2024
Security Posture
Passkeys for the Enterprise: Are You Ready to Go Passwordless?
Are passkeys ready for the enterprise? How FIDO2 works, synced vs. device-bound passkeys, attestation for admins, recovery, shared devices and a phased rollout.
PCI DSS
MFA for All Access Into the CDE: Requirement 8.4.2 Explained
PCI DSS requirement 8.4.2 extends MFA to all access into the CDE from March 31, 2025. How it fits with 8.4.1, 8.4.3 and 8.5.1, and ways to implement it.
Security Posture
Hardening Your Identity Provider Against Account Takeover
How to harden your identity provider against account takeover: strong admin MFA, conditional access, token lifetimes, fewer admin roles, logging, safe resets.
2023
Security Posture
Least Privilege and Just-in-Time Access in Practice
How to put least privilege and just-in-time access into practice: role design, access reviews, removing standing admin rights, cloud IAM and service accounts.
PCI DSS
The New PCI Password Rules: 12 Characters and Beyond
PCI DSS 4.0 password requirements raise the minimum to 12 characters by 2025. Here's what 8.3.6, 8.3.9, 8.3.7, 8.3.10.1 and 8.6 require and when.
2022