# Hideez llms.txt > ## Products - [Hideez USB Bluetooth Adapter for Mac, Linux, Windows, and Raspberry Pi](https://hideez.com/products/hideez-dongle): * See the full list of countries eligible for free shipping here. Hideez USB Bluetooth adapter is the best Bluetooth adapter for Mac, Windows, Linux, and Raspberry Pi computers. Hideez BT dongle allows you to connect a wide range of devices, including mouses, keyboards, speakers, headphones, printers, and other Bluetooth devices, making your non-Bluetooth computer Bluetooth capable and connected. CHARACTERISTICS:- Bluetooth 4.0 (Bluetooth Low Energy)- Receiving/sending distance up to 20m- Transmission speed: 3 Mbps- Supports Bluetooth voice and data- Dual-mode Bluetooth transmission - [Hideez Key 4](https://hideez.com/products/hideez-key-4): * See the full list of countries eligible for free shipping here. Designed to meet the demands of both personal security and enterprise environments, Hideez Key 4 streamlines access management while delivering phishing-resistant protection. It offers secure passwordless logins, automatic password and OTP autofill for legacy systems, and proximity-based access to computers so that they are never left unattended. Use it as a standalone security tool or as part of Hideez Enterprise Identity — an IAM system that enables organizations to switch to passwordless workforce access, saving time, reducing costs, and ensuring compliance with local security requirements. COMPATIBILITY: ✔ Passwordless sign-in to accounts (FIDO2, FIDO U2F security key): Windows 10/11, Linux, Android (via internal Bluetooth or NFC) ✔ Bluetooth password manager, OTP generator, Proximity-based PC lock: Windows 10 (2019 or later), Windows 11 (with the Hideez Client app) - [Hideez Key 3](https://hideez.com/products/hideez-key-3): * FREE Shipping to the US only Hardware password manager and generator for Windows. Hideez Key stores and automatically fills in logins, passwords, and OTPs across your accounts, locks/unlocks Windows computers based on user proximity, opens RFID door locks. Supports FIDO2 & FIDO U2F protocols allowing for passwordless logins within the FIDO ecosystem. Within the Hideez Enterprise Identity system, the device can be used as a main authorization factor that allows IT administrators to manage user identities and access rights, protect their accounts & workstations, and comply with information security standards. COMPATIBILITY: ✔ Windows 10/11: Password management, OTP generator, Proximity login & logout ✔ Windows 10/11 and Android 7.0+ devices: Passwordless authentication (U2F, FIDO2 Auth) - [Hideez Identity Cloud](https://hideez.com/products/hideez-identity-cloud): Hideez Cloud is a secure authentication platform designed for small and medium-sized businesses that need fast, compliant, and passwordless access. It enables employees to log into web services and workstations using biometrics or mobile authentication — with no passwords involved. Organizations can centrally manage access and enforce security policies, ensuring protection against phishing and unauthorized access. The platform supports proximity-based login/logout on Windows, SSO across key applications, and seamless integration with Azure AD (Entra ID). - [Hideez Enterprise Identity](https://hideez.com/products/hideez-enterprise): Hideez Enterprise is a passwordless identity and access management solution for medium and large organizations. It supports on-premise or private cloud deployment and enables proximity-based login to web apps, legacy systems, and desktops. Employees can authenticate using FIDO2 Passkeys, the Hideez Key hardware token, mobile apps, or third-party security keys. The platform ensures full control, compliance, and strong security without compromising user convenience. - [Hideez Authenticator](https://hideez.com/products/hideez-authenticator): Hideez Authenticator is a free mobile app that enables secure, passwordless access to web services and Windows computers. It replaces FIDO security keys and smart cards, supporting Single Sign-On and workstation login/logout via dynamic QR code scans. This app is part of Hideez Workforce Identity — an IAM system that enables organizations to switch to passwordless workforce access, saving time, reducing costs, and ensuring compliance with security regulations. ## Blogs - [Case Studies](https://hideez.com/blogs/case-studies): Case Studies - [Hideez Blog & News](https://hideez.com/blogs/news): Hideez Blog & News ## Blog Posts - [Hideez Last Mile Authentication Solution Now Available on the CyberArk Marketplace](https://hideez.com/blogs/case-studies/cyberark-marketplace): Hideez is excited to announce the availability of a Hideez Key integration with CyberArk that provides an added layer of hardware protection on the last mile. CyberArk is the global leader in privileged access security, and works with some of the world’s largest and most successful companies, including more than 50 percent of the Fortune 500. The integrated solution provides an out-of-the-box with authorization system and is available through the CyberArk Marketplace , a trusted platform for customers to easily find and deploy integrations with the CyberArk Privileged Access Security Solution. The CyberArk Marketplace delivers simplicity and speed for security and IT operations teams to extend the benefits of securing privileged access. Additionally, Hideez joined the C 3 Alliance , CyberArk’s global technology partner program. CyberArk launched C 3 Alliance for best of breed players to approach security as a team game, bringing together solutions to protect against attackers today, tomorrow, and into the future. The Hideez Key is a compact, wearable, all-in-one Bluetooth-enabled hardware key that serves as a secure password manager, proximity lock/unlock for PCs, and electronic door opener. It seamlessly integrates with market leading enterprise cybersecurity solutions, such as those from CyberArk, for strong endpoint hardware-based authentication that’s simple to use and designed for individuals. CyberArk or Hideez customers interested in more information about the integration are encouraged to contact us for details or if you’re in Eastern Europe or the former Soviet countries, contact our official distributor Softprom . - [Hideez Key for CyberArk. Authentication Integration](https://hideez.com/blogs/case-studies/hideez-cyberark-authentication-integration): Stolen credentials are used to commit fraud on an enormous scale through Account Takeover (ATO) or credential stuffing attacks. This presents a huge problem for businesses with employees online. Data breaches can compromise your internal documents and processes, your sensitive customer data and your financials. Solution Overview The user authenticates using the HTTPS web-based access to the PVWA system (the CyberArk authorization system is configured as a client of the RADIUS server). The user enters the basic credentials (Login and Password) using Hideez Key as a reliable hardware password storage. The CyberArk system, after checking and confirming the base user accounts, makes a request to the remote RADIUS server, which is configured in conjunction with the one-time password generator system, and requests the user to confirm the OTP confirmation code. The user using the Hideez Key enters a confirmation code. In case of incorrect verification of the code, access is denied to the user. Upon successful verification, the RADIUS server confirms the authenticity of the user to the CyberArk PVWA system. PVWA allows the user inside in accordance with the rights granted by the CyberArk system. Why Hideez? Protects against digital identity theft, phishing, credential stuffing, and account Take-overs Only password keeper for digital and physical access Outsmart vulnerabilities of other industry players Increased productivity of employees Compatible with existing infrastructure Minimized risk of Human Error Segmentation Type: Comprises of one key password, public key infrastructure and others. Model: Comprises of smart card with pin, smart card with biometric technology, biometric technology with pin, two-factor biometric technology, one-time password with pin and others. Technology: Comprises of physical and logical access control, SafeNet OTP authenticators, out-of-band authenticators, Mobile PKI office suite, PKI authenticators and others. End User: Comprises of banking and finance, consumer electronics, healthcare, government, travel and immigration, military and defense, commercial security and others. Regions: Comprises Geographical regions – North America, Europe, Asia Pacific and Rest of the World. How it works? Hideez Key Technology • Authentication • Security • Auditability and accountability • Ease of Use: Efficiency and Productivity • Manageability What is Hideez Password Manager? • Protects against digital identity theft, phishing, • Credential stuffing, and account Take-overs • One Key for many services • Increased productivity of employees • Reduced cost of operations • Compatible with existing infrastructure • Decreased Annual Loss • Minimized risk of Human Error • Business continuity Product Diagram & Description of Product Integration This solution sets us apart from other solutions, primarily due to the possibility of hardware storage of difficult-generated user passwords, a hard-to-select word format. Second, there is no need to have a telephone or other means of communication to confirm the user's identification in enterprises with high security requirements. Product Installation & Integration Configuration To deploy the Hideez Key and CyberArk interaction scheme using the RADIUS security protocol, it is suggested to use any RADIUS authentication server (for example, FreeRADIUS) installed using Ubuntu Server 18.04, with the settings of a secure channel using the CyberArk method, The Credential Provider and ASCP Implementation Guide, the Privileged Access Security Installation Guide, and the Privileged Access Security Implementation Guide. As well as bindings for the user authentication factor, the additionally raised system of multiOTP authentication or Google Authenticator. Hideez Key acts as a wireless hardware password manager, as well as an access device to the user's workplace. Instructions for setting up and using Hideez Key (Hideez Safe) are available at the product page or in the document repository. - [Hideez Enterprise Server Receives CITRIX READY Verification](https://hideez.com/blogs/case-studies/hideez-enterprise-server-verified-as-citrix-ready): Hideez Authentication Server was approved as Citrix® Ready™ and is now trusted to enhance Citrix Application Delivery Controller™ (ADC). Our team has completed a rigorous verification process to ensure that Hideez Enterprise Server is compatible with Citrix Gateway™ products, and it can now be found in the Citrix Ready Marketplace . The Citrix Ready Program is an end-to-end partner program that helps customers identify third-party products, solutions, and services recommended to enhance digital workspaces, app delivery and security products and solutions from Citrix. Leveraging its industry-leading alliances and partner ecosystem, Citrix Ready showcases over 6000 products and solutions designed to meet a variety of business needs. Hideez Authentication Server is a FIDO2 / Webauth server, SAML 2.0 Identity Provider delivers passwordless FIDO2 authentication and 2FA across corporate applications, in an environment of numerous workstations, users, and devices. Within the Hideez Authentication service , the server allows enterprise admins to manage both FIDO-compliant hardware authenticators such as Hideez Keys or platform authenticators like ones integrated with the employees’ devices (smartphones, tablets, laptops, etc.), and access corporate services with a built-in biometric sensor. Hideez Authentication Service is compatible with popular existing enterprise