applications obviously initially requires successful authentication. After your username and password are accepted, authentication between the user and web service (client/server) session is usually maintained by cookies. The cookie allows the server, after successful authentication, to identify and trust the client during the session to allow seamless access to the web service. Many web services are front ends to databases, consumer data and/or corporate user specific data. An attacker, therefore, would just need to steal the cookie to hijack the current authenticated session. HTTP headers provide another layer of security for employees and consumers to guard against a number of attack vectors — including man-in-the-middle attacks (MIM), many cross-site scripting (XSS) attacks, session hijacking, and more. Cross-site scripting (XSS) has been a popular attack vector. In fact, it’s reported that XSS is the most common exploited vulnerability in web applications. XSS are high risk vulnerabilities where a type of code injection is used to hijack a legitimate users’ session. This isn’t a password breach, but a breach in the web session where the user has already successfully authenticated and is interacting with a web service. The HTTP session is hijacked and the attacker is now impersonating a legitimate authenticated user. Users are vulnerable everywhere to these threats but are especially susceptible within public unsecured WiFi networks where attackers can easily extract session cookies. Certainly, you would always also prefer an HTTPS session over an HTTP session, but that won’t necessarily help mitigate some XSS security issues. You need multiple layers of protection. HTTP header session protection is an essential component of a secure web services session; however, HTTP header session protection won’t protect against weak and reused passwords, brute force attacks, phishing attacks and other attacks against the passwords themselves. To mitigate password threats, implement strong authentication using multifactor authentication (MFA). Optimal IdM has a rock solid, agile MFA solution that was named Best MFA Solution of the Year in the GSN Homeland Security Awards. Microsoft reports that only 4% of SaaS storage apps and 3% of SaaS collaboration apps support all HTTP headers session protection. It’s irresponsible for organizations to ignore such large, yet solvable, attack vectors.  Today’s sophisticated threat landscape for web and SaaS SSO applications require a vendor who can support modern, strong authentication by leveraging multiple HTTP session protections. Optimal IdM is that vendor. Further, Optimal IdM’s SSO solutions session support protections and encrypt data in transit and at rest. Additional Recommendations ...

07.23.2018 - Manufacturers Need Industrial-Quality Access Control

Ideas about cybersecurity in the manufacturing sector have started to change, and it’s about time. Until recently, a common misperception among those in the industrial world was that that they had little to attract hackers—no credit card data, no health records, no bitcoin. But manufacturers do have data, and it’s immensely valuable — their trade secrets. Profit isn’t the only motivation for hackers many just want to cause chaos. There are plenty of reasons for hackers to attack manufacturing systems; the proof is that one out of three industrial control systems (ICS) computers were hacked last year (Kaspersky Lab, Sept 2017). That number seems daunting. Many industrial automation systems have only limited internet connectivity, if at all. But they are connected to their corporate networks, and that’s where the weakness lies. Only half of manufacturing businesses isolate their ICS networks from their corporate networks (www.ncms.org/CyberSecurityReport). The rest are the mercy of the same phishing, ransomware, and insider attacks as any financial or healthcare organization. One vulnerability that affects manufacturers in particular is poor security practices among their vendors. It just takes one weak partner to infect an entire supply chain. Hackers are efficient criminals; they conduct research using Lexis Nexis, LinkedIn, and even dumpster dive to learn what they need to know to launch the most effective attack possible against their target of choice. If they want to attack your business, they may learn who your vendors are, choose those they suspect to be the weakest¾which may be a mom-and-pop shop, or may be a larger business that has a reputation on the dark web as an easy takedown¾and breach the weak vendor in order to hop onto your network. Security professionals like to say, “Security is people.” The average worker at a bank or hospital is highly aware that their employer is a high-value target, so they are more cautious than those in other industries about clicking on links or opening attachments. The average worker in an industrial business may not be as guarded. Security awareness training is a step in the right direction, but not all workers will take it seriously. Even if every worker did keep security at top-of-mind, humans still make mistakes. It just takes one accidental click to open the door to malware. And once inside, it may make its way to whatever target its authors desire. That could be your trade secrets, or it could be the main controllers in your automation system. ...


  • The database in which all of your organization’s sensitive identity data is stored.
  • A digital ledger in which digital transactions are recorded chronologically and publicly.
  • Securely managing customer identity and profile data, and controlling customer access to applications and services.
  • The means of linking a person's electronic identity and attributes, stored across multiple distinct identity management systems.
  • A legal framework that sets guidelines for the collection and processing of personal information of individuals within the EU.
  • The policy-based centralized orchestration of user identity management and access control.
  • An authentication infrastructure that is built, hosted and managed by a third-party service provider.
  • A security system that requires more than one method of authentication from independent categories of credentials to verify the user's identity for a login or other transaction.
  • A global provider of innovative and affordable identity access management solutions. 
  • Managing and auditing account and data access by privileged users.
  • Tools and technologies for controlling user access to critical information within an organization.
  • An authentication process that allows a user to access multiple applications with one set of login credentials.