This is the third and final blog post in our Adapt to the Cloud Operating Model series.  With any organizational change that impacts people, process, and technology, it’s best to take it in stride. When talking with customers about their Zero Trust security initiatives, an analogy I often use is: “if Google’s BeyondCorp is the peak of Mt. Everest,…

SMS authentication—also known as SMS-based two-factor authentication (2FA) and SMS one-time password (OTP)—allows users to verify their identities with a code that is sent to them via text message. A form of two-factor authentication, it often acts as a second verifier for users to gain access to a network, system, or application, and is a good…

It’s no secret that customer behavior is constantly evolving. But the changes we’ve seen in the last seven months and the acceleration of customers adopting digital-first experiences for nearly every aspect of their life is unprecedented. And this trend is only going to continue, creating a need for customers to navigate digital touchpoints in a…

Viruses, spyware, and other malware can affect more than just desktop computers and laptops. Mobile devices are vulnerable as well. As the threat landscape continues to evolve, it’s important that we not only understand these risks—but how we can protect ourselves against them.  In this post, we’ll take a closer look at the mobile phone security…

Zero Trust is a security framework based on the belief that every user, device, and IP address accessing a resource is a threat until proven otherwise. Under the concept of “never trust, always verify,” it requires that security teams implement strict access controls and verify anything that tries to connect to an enterprise’s network. Coined in…

Identity governance and administration (IGA) is a policy-based approach to identity management and access control. As the name implies, IGA systems merge identity governance and identity administration to provide additional functionality beyond traditional identity and access management (IAM) tools. Particularly, they offer valuable support in…

In our previous posts for this 5-part series on lifecycle management, we offered various best practices you could implement to better manage identity data, lifecycle processes, and access grants. Today, we’ll review the identity-related challenges surrounding audits and compliance, and offer ten ways to gradually chip away at the complexities of…

It’s a pretty common situation: organizations spend their resources on maintaining legacy software and legacy protocols. Today, this is often supported by hybrid domain joined devices and Microsoft Azure AD. But did you know that this can actually lead to a lax security posture?  In this type of setup, any time your users log in to a Windows 10…

This post is part of a blog series about Apps for Good—a collection of pre-built integrations to help Okta customers power their corporate and employee giving and volunteering. If you’re interested in deploying applications like these in your company, tell your Okta administrator about Apps for Good or reach out to us at [email protected]. In…

Vishing (or “voice phishing”) is a type of social engineering scam where an attacker tries to trick their target into surrendering sensitive data over the phone.  As with other social engineering attacks, these phone phishing scams prey upon human emotions—attackers often create false scenarios that cause panic (e.g., security alerts) or desire (e…