infrastructure solutions, being a perfect supplement for existing MFA, SSO, Enterprise Mobility Management, Cloud Solutions, IAM, or PAM. Our solution can provide enterprises with a passwordless authentication experience, protect the sensitive data of their employees and comply with modern security standards. - [Hideez joins forces with Yubico to Help State-Owned Companies in Ukraine Secure Themselves Amid War](https://hideez.com/blogs/case-studies/hideez-joined-forces-with-yubico): Ever since the start of the Russian invasion, Ukraine’s digital infrastructure has faced an unpreceded number of malicious web attacks. Amid the relentless wave of those attacks targeting government agencies and critical infrastructure organizations , Hideez launched a partnership with Yubico , a global authentication leader from Sweden, to help Ukrainian entities secure their digital environment with hardware security keys. So far, Yubico has donated 20,000 YubiKeys with a retail value of $1 million to government structures and state-owned companies in Ukraine. The devices are being distributed among most of the significant institutions, including the State Service of Special Communication and Information Protection of Ukraine (SSSCIP), .UA domain managing organization Hostmaster.UA, intelligence services, and government-owned energy companies. In order to get security keys into the hands of employees, the SSSCIP sped up what is normally a six-month certification process for the introduction of new government-wide cyber tools to just a few weeks. What are the main challenges faced by Ukraine’s organizations amid war? The start of full-scale hostilities came as a surprise to Ukraine and the entire world community. Many government agencies turned out to be ill-prepared for external attacks in the digital space, as they were forced to focus their efforts on maintaining normal functioning and ensuring the physical safety of employees as a main priority. A lot of staff members left their homes and dispersed among different regions and countries. Most of them keep on performing their duties remotely. The issue of digital security of government agencies and critical infrastructure organizations became more acute than ever before since the hostilities made it difficult to retain control of the security policies compliance, while the number of potential risks increased many times over compared to peaceful times. The Ukrainian authorities needed a solution to help them secure endpoints and make unauthorized access to user accounts and internal networks difficult, if not impossible. Since the beginning of March 2022, Hideez has been providing Ukrainian organizations with free licenses to use the Hideez authentication service and supplying them with Yubico’s hardware authentication devices for free. Yubico has already donated 10,000 security keys and plans to donate 10,000 more, while Hideez shouldered the logistical processes, technical implementation, communication, and customer support. What does Hideez do to speed up the implementation of new security solutions? Implementing new technologies takes time and effort. The process of restructuring existing business processes places an additional burden on management and employees who are already overwhelmed by the challenges of wartime. They are typically not ready to spend extra time taking advanced security courses and building their own cybersecurity systems from scratch. Fortunately, modern cloud authentication services represent a more or less simple and reliable way to address the above-mentioned issues. Hideez authentication and access management solution is based on FIDO2, an open authentication standard that enables users to use their biometrics or external security keys instead of passwords to access any website or application. It is worth mentioning that in May 2022, global IT giants Apple, Microsoft, and Google, expanded support for FIDO to accelerate the transition to a single standard of passwordless authentication by the end of 2023. ( Yuriy Akkerman , VP of War Efforts of Hideez) “We did a great job to adjust the Yubico’s products to Ukrainian realities. First of all, it was necessary to create the most simple and understandable user manuals for Ukrainian users . We tried to cover every possible use case and authentication scenario in an environment with Ukrainian infrastructure: explain what security keys are and why they are needed, how to use them, how to set up backup login options, and what one can do if the key is lost, etc. Our team is fully engaged in educational work, we conduct free training for staff and help them create new security policies, taking into account the use of hardware security keys.” ( Oleg Naumenko , CEO of Hideez) The implementation of security keys simplifies and automates a lot of manual processes, but implementing them during wartime is a huge challenge. We go through this challenge together with our partners, our Ukrainian clients, and our faith in the future. It wasn't easy to have the keys shipped to end-users as many of them are spread out all over Ukraine. But I have no doubt that from now on YubiKeys will he lp leadership teams keep their organizations running smoothly, even at a distance . " (Oleg Levchenko, CEO "‎Hostmaster") “We thank Hideez and Yubico for the opportunity to help protect our resources. Yubikeys will allow us to secure our infrastructure against the unauthorized access and installation of... - [ Hideez is helping to defend Ukrainian cyberspace](https://hideez.com/blogs/case-studies/hideez-ukraine): The Russian invasion of Ukraine is a battle in both the physical and the digital world. On both sides, information warfare plays a more critical part of the battlefield than any other war in human history, with the biggest attack vector and threat being weak login credentials. Hideez Group has long been a proud member of the Ukrainian tech, and cybersecurity community. Today, our land, our cities and our families are engulfed in war. Many people had to leave their homes, but the major part of our team is staying in Ukraine and providing services for free: we keep on mobilizing cyber efforts, defending Ukrainian independence at the digital front, and sharing experiences with those in need. Since February 24, Hideez has been providing Ukrainian organizations with free security keys from Yubico and a free license for the Hideez Server , a network service that allows managing authentication and access processes with minimum effort. Upon the request, Yubico kindly donated 30,000 YubiKeys to Hideez, in order to protect the critical IT infrastructure in Ukraine. Since then, we have deployed free YubiKeys to a dozen government agencies and companies providing critical infrastructure, including: SSSCIP, State Service of Special Communication and Information Protection of Ukraine Ministry of Digital Transformation Government-owned energy companies and power plants National Police Department State agency of automobile roads of Ukraine Ukraine’s .UA domain managing organization Hostmaster.UA SSSCIP conducted an examination and prepared an expert opinion on the use of YubiKeys and Hideez Server in its public institutions for their protection against unauthorized access. Media About Us Donation information In order to continue deploying the donated YubiKeys to the critical infrastructure in Ukraine, Hideez is in need of immediate, additional funding to cover the salaries for the team that conducts this ongoing deployment effort on the ground. If you are based in the US and if you wish to support Hideez in the effort to deploy YubiKeys, you can make a donation to UkraineNow , a 501c3, IRS approved non-profit organization. Information for Ukrainian organizations We want Ukraine to be a prime example of how to build a strong and effective cyber defence. One critical step to achieve this is to implement YubiKeys that offer strong two-factor, multi-factor and passwordless authentication with support for multiple protocols including FIDO2 . We are working with our international partners, manufacturers and solution providers to provide our Ukrainian clients with a flexible choice of available options: Passwordless access to worsktations, personal or shared work accounts. Employees can use YubiKey security keys or Hideez Authenticator app instead of passwords; Centralized management of employees, including their authentication devices and preferred sign-in methods (regular or two-factor, with or without password, etc.) Remote management of employees' access to important digital resources. Compliance with global security standards. Protection against phishing, spoofing, and man-in-the-middle attacks Seamless integration with Active Directory, Azure AD, and multiple service providers based on SAML and OIDC protocols Experienced team. Online consultations, video guides and documentation. What services are provided for free? 1. Deployment of the Hideez server for passwordless authentication and centralized control of employees' access to their accounts and organization's digital resources. Free license is granted for 12 months. To access the demo version of the server, please click here . 2. Delivery and configuration of hardware security keys YubiKey 5 FIPS (type USB-A or USB-C) for the required number of employees within the organization. 3. Expert assistance and online consulting to help set up the most efficient and convenient authentication system with minimal loss of time. How to apply? If you are a government organization, critical infrastructure provider, or local company suffering from cyber attacks, phishing, leaks, or problems with employee authentication management, we are ready to provide free cybersecurity solutions. We would like to draw your attention to the fact that for the free transfer of YubiKey hardware security keys, we will ask you to conclude an official act of acceptance - transfer of property between Hideez and the legal entity for which your organization is registered. - [Hideez Teams Up with InBase to Enhance Security of Megapolis.DocNet Users](https://hideez.com/blogs/case-studies/inbase-partnership): Hideez is proud to announce a new partnership with InBase , a Ukrainian IT company renowned for its business automation and electronic document management solutions. This collaboration aims to enhance the security and user experience for Megapolis.DocNet, InBase’s flagship corporate document management system. Megapolis.DocNet is a comprehensive corporate document management system designed to handle the entire document workflow seamlessly. From the initial creation and digital signing to secure archiving, the solution ensures efficient document management and provides users with complete control over their documents. The solution is built to manage heavy workloads and operates reliably even on less powerful servers, effectively handling numerous simultaneous operations. It also boasts enhanced collaboration capabilities, integration options, and process automation features, streamlining organizational workflows. Bringing Passwordless Authentication to the Forefront By integrating with Megapolis.DocNet, Hideez aims to tackle the challenge of secure access to valuable documents by offering a variety of passwordless authentication methods. These methods include: Passkeys : Secure cryptographic keys based on biometrics. Hideez Authenticator : A user-friendly app for secure mobile-based authentication. Hardware Security Keys : Including Hideez Keys, YubiKeys, and other FIDO-certified devices. These options ensure that traditional passwords become obsolete, thereby eliminating the risk of them being compromised or forgotten. Thanks to our partnership, Megapolis.DocNet users will benefit from advanced passwordless SSO, significantly enhancing their data protection. The integration with Hideez Authentication Service will provide users with a higher level of security and convenience, safeguarding their sensitive documents and communications. About InBase InBase is a Ukrainian IT company with over 25 years of experience in developing business automation and electronic document management solutions. Apart from Megapolis.DocNet system, their product lineup includes: Scriptum: A high-performance low-code platform for business process automation, enabling companies to create their own IT solutions without the need for developers. Scriptum includes pre-built modules and detailed instructions, making it easy to automate workflows and integrate various systems. Scriptum.Repository: A secure electronic archive providing a centralized space for storing and managing electronic documents, accessible 24/7 from any device, with robust search and bulk export features. Megapolis.DocNet Connector for Electronic Court: An add-on to the state "Electronic Court" system, facilitating full-scale legal document management and exchange with courts, complete with notifications, lawyer calendars, access control, audits, and report generation. InBase has achieved success in executing more than 1,000 projects, encompassing system solutions tailored for small and medium-sized enterprises, as well as extensive deployments catering to large organizations and intricate nationwide information systems. Noteworthy clients include Naftogaz, Kyivstar, DTEK, Farmak, Comfy, Ukrtelecom, Astarta, Ukrzaliznytsia, and numerous others. - [Hideez Receives USAID Support for Advanced Passwordless Authentication Project](https://hideez.com/blogs/case-studies/usaid): Hideez Development LLC has secured a grant from the U.S. Agency for International Development (USAID) through USAID Cybersecurity Activity to develop an innovative mobile authenticator app that will enhance cybersecurity for Ukraine’s critical infrastructure. The rapid evolution of technology presents both new opportunities and challenges, particularly in cybersecurity. Traditional authentication methods, such as passwords and OTPs, leave critical infrastructure vulnerable to sophisticated cyber threats. Hideez leverages the Fast Identity Online (FIDO) Alliance standards, including FIDO U2F and FIDO2/WebAuthn authentication, to introduce a secure, passwordless SSO and IdM system for the workforce. This method employs public key cryptography to store private keys on personal devices, significantly reducing the risk of phishing and other types of identity-based attacks. The main goal of the project is the development of a mobile app that would rely on a smartphone’s crypto chip (TPM module) and FIDO algorithms to enhance the protection of employees while they access web services and applications. The solution will be introduced to a number of critical infrastructure providers and private companies in Ukraine as a means of reducing the costs of implementing passwordless authentication. "For Ukraine to effectively combat cyber threats, it is essential to integrate cutting-edge cybersecurity measures into their infrastructure," said Oleg Naumenko, CEO at Hideez Development LLC. "Our collaboration with USAID Cybersecurity Activity underscores the importance of innovative solutions in building a resilient and secure digital ecosystem." Hideez’s solution will focus on: Enhancing Security : Implementing a robust authentication system to mitigate phishing attacks and password-related data breaches. Improving User Experience : Streamlining the authentication process to increase productivity and improve user experience. Reducing Costs : Eliminating the need for hardware tokens and reducing administrative burdens. Promoting Advanced Technologies : Encouraging widespread adoption of secure, passwordless authentication methods. About USAID Cybersecurity Activity USAID Cybersecurity Activity is a USAID project that works to reduce and potentially eliminate cybersecurity vulnerabilities in Ukraine's critical infrastructure sectors, and to build Ukraine’s cybersecurity workforce, develop the cybersecurity industry, and strengthen Ukraine's ability to prepare for cyberattacks. - [In Response to Cyberattacks: Hideez Launches a Mobile App for Secure Passwordless Multi-Factor Authentication](https://hideez.com/blogs/case-studies/mobile-app-for-passwordless-mfa): Kyiv, Ukraine — June 9, 2025. Hideez has launched a mobile authenticator app that leverages cryptographic technology for passwordless login. The solution was developed with the support of the USAID Cybersecurity for Critical Infrastructure in Ukraine Activity. Unlike popular apps that rely on one-time codes and remain vulnerable to phishing attacks, the Hideez Authenticator implements a passwordless model based on public-key cryptography. This eliminates the need to remember or transmit credentials and ensures phishing resistance. Users can log into workstations, applications, and web services by simply scanning a QR code with their smartphone. All cryptographic keys are stored locally in a secure enclave on the user’s device, and authentication is possible even without an internet connection — a critical advantage during blackouts. The app is already deployed as part of the Hideez Workforce Identity system at the Cabinet of Ministers of Ukraine, the State Agency for Restoration and Infrastructure Development, and other institutions with heightened security requirements. “This is a major step forward in strengthening Ukraine’s cyber resilience. Ukraine already has a strong IT sector, a high level of digital maturity, and the ability to rapidly adopt cutting-edge security technologies. Passwordless authentication is already supported by global tech leaders like Google, Apple, and Microsoft — and we believe Ukraine can be not only a user but a creator of such solutions. We're already seeing interest from companies in Europe and the United States. This confirms that Ukrainian companies are capable not only of following global trends but of setting them. Our product is proof that innovation doesn't have to come from Silicon Valley — it can come from Ukraine,” said Oleg Naumenko , CEO of Hideez. Key Benefits of the Hideez System: A comprehensive identity and access management system compatible with both cloud and on-premises environments Flexible choice of authentication methods — mobile app, hardware tokens, or built-in biometric mechanisms 100% phishing resistance through cryptographic protocols Free for up to 20 users Easy to set up, with online support in Ukrainian To become one of the first users and implement the solution for free as part of a fully supported pilot project, submit a request on the official Hideez distributor’s website: https://hideez.bakotech.com/ua-demo About Hideez Hideez specializes in passwordless authentication solutions . Its products are designed for multi-user environments, ranging from small businesses to large enterprises with complex IT infrastructure. Hideez is an official member of the FIDO Alliance, and its products have received expert approval from the State Service of Special Communications and Information Protection of Ukraine. About USAID Cybersecurity Activity USAID Cybersecurity Activity works to reduce and potentially eliminate cybersecurity vulnerabilities in Ukraine's critical infrastructure sectors, and to build Ukraine’s cybersecurity workforce, develop the cybersecurity industry, and strengthen Ukraine's ability to prepare for cyberattacks. - [Cyber Hygiene: Essential Practices to avoid common online attacks](https://hideez.com/blogs/news/cyber-hygiene): Whether you're replying to emails, streaming your favorite show, or logging into a work app, you're interacting with the digital world — and every click matters. Basic cyber hygiene isn’t just a best practice. It’s a necessity. Think of it like brushing your teeth or locking your front door. Small habits, done regularly, can protect you from major threats. Cyber hygiene works the same way. It's the daily, weekly, and monthly routines that keep your digital life clean and secure — from personal devices to corporate networks. For small businesses, the stakes are especially high. One misstep — like a weak password or an outdated system — can open the door to serious security issues. Practicing strong cyber hygiene isn’t just smart; it’s essential for staying compliant and operational in today’s threat-heavy environment. This guide breaks down the key components of effective cyber hygiene, from essential security basics to advanced threat mitigation strategies. You’ll learn how to reduce risk, prevent unauthorized access, and respond confidently to today’s evolving threat landscape. Whether you're securing remote endpoints, legacy systems, or physical office access, Hideez offers an all-in-one platform that reduces attack surfaces and supports compliance with standards like HIPAA , PCI DSS, and NIST . SMBs can get started with a free 30-day trial to test passwordless access without upfront costs. Understanding Cyber Hygiene Fundamentals Cyber hygiene refers to the practices and steps that users take to maintain system health and improve online security. Similar to personal hygiene routines that help maintain physical health, cyber hygiene involves regular habits that protect digital information and systems from deterioration and threats. The concept works as a preventative approach rather than a reactive one, focusing on establishing consistent security practices before problems arise. At its core, cyber hygiene is about maintaining a baseline level of security to prevent common attacks. According to Microsoft's Digital Defense Report, proper cyber hygiene protects against 98% of attacks, with the majority of these involving compromised identities. This highlights the importance of implementing fundamental security measures rather than focusing solely on sophisticated security solutions. The primary goal of cyber hygiene is to keep sensitive data secure and strengthen an organization's ability to recover when a successful attack occurs. By maintaining good cyber hygiene, organizations can minimize the risk of operational interruptions, data compromise, and data loss, creating a more resilient security posture. This makes cyber hygiene fundamental to both cybersecurity (guarding against threats) and cyber resilience (improving recovery capabilities). Core Components of Effective Cyber Hygiene A comprehensive cyber hygiene program encompasses several critical components that work together to create a strong security foundation. Regular maintenance is essential, including keeping software and operating systems current, applying security patches promptly, and systematically archiving data. This routine care prevents security vulnerabilities from being exploited by cybercriminals. Training and awareness form another crucial element, as cyber hygiene requires individuals and organizations to adopt a security-centric mindset. Security awareness training helps employees understand their role in maintaining security and recognize common threats like phishing attempts. Since 68% of data breaches involve the human element according to the 2024 Verizon Data Breach Investigations Report , this component cannot be overlooked. Ongoing collaboration between security specialists and end users is vital for sustained cyber hygiene. IT security teams cannot maintain good cyber hygiene in isolation — they need the cooperation of all users within the organization. This collaborative approach creates a culture of security where everyone understands their responsibilities in protecting digital assets. Finally, regular monitoring and assessment of security measures ensures that cyber hygiene practices remain effective against evolving threats. This continuous process involves evaluating the organization's security posture, identifying potential vulnerabilities, and adapting strategies accordingly. External cyber hygiene services can also provide valuable insights and recommendations from security experts equipped with specialized tools and expertise. Try Passwordless Access in Your Organization! 01 Create an account as an IT administrator 02 Set up using our AI wizard or book a call with tech support 03 Add up to 20 users for free ✨ Sign Up Cyber Hygiene Best Practices Good cyber hygiene starts with simple, consistent habits. Here’s how to build a layered defense that protects your organization from today’s most common cyber threats. Password Managers Strong password management is the foundation of good cyber hygiene. Using unique,... - [How to Use Hideez Key's RFID Module](https://hideez.com/blogs/news/hideez-key-rfid-module-usage): Hideez Key can serve as an electronic key for home, office or gym. Using the RFID features does not require any additional software. Hideez Key is equipped with RFID module that works on the 125 kHz frequency bandwidth. The RFID antenna with the control unit can be found under the top cover. This module is not connected to the main board and operates independently from the Bluetooth module. The RFID module is commonly used for identification in physical access control systems. Hideez Key can work on two different standards: HID or Em-Marine. However, they cannot be used simultaneously. Hideez Key can store only one RFID code at a time. The key fob comes with a unique code that has already been put in the Em-Marine standard. To use it as a tag for your RFID-enabled door system, you should ask your access system provider to include this code into their system. This code can be replaced by any other code both in the Em-Marine or HID standards. This procedure requires special hardware called a programmer. This equipment is supplied as a part of commercial access control systems (ACS), or it can be purchased separately. You may ask an authorized locksmith service to clone your existing key fob onto your Hideez Key. Note : The RFID module is not compatible with NFC modules that are installed in smartphones and tablets, as it uses a different frequency range. - [ How to Secure your Gmail Account in 2022? - Email Security Best Practices](https://hideez.com/blogs/news/gmail-security): Online scams are as old as the Internet itself and have evolved over the decades along with it. Hackers and cybercriminals are always trying new techniques to suck in and trick users into exposing their valuable personal information. Some of the most common hacker attempts revolve around breaching email services like Gmail. Every couple of months, Google experiences some form of a large-scale hacker attack, and the situation was no different in 2021. Not to mention that hundreds, even thousands of people get their accounts breached daily. But, even though this is a worrying statistic, there are some things you can do to secure your Gmail account. Here are the best email security practices to employ in 2022 to ensure maximum Gmail account security. How to Secure Your Gmail Account From Hackers? Online threats and Gmail account breaches are no laughing matter, and Google takes them very seriously. For this reason, it has built a very robust security system that you can rely on to secure your account from email security threats. This system relies on several facets you need to take care of and put in place. With that in mind, here’s everything you need to know about the five best ways to secure your Gmail account from hackers: 1. Use a Strong Password It all starts with a strong password. Unfortunately, many online users often overlook the importance of a good password and opt for convenience over security. This is a very bad and potentially harmful practice. If you want to make sure your password is as strong as it can be, it’s best to follow the National Institute of Standard and Technology (NIST) password guidelines . Let’s take a closer look at the most important NIST password guidelines: Length Over Complexity - It’s commonly accepted that a complex password is significantly safer than one that’s not complex. However, results show that password length is much more significant than complexity. This is why NIST doesn’t recommend any password-complexity guidelines. Instead, it recommends using passwords of at least eight characters. No Periodic Resets - The idea behind periodic resents is to lock out unauthorized access to an account by requiring the user to reset their password every couple of months. In reality, this practice just complicates the user experience and increases the chances of a breach. It’s difficult enough to remember one strong password. So it’s always better to make that one password extra-strong than to change it up every once in a while. Don’t Use Password Hints - In today’s overexposed era of social media, most of us are sharing more than we realize. If you use a password hint an attacker can find by researching one of your social media profiles, you’re just making it easier for the hacker to get access to your account. Enable Two-Step Verification - Multi-factor authentication, also known as Two-factor authentication, is a very efficient identity verification method that allows you to secure the Gmail login process even better. This brings us to the next crucial security step. 2. Choose your two-factor authentication (2FA) method Adding Two-step verification to your Google account is fairly simple and straightforward. The technology has come a long way over the past few years and is a must-have for all security-conscious Google users. There are several types of 2FA you can set in place to add security to your Gmail account. The most widespread ones are: Text Messaging - SMS verification has long been the industry standard for Two-factor verification. That said, this type of 2FA has become obsolete with time, as SMS messages can be intercepted through basic flaws and are not very secure overall, compared to other methods we’ll get to in a second. Google Prompts - There are two ways to use the Google Prompts feature. You can set it to use it with your phone instead of your password. Alternatively, you can select it as a 2FA method on top of the password. We must mention that Google Prompts can only be used on a mobile or tablet device. Authenticator App - There are many authenticator apps out there, but Google Authenticator is the best on the market. It’s simple, barebone, and relatively streamlined. Taking that into account, it poses the question - can Google authentication be hacked? If you’re worried about this, there’s only one 2FA method that can top it. Security Key - hardware keys are always the most secure option in terms of 2FA security. They are created with customization and user experience in mind, often combine multiple features and compatibility with different devices. For example, the one like Hideez Key can store and automatically enter your login credetials at the push of the button, generate one-time passwords and make the process two-factor verification seamless and intuitive. 3. Take Care of Your Google Account Recovery Strong password and 2FA aside, you also need to have a system in place in case you have to recover your Google account. Having a good account... - [PSD2, Dynamic Linking & FIDO Authenticators](https://hideez.com/blogs/news/psd2-banking-explained): The revised Payment Services Directive (PSD2) represents a significant evolution in European payment regulation, updating the original 2007 PSD framework. This directive aims to create a more integrated European payments market, enhance security measures, protect consumers, and foster innovation by opening banking infrastructure to third parties. With full implementation occurring between 2018 and 2020, PSD2 has fundamentally reshaped how financial institutions, payment service providers, and consumers interact. This article explores the key components of PSD2, its implementation requirements, security measures, impact on various stakeholders, and the challenges and opportunities it presents within the evolving financial services landscape. Understanding the Core Objectives and Legal Framework of PSD2 PSD2 updates and enhances the EU rules established by the initial Payment Services Directive adopted in 2007. It entered into force on January 12, 2016, with EU Member States given until January 13, 2018, to transpose it into national law. The directive is administered by the European Commission to regulate payment services and payment service providers throughout the European Union and European Economic Area. The four main objectives of PSD2 are clearly defined: to contribute to a more integrated and efficient European payments market; to further level the playing field for payment service providers by including new players; to make payments safer and more secure; and to enhance protection for European consumers and businesses. In essence, PSD2 supports innovation and competition in retail payments while strengthening the security of payment transactions and consumer data protection. The legal framework of PSD2 contains two main sections. The "market rules" describe which types of organizations can provide payment services, including credit institutions (banks), electronic money institutions, and the newly created category of "payment institutions" with their own prudential regime rules. The "business conduct rules" specify transparency requirements for payment service providers, including charges, exchange rates, transaction references, and maximum execution time, as well as rights and obligations for both providers and users. PSD2 is supplemented by regulatory technical standards developed by the European Banking Authority in cooperation with the ECB. These standards cover strong customer authentication, common and secure open standards of communication, incident reporting, and security measures for operational and security risks. These components work together to create a comprehensive framework that governs the modernization of payment services across Europe. Strong Customer Authentication (SCA): Requirements and Implementation At the heart of PSD2 is the concept of Strong Customer Authentication (SCA), a security measure designed to reduce fraud and enhance the safety of online payment transactions. SCA requires payment service providers to implement multi-factor authentication for electronic payments and account access, significantly increasing security standards across the European payments landscape. According to the directive, customer authentication is considered "strong" when it is based on the use of two or more independent elements from the following categories: knowledge (something only the user knows, such as a password or PIN), possession (something only the user possesses, such as a card or authentication device), and inherence (something the user is, such as fingerprint or voice recognition). These elements must be independent, meaning a breach of one element does not compromise the reliability of the others. For remote transactions like online payments, the security requirements go even further by requiring a dynamic link to the specific transaction amount and the account of the payee. This provides additional protection by minimizing risks in cases of mistakes or fraudulent attacks. The most widely adopted approach for verifying cardholder identities under SCA guidelines is 3D Secure 2.0, which improves user experience while reducing the extra steps normally required for authentication. There are, however, several exemptions from SCA requirements that are designed to balance security with convenience. These include low-value transactions (under €30), low-risk transactions (based on real-time risk assessment), recurring transactions of the same amount to the same beneficiary, and transactions to trusted beneficiaries that customers have previously whitelisted. Payment service providers can request these exemptions when processing payments, but the final decision rests with the cardholder's bank. Open Banking and Third-Party Payment Service Providers Under PSD2 PSD2 opens up the EU payments market to third-party payment service providers by requiring banks to provide access to customer account information and payment initiation capabilities through open Application Programming Interfaces... - [Navigating HIPAA Authentication: Ensuring Compliance with Hideez](https://hideez.com/blogs/news/navigating-hipaa-authentication-ensuring-compliance-with-hideez-key): There are many IT solutions on the market that can help healthcare organizations meet the security requirements for the Health Insurance Portability and Accountability Act’s (HIPAA) clauses on safeguarding protected health information (PHI). HIPAA’s security rule lays out specific administrative, physical, and technical components that are necessary for full compliance. Hideez supports compliance with HIPAA demands for ePHI protection as a multi-factor authentication solution. Authentication assurance levels Multi-factor authentication (MFA) is required when dealing with electronic protected health information. Three authentication assurance levels (AAL) are outlined in national digital identity standards ( NIST SP 800-63-3 ), but only the last two meet the requirements for MFA. AAL1 - provides some assurance that the claimant controls an authenticator bound to the subscriber’s account. AAL1 requires either single-factor or multi-factor authentication using a wide range of available authentication technologies. Successful authentication requires that the claimant prove possession and control of the authenticator through a secure authentication protocol. AAL2 - provides high confidence that the claimant controls authenticator(s) bound to the subscriber’s account. Proof of possession and control of two distinct authentication factors is required through secure authentication protocol(s). Approved cryptographic techniques are required at AAL2 and above. AAL3 - provides very high confidence that the claimant controls authenticator(s) bound to the subscriber’s account. Authentication at AAL3 is based on proof of possession of a key through a cryptographic protocol. AAL3 authentication SHALL use a hardware-based authenticator and an authenticator that provides verifier impersonation resistance — the same device MAY fulfill both these requirements. In order to authenticate at AAL3, claimants SHALL prove possession and control of two distinct authentication factors through secure authentication protocol(s). Hideez Key: AAL2 compliant Hideez Key 3 meets AAL2 standards as it provides for authentication via MFA, specifically via a memorized secret and single-factor one-time password: Memorized secrets in layperson’s terms are passwords, but they should meet certain requirements to fit AAL2. If chosen by the subscriber, they should be least 8 characters in length. If chosen by a Cloud Service Provider or verifier, they should be 6 characters long and can be entirely numeric. Hideez Key stores thousands of passwords of any length for users and can also generate strong passwords consisting of different random symbols, including alphabetic, numeric and special symbols, inputting them automatically via Bluetooth with just one click on the device. Our product also qualifies as a single-factor one-time password (OTP) authenticator. Hideez can generate OTP, based on the standard RFC6238 for TOTP aka Time-Based One-Time Password algorithms. The OTPs are based on HMAC-SHA-1, with 160 bit key length and provides 6 digit values. Hideez Key stands out as a hardware OTP generator that, as a device, is something you have, providing proof of possession. To find out more about Hideez Enterprise Solution, please fill the form below, and we'll get in touch! - [Multi-factor Authentication: Why is a Separate Wearable Device Better Than Your Smartphone?](https://hideez.com/blogs/news/separate-wearable-device): In the United States, about 19% of the adult population has experienced identity theft. Over 60 million Americans have had their online identity exposed by hacks of the customer databases of their service providers or government agencies. The situation is similar in Europe and other countries. Identity theft is not the only crime that walks hand in hand with hacked passwords and compromised online accounts: credit card fraud, blackmail, privacy invasion and illegal wiretapping all occur frequently throughout the world. Multi-factor authentication (MFA, sometimes simplified as ‘two-factor’ or 2FA) has been proven to be an effective tool for enhancing the security of online accounts. However, enabling MFA or 2FA does not mean your account is automatically secure. The military and elite have used MFA for centuries. For example, in the Three Musketeers by Alexandre Dumas, d’Artagnan receives a ring from Queen Anne of France in addition to the spoken instructions he needs to use to communicate to the Duke of Buckingham in order to warn the Duke that Cardinal Richelieu and Milady de Winter are plotting to kill him. The modern use of MFA for securing computer records and online accounts originated in the banking sector, the typical example being cash withdrawal from an ATM, which requires having a banking card and knowing your PIN. Person using ATM. Image by Pixabay In the early 2000s, banks, online stores and services introduced a telecom version of 2FA based on SMS containing a one-time password (OTP). Now this is synonymous with 2FA itself. Recently, mobile applications (e.g. cross-platform Google Authenticator) brought have carrier-independent 2FA to mobile platforms using TOTP and HMAC software algorithms. Screenshot of Google Authenticator on Android Smartphone. Image by AskUbuntu via StackExchange So, why still bother with old-school hardware authentication tokens that require carrying yet another object around? In this post, we will try to explain why a hardware second factor solution is a good option and will guide you through the features of our flagship product, the Hideez Key , which makes hardware MFA an effective and easy to use solution for such cases. An external device is a true second factor, in fact — one of the multiple factors required to feel secure in modern cyberspace In times when online criminals and governments can bypass even two-factor authentication , trusting your second factor to the same device you want to protect is not the best solution. The well-known three pillars of two-factor authentication are what you know (i.e. password or PIN), what you have (i.e. banking card, digital token or other physical object) and what you are (i.e. biometric data like fingerprints, iris or eye veins, the manner you type on your keyboard, soundwave pattern of your voice or heartbeat, etc.). Customers who use software-only 2FA limit themselves to only what they know, i.e. their permanent password or passphrase and a one-time password (OTP) or PIN which is… just another password in the end. This means a computer professional or criminal who somehow got control over your client device or has the ability to see what is on your screen (think of CCTV or hidden security cameras inside modern office buildings) can bypass software-only 2FA like that. In fact, given all the threats of the modern world, we recommend our customers to move beyond conventional 2FA to more complex MFA with biometric data as the primary factor for authentication with all other auxiliary factors required only to prove the authenticity of the confirmation message issued based on the biometric data. Here, ease of use starts to play a key role. If setup and used properly, external devices can be more reliable than OTP Since the late 2000s, OTPs delivered via SMS has become a very popular authentication method in banking and has spread to online services like email, social networks, cloud storage, etc. There, OTPs are easy to use. However, their reliability depends on a number of factors. First of all, the customer needs to be sure that the mobile network used to deliver the OTP is sufficiently protected. There are publicly reports of flaws in 4G and even 5G networks already, while 3G was also compromised as early as in 2010 . Secondly, SMS OTPs are vulnerable to government wiretapping, which might be an issue for countries experiencing problems with freedom of speech and other basic human rights. Each 3G and 4G standard has mandatory instruments built in for authorized government law-enforcement agencies to access the SMS servers of mobile networks operating within the jurisdiction of the law-enforcement agency. Moreover, it is possible to intercept such SMS OTPs while the victim of an attack is using roaming in that country. Unlike telecom operators, 2FA token hardware vendors currently have no obligation to disclose their technology to the government in most countries, as this might have adverse effects on banking security and... - [Hideez is a SAML 2.0 Identity Provider](https://hideez.com/blogs/news/hideez-is-a-saml-2-0-identity-provider): Authentication Using SAML Hideez SAML Identity Provider complements the Hideez Enterprise Server with new capabilities. The IdP uses HES identity store enabling authentication and providing federation for service providers which support SAML 2.0 Web Browser SSO Profile. SAML (Security Assertion Markup Language) is standard for exchanging authentication and authorization data between security domains. SAML 2.0 is an XML-based protocol that uses security tokens containing assertions to pass information about a principal (usually an end user) between a SAML authority, named an Identity Provider, and a SAML consumer named a Service Provider. Besides the fact that SAML authentication helps to prevent users from remembering many logins and passwords, this technology allows IT administrators to manage only one pair of user credentials for all applications. Hideez SAML Identity Provider built on Shibboleth IdP3 that is available under the Apache 2.0 open source software license. Shibboleth is among the world’s most widely deployed federated identity solutions, connecting users to applications both within and between organizations. If your application is a SAML 2.0 Service Provider you are ready to add an extra layer of security with Hideez IdP, to enable 2FA and to use Hideez Key as a hardware wireless authenticator. Note: Even if your application doesn’t support SAML it is easy to implement. In such way, you obtain an elegant full-value authentication solution integrated with Hideez technology and with minimal expenses. Request a Demo >> - [Authentication in NIST Cybersecurity Framework | Smart Grid Profile for Improving Critical Infrastructure](https://hideez.com/blogs/news/authentication-requirements-in-nist-cybersecurity-framework): The U.S. electric power grid is modernizing through “smart” technologies. These changes bring a lot of benefits, but also a lot of potential cybersecurity risks. National Institute of Standards and Technology (NIST) recently published Smart Grid Profile . The Smart Grid Profile is NIST’s “initial attempt to apply risk management strategies from the Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework) to the smart grid.” The Profile provides numerous cybersecurity considerations for power system owners/operators in each of the Cybersecurity Framework’s five Core areas: “identify, protect, detect, respond, and recover.” Three Core Authentication requirements: 1. Devices should be authenticated before connecting to the grid network to ensure that only authorized devices are allowed to connect. Proper authentication of users, devices, and assets helps ensure safety and reliability. Special care will need to be taken to ensure that modernized devices are also authenticated to the grid network. 2. When collecting and aggregating data from third-party devices, the devices and the data should be authenticated and validated. Without this authentication and validation, power system owners/operators should carefully consider whether those devices and their data can be trusted. 3. Unauthorized personnel, connections, devices, or software introduce risks into IT and OT and may impact grid operations. Any connections to IT and OT systems and networks should be authenticated to ensure that only approved and trusted parties gain access to those systems and networks. If you want to know more how Hideez Authentication Solution can implement Authentication requirements for Smart Grid Profile please contact us. SCHEDULE A DEMO - [Data Privacy & Security in Healthcare. Who needs to Comply with HIPAA?](https://hideez.com/blogs/news/data-privacy-security-in-healthcare-who-needs-to-comply-with-hipaa): The Health Insurance Portability and Accountability Act (HIPAA) is one of the key documents for every CISO working in healthcare. Written over 20 years ago, long before smartphones, WiFI, or Google were invented, it still regulates healthcare information security in the industry. Learn how it is applied nowadays to ensure secure medical care. Why is data security important in healthcare? Name. Address. IDs. Prescriptions. Photos. It’s just a fraction of the data healthcare organizations had, have, and will have about their clients. Unauthorized access to such information can result in severe consequences for the disclosed individual. They may face identity theft, fraud, theft of money, as well as moral damage. The research found that health records from hospital data breaches can cost hundreds of dollars each on a black market. For a healthcare organization, the stakes are high when it comes to patient data security issues. Security breaches in healthcare result in expenses on independent forensic experts, internal investigation, communication with both employees and clients, settlements, fines, and ultimately reputational damage and loss of customer trust hit the long-term profit of the organization. That is why a CISO role is of most importance in the healthcare business. It is their job to develop a system that would adequately mitigate risks and protect against anticipated threats. What is data security for PHI? HIPAA ensures health data security (PHI) regulating how it is used, maintained, stored, or transmitted by a HIPAA-covered entity (a healthcare provider, a health plan or health insurer, a healthcare clearinghouse) or a business associate of such entity. PHI stands for Protected Health Information, and under HIPAA, it covers any information related to the health status of an individual. It includes medical records, health histories, lab test results, and medical bills. PHI is protected regardless of the form it takes, including physical records, electronic records, or spoken information. Once health information includes individual identifiers, it becomes PHI and is protected under the HIPAA. There are 18 PHI identifiers: Name Address (including subdivisions smaller than a state, like a street address, city, county, or zip code) Any dates (except years) that are directly related to an individual. It includes birthday, date of admission or discharge, date of death, or the exact age. Telephone number Fax number Email address Social Security number Medical record number Health plan beneficiary number Account number Certificate/license number Vehicle identifiers, serial numbers, or license plate numbers Device identifiers or serial numbers Web URLs IP address Biometric identifiers such as fingerprints or voiceprints Full-face photos Any other unique identifying numbers, characteristics, or codes. HIPAA-covered entities and their business associates must comply with the confidentiality, integrity, and availability requirements to electronic PHI (ePHI). Confidentiality is maintaining that ePHI is not illegally disclosed without proper patient authorization. Integrity is ensuring that ePHI that is transferred or maintained by a healthcare organization can be accessed only by appropriate and authorized parties. Availability is allowing patients to access their ePHI under the HIPAA security standards. A line between PHI and not PHI It is often believed that all health information is considered PHI under HIPAA, but there are some exceptions. HIPAA only applies to the covered entities and their business associates. It means that if health information is not shared with such entities, it is not considered PHI. Let's take health trackers (either wearable or mobile app) that record health information such as heart rate or blood pressure as an example. Unless the device manufacturer or app developer shares this data with a HIPAA-covered entity, it is not considered PHI under HIPAA. HIPAA does not apply to education or employment records. A hospital may hold data on its employees, which can include some health information like allergies or blood type, but it is not classified as PHI. If PHI is stripped of all the identifiers that can tie it to an individual, it becomes de-identified PHI, and the HIPAA rules no longer apply. What is a data breach in healthcare? Data breach in healthcare means that one or more records are at risk of being exposed or have been known to be accessed or disclosed without authorization. Potential access to the data also counts as a data security breach. Big data security breaches happen yearly, targeting even the biggest healthcare companies. A single attack on American Medical Collection Agency affected 25 million patients. Research shows that ransomware and SQL injection attacks are the most common cause of a healthcare data breach. They often occur when stressed and/or unaware employees fail to identify malicious emails, websites, or software. Another common challenge is compliance... - [What is Identity Management? Enterprise Identity Management Solutions](https://hideez.com/blogs/news/identity-and-access-management): Cybersecurity has come a long way in the past two decades. So much so that proper identity management practices have become a basis for strong cybersecurity systems. In short, you always have to make sure that everyone is who they claim to be when requesting access. Equally as important, you should be certain that they are allowed to access what they’re requesting. With this in mind, choosing a specific identity management approach can be challenging, especially when dealing with enterprise identity management solutions. So, to help you make sure you pick the most suitable identity management policy, we’ll cover everything you need to know about this extensive topic, all in one place. What is Identity Management? Identity management(IdM), also known as identity and access management (IAM) is often defined as a system used by IT departments to initiate, store, and manage user identities and access permissions. IAM includes two important processes: authentication and authorization . In simple terms, authentication answers who you are by matching your login and password with your record in a database. Authorization checks what access and permissions you have. So, the identity and access management system is there to prevent any unauthorized access and raise alarms whenever an unauthorized user or program makes an access attempt. Additionally, it’s important to differentiate Identity Management and Access Management. The easiest way to do so is to remember that Identity Management is all about managing different attributes related to a user, a group of users, or any other entity that requires access. On the other hand, Access Management is about evaluating these attributes and giving a positive or negative access decision based on them. IAM methodology ensures that users have access to the assets they need, like systems, infrastructure, software, information, but the assets are not accessible by unauthorized users. The key to secure identity management and access control lies in the combination of strong credentials, appropriate permissions, specified assets, and the right context. Identity and access management policies and procedures are developed with the principal idea in mind - prevent exposure of sensitive data. Identity and Access Management Concepts Identity and access management solutions, like Hideez Workforce Identity, typically consist of the following fundamental elements: an identity repository with personal data used by the system to identify users; access lifecycle management tools (used to add, modify, update or delete that data); an access regulation system that enforces security policies and access privileges; a report and audit system that monitors activity in the overall system. Identity access management tools can include automatic provisioning software, password managers, security-policy enforcement applications, monitoring apps, multi-factor authentication, single sign-on, and more. With the advancement of technologies and an increased number of data breaches, it takes more than a strong login and password to protect an account. That’s why more and more IAM solutions use biometrics, physical tokens, machine learning, and artificial intelligence in their systems. Identity Management Use Cases User identity management User identities are managed by the IAM solution. The IAM may integrate with existing directories’ identity management roles, synchronize with them, or be the one source of truth. In any case, an id management system is used to create, modify, and delete users. User provisioning and de-provisioning An IT department is responsible for user provisioning. They need to enter new users into the system and specify what apps, software, sites, directories, and other resources they can access. It is essential to define what level of access (administrator, editor, viewer) every individual user has to each of them. To simplify the process, the IT department can use role-based access control (RBAC). This way, when a user is assigned one or more roles, he or she automatically gets access as defined by that role. De-provisioning is also a critical IAM component. When done manually, it can result in delayed action and unintended disclosure. Hideez Enterprise server automates the process and immediately de-provision ex-employees. User authentication IAM systems authenticate a user when the user requests access. A common standard is to use multi-factor authentication to ensure stronger protection and a better ID management system overall. User Authorization Based on user provisioning, an IAM system authorizes user access to the requested resource if the credentials match the records in the database. Reporting To help companies comply with regulations, identify security risks, and improve internal processes, IAM provides reports and dashboards to monitor the situation. Single Sign-On (SSO) SSO is one of the best examples of modern and sophisticated identity management use cases. Only the best... - [What is Multi-factor Authentication? Advantages & Limitations](https://hideez.com/blogs/news/what-is-multifactor-authentication-advantages-and-limitations-hideez): In the world where people seem to remember only passwords like «qwerty » , «Abc123! » and «123456789» , there should be a way to protect their accounts. Luckily, there is an MFA. Available in many forms, it allows making even the worst of passwords more secure. What is Multi-factor Authentication? Although two-step verification isn't really a new concept, many online users and businesses still aren't aware of what it is. That's why, before we get deeper into all of the benefits Multi-factor Authentication brings to the table, it's necessary to understand what it is and how it works. So, what is MFA ? The MFA definition is quite simple. It's a technology used to ensure that the user is indeed the one who he says he is, by requiring him to provide at least two unique pieces of identification that prove his true identity. The main goal of such a security system is to create a layered wall of protection that makes it more difficult for third-party hackers to gain access to sensitive user information. Even if the attacker manages to get a hold of your password and compromise your account, he still has to pass at least one more barrier before successfully getting into your account. While this may sound like an overly-complicated system, you've most likely already used MFA in your day-to-day life without even realizing it. Some of the most popular Multi factor Authentication examples include swiping a card and entering a PIN, logging into a site with additional phone numeric confirmation, and many other similar examples. Companies, like Google and Microsoft, have gone even further and created pushed verification notifications, and Hideez introduces a hardware security token . This saves the user from typing in the code when logging into favorite apps and websites. How Does Multi-factor Authentication Work? Now that we understand the concept of MFA technology , let's take a look at how this system works in practice. MFA is an authentication method that combines at least a couple of independent identification credentials. Generally speaking, there are three types of multi factor authentication – what the user knows, in the form of a password, and what the user has or is. The latter is crucial to the whole concept of MFA security , as it requires the user to input a unique security token or biometric verification. It's where most hacking attempts fall through, as its highly unlikely that the attacker can obtain a unique security token, let alone any biometric verification data. These three categories leave a lot of options open to create different authentication mechanisms for protecting user information. When creating an efficient MFA system, IT technicians often consider the relative strength of these combined factors, costs, and benefits they bring in combination with each other. Seeing that the costs and security benefits can dramatically differ depending on the mix, each business can custom-create a combination that works best for them and their users. They can also balance security features and convenience to create a user-friendly experience depending on the type of service they provide. Multi-factor Authentication Technologies Several multi-factor authentication technologies go into this security system. We've hinted what most of them are in the previous sections of this page, but here's a detailed rundown of each one: Security tokens – These technologies are the hardware part of MFA. They are the most common type of MFA technology out there and can be in the form of a smart card, USB drive, or wireless keychain, like Hideez Key 3 . Soft tokens – Opposite to security tokens, soft tokens are software-based apps that serve to create single-use PIN verifications. They are most commonly used for mobile MFA. Biometric authentication – This type of MFA technology relies on the "who you are" part we mentioned before. It can include fingerprint scans, retina and iris scans, facial recognition, voice recognition, and other identifying factors that are unique to each person. Mobile authentication and GPS – Most popular MFA variations include phone calls and SMS verification. In the same breath, modern smartphones can also provide location authentication through GPS technology. Benefits of Two-Factor Authentication Multi-factor authentication, also called 2-factor authentication , offers many advantages to the user. Here are some of the most significant benefits of two-factor authentication: Increased security – Passwords are generally considered to be an obsolete system, mainly because the majority of online users tend to choose weak password combinations or reuse the same password for multiple sites. With that being the case, when used with 2-factor authentication , passwords offer increased security levels. Moreover, with the growing popularity of multi factor authentication methods , we could even see the current password system getting replaced completely by MFA technology . Fraud protection – As the number of... - [What is Phishing? Phishing Types and Tips for Prevention](https://hideez.com/blogs/news/what-is-phishing-types-and-prevention-hideez): Phishing is an old and tested cyber-security attack that, to this day, remains #1 cause of data breaches worldwide. Anyone can fall victim to a phishing attack, so it's essential to know how to recognize one. What is Phishing? The phishing definition describes this type of activity as a deceitful use of electronic communication services to defraud online users. Phishing emails are created with one sinister purpose in mind – to deceive the user and get a hold of his sensitive and valuable information such as credit card data, social security number, passwords, and other private details. Phishing scams are very popular among hackers, as they don't require too much effort and resources and can target a large base of online users. While this type of fraudulent behavior does sound menacing, not all phishing scams are the same. Most phishing emails are relatively easy to recognize at face value, even if you're not a cybersecurity expert. They are usually poorly written, with bad grammar, often urging you to act fast or offering you a deal that's too good to be true. But, there are more organized cybercriminal groups that use very effective phishing email hooks that generate high click-through rates. In either case, it's necessary to know as much as you can about this topic. That's why, in this post, we will go over the most common types of phishing attacks , as well as the best phishing email prevention measures. Types of Phishing Attacks As security experts continue to educate online users on how to prevent the most common phishing attempts , new phishing scams also keep coming out. With that in mind, it's important to be aware of some of the most prevalent types of phishing attacks currently circulating the internet. Spear Phishing Attacks Spear phishing is an electronic communications scam or an email targeted towards a specific individual or organization. It's mostly known as the latter and is primarily used to steal valuable data from the user's device or infect the device with malware. The way this form of scam works is quite simple. The hacker sends an email to the target posing as a trustworthy source. The unknowing user then opens the email infected with a malicious link , which leads him to a fake website filled with malware. Spear phishing is one of the most common phishing tactics among hackers. One of the biggest and best-known spear phishing attacks was on Epsilon back in 2011. The company was one of the largest email service providers at the time of the spear-phishing incident, which exposed valuable information of over 50 top companies that used the service. Whaling Attacks Whaling attacks, also known as CEO fraud, are phishing attacks aimed explicitly at executives and senior business partners within an organization. The main objective of whaling attacks is to steal large amounts of money or obtain sensitive exec information to authorize fraudulent financial transactions. While you might not think that these types of phishing emails are effective as they target highly-educated and experienced people, they are surprisingly very efficient. Of course, whaling attacks require much more research and are more sophisticated than the types mentioned above, but are also one of the most financially beneficial kinds of scam hackers rely on. Voice and SMS Phishing Although phishing email attacks are by far the most popular methods defrauders like to use, phishing scams can also be carried out over the phone. Through voice phishing or Vishing, the attacker can set up a VoIP (Voice over Internet Protocol) and impersonate familiar individuals to get a hold of valuable private or financial information. Another phone-oriented type of phishing scam is SMS phishing, also known as Smishing. Just like every other form of phishing, in SMS phishing fraudsters pose and mimic known entities in an attempt to leverage the user into disclosing personal information. Pharming Unlike any of the above mentioned methods, pharming completely diverges from the traditional "victim baiting" concept. It is based on DNS cache poisoning, which redirects the user from a reliable website to the fake site set up by the hackers. This way, the user is tricked to input his login details on the fake site, instead of the real one. This technique is not as common as the others but is most often used by attackers who have control of multiple users' systems and can leverage a control system through real and trustworthy accounts. How to Prevent Phishing Attacks This type of malicious activity is carried out through careful planning and taking advantage of different cybersecurity loops. But, to prevent phishing attempts , you will need to have more of a creative than a scientific approach. There are several useful practices you can use in your daily life to prevent phishing attacks . Take advantage of Email Filters Email filters should serve as the first line of your defense. You can set filters to protect against spam and phishing emails by... - [California Consumer Privacy Act 2020. What You Need to Know?](https://hideez.com/blogs/news/ccpa-2020): The California Consumer Privacy Act is effective on January 1st, 2020. This means that, in a little less than two months, California will be the first state to introduce a clear-cut and precisely defined privacy law. Intended to enhance privacy rights and consumer protection for the residents of the state of California, the CCPA takes a broad view of what constitutes private data. Continue reading to learn everything about the CCPA and how it affects your business or personal information. What is the CCPA? Officially called AB-375, the California Consumer Privacy Act was drafted with a purpose to establish protection for a subset of US citizens against their personal information being harvested and sold without their knowledge. The bill was passed and signed into law on June 28th last year. Often dubbed as "California's GDPR", this California data privacy law promises to bring the much-needed changes when it comes to data security and consumer privacy protection. While the California information privacy act applies only to businesses that sell goods or services to California residents, its application outside the US could drastically speed up the worldwide spread of similar legislation. Of course, since this California data security law is created for a different location than the GDPR, there are a couple of essential differences between the two. The main difference is the overall scope and territorial reach of each law and the definitions related to protected data. Taking a look at the more specific characteristics, another significant difference between the two laws is that the CCPA, in some cases, only considers information provided by the users, while GDPR always covers all personal data regardless of the source or whether the information was public. This makes GDPR a much broader law than the CCPA. Which companies does the CCPA affect? The California data protection law clearly defines which type of businesses it applies to. The law affects every company which does business in California, and the only way to opt-out of it is to go out of business. This act will be enforceable on every company that deals with Californian consumers and meets at least one of the three following CCPA requirements : Has annual gross revenue in excess of $25 million; Has a database of 50,000 or more users, households or devices; Derives more than half of its yearly revenue from selling users' data. In addition to these three thresholds, California privacy policy requirements state that every organization is required to "implement and maintain reasonable security procedures and practices" to ensure the protection of user data. Any business which falls under one of these categories and fails to comply with the CCPA requirements could suffer the following sanctions and remedies: Fines up to $7,500 for each intentional violation, and up to $2,500 for each unintentional violation; Companies, associations, activists, and others can exercise their right to opt-out on behalf of California residents; Companies that suffer data theft or similar security breaches can be ordered to pay statutory damages or actual damages, whichever is greater. With such regulation, even some big businesses could have trouble with the California online privacy protection act compliance legislation. Companies like Facebook and Google, whose entire business models rely on collecting personal information, could greatly suffer if just a fraction of their users start demanding to see and delete the information they've collected on them. Facebook, in particular, has faced severe backlash over the years, and it will be thought-provoking to see how the platform will deal with the upcoming legislation. A simple way to prevent data breaches and resulting fines for non-compliance is to use Hideez Enterprise Solution . Our straightforward security features comply with the CCPA, and include phishing prevention, centralized credential provisioning and de-provisioning of ex-employees, and more. Our All-in-one Identity and Access Management Solution makes sure that only authorized users can access sensitive data. Minimize human factor without complicating everyday routine of your employees. What data does the CCPA cover? From what we've learned so far about the California privacy policy requirements , we can say that this upcoming regulation can be summed up in the definition "personal information that identifies or could be linked to California residents or households." To fully comprehend what this means, we also have to know what the term "personal information" covers. In the current form of the CCPA, this phrase includes: Individual identifiers like real name, address, social security number, driver's license, passport number, IP address, email address, or any similar unique identifier; Commercial information like records of services, products of personal property purchased, obtained, or considered; Online or Electronic Network Information including search history,... - [What is HIPAA Compliance? HIPAA Requirements 2020](https://hideez.com/blogs/news/what-is-hipaa-compliance-hipaa-requirements-2020): HIPAA is a legal act that establishes the rules for patient information protection. It makes it possible for healthcare patients to control their sensitive information and rely on organizations, which are required to implement standardized patient privacy and security structures. But, even though it has been around for quite a while, its rules, requirements, and security standards aren’t something many people are familiar with. Continue reading this page and get all of the information on HIPAA compliance rules, violation penalties, and other important details in the HIPAA checklist . The HIPAA Privacy and HIPAA Security Rules The Health Insurance Portability and Accountability Act was drafted first and foremost to modernize the way personally identifiable healthcare information should be electronically transmitted, maintained, and secured. It was passed in 1996 and has since been a critical standard of every healthcare compliance audit checklist . As a technology-neutral law, HIPAA has aged well during its existence and has remained unaltered despite the rapid advancements brought by the Internet in the past two decades. In its core, HIPAA is a legal act comprised out of rules, which set the primary compliance requirements. The two most important rules included in this act are the HIPAA Security Rule and Privacy Rule. What is the HIPAA Security Rule ? The HIPAA Security Rule was first introduced in 1998 and has gone through several amendments since it was first approved. When it was first drafted, modern smartphones weren’t yet on the market, and the first social media platforms were just coming up on the internet. With that in mind, it’s understandable that the HIPAA risk assessment checklist was updated significantly to stay up to date with the ever-evolving society. Despite that, most of the original language used in the first HIPAA Security Rule has stayed pretty much the same over the years. What is the HIPAA Privacy Rule? The Privacy Rule was first enacted in 2003. Unlike the HIPAA Security Rule , which sets the basic security standards, the Privacy Rule sets specific limits regarding the use of sensitive patient information without the authorization by the patient. The Privacy Rule is an essential part of HIPAA, as one of its main purposes is to guarantee the patients the right to obtain a copy of their health records and request any needed corrections. With over 400 pages on the Federal Registry, it ranks highly on the HIPAA risk assessment checklist . Whom Does HIPAA Apply to? HIPAA applies to all healthcare providers, health plans, and healthcare information centers if those organizations send health information electronically with transactions. To have a complete understanding of everyone and everything included in these three categories, let’s examine each of them in more detail: Healthcare Providers – Hospitals, clinics, doctors, dentists, nursing homes, pharmacies, psychologists, and chiropractors. Health Plans – HMO’s, company health plans, government programs (i.e., Medicare, Medicaid), health insurance, and veteran’s health programs. Healthcare Information Centers – entities that process non-standard health information for healthcare organizations. Any organization that falls in one of the categories above is required to comply with the HIPAA compliancy rule checklist. Covered entities that fail to comply with the HIPAA checklist can face harsh financial and criminal penalties that can go up to $250,000 and ten years in prison. With all of this said, it’s necessary to keep in mind that not all healthcare organizations are required to meet HIPAA compliance. This act only applies to organizations that transfer protected health information for transactions that the HHS has adopted standards. This is a vital aspect of HIPAA, and all patients should be aware of before sharing any sensitive health and personal data. HIPAA Breach Notification Rule To-Do The detailed HIPAA checklist includes precise breach notification requirements covered entities must meet in case of such a situation. The list includes the following actions: Individual Notice – The company must notify all of its affected individuals after the discovery of a breach of poorly protected information. These notifications must be sent without any unreasonable delay, and no later than 60 days following the discovery of a breach. The individual notice also draws a set of user protection options, including a toll-free phone where individuals can get helpful information and advice on what to do to avoid any further potential harm. Media Notice – Covered entities that face a breach that affects more than 500 residents of a single jurisdiction or state must also provide a notification to prominent media outlets operating in that jurisdiction or state. Just like the previous notification, the media notice must be provided within a reasonable period, no later than 60 days. Notice to the Secretary – In addition to the first two notification... - [What is CCPA and How to Become Compliant?](https://hideez.com/blogs/news/what-is-ccpa-and-how-to-become-compliant): The California Consumer Privacy Act, also known as CCPA, becomes effective on January 1, 2020. Due to this upcoming legislation, the Internet has been flooded with California Consumer Privacy Act news, most of which have only partially covered the California Consumer Privacy Act applicability, rules, and possible penalties. It has prompted us to create a detailed guide on this act and provide you with every piece of information you should know before it takes effect. What will the CCPA Accomplish? The purpose of the California Consumer Privacy Act is quite simple. Its main goal is to secure personal information of individuals by obliging businesses to collect their consent before gathering or processing any sensitive or personal data. According to the broad consensus, the California Consumer Privacy Act will change the way businesses think about user data. This regulation will be the first consumer right to privacy act California has passed and can be a big step forward to ensuring data protection across the board, as numerous other states have also started working on their data regulations. Is CCPA the California version of the GDPR? If we were to make a direct California Consumer Privacy Act and GDPR comparison, there are some fundamental similarities between the two. Both laws are centered around the way personal information is processed. Both the California Consumer Privacy Act and the GDPR are created to protect individuals, and these acts apply to anyone who does business within each law’s sphere of control. While there are a couple of core similarities between the two, in some cases, they serve to highlight the differences. As the broader of the two, the GDPR also covers legal bases and principles of personal data processing, specific data security measures, and codes of conduct. On the other hand, unlike the GDPR, the Consumer Privacy Act requires businesses to regularly publish up to date information on their personal information trading practices and to specifically allow individuals to opt-out of the sale of personal data. With all of this in mind, in a lot of ways, the Consumer Privacy Act is California’s version of the GDPR. It openly resembles the European law in some important segments, but ultimately differs from it regarding some personal information requirements. What should a CCPA-compliant Privacy Policy Contain? This part of the California Consumer Protection Act will probably be the most difficult one for business to fulfill simply because it includes many different conditions that they need to meet in to be compliant with the CCPA. With that being said, the California Consumer Privacy Act text does include all of the information you need to use to ensure compliance. Here’s a quick California Consumer Privacy Act overview: CCPA Consumer Rights – the Consumer Privacy Act clearly states all of the consumer privacy rights. More importantly, the consumer privacy definition specifies that consumers have the right to access personal information. They can do so for free, twice a year. Requesting Access and Deletion – This requirement of the CCPA builds on the first provision by providing users with a reliable channel through which they can access and request the deletion of their personal data. It includes a web page and a toll-free number. “Do not Sell My Information” Page – Consumer Privacy Act compliant businesses that sell their users’ personal information must provide a web page through which users can opt-out of having their personal data sold. Categories of Collected Personal Information – Every business must provide a detailed list of categories of personal information they’ve collected over the previous twelve months. It includes personal data identifiers, employment, and education information, protected legal characteristics, and other categories of personal information listed in the California Consumer Protection Act. Sources of Personal Information – In addition to informing their customers what type of personal data they collect, The California Consumer Privacy Act also orders businesses to disclose their sources of personal information. To be more precise, the Consumer Privacy Act dictates that companies must only list the categories of sources, not name the source directly. Reason for Collecting Personal Information – Consumer privacy laws also dictate that businesses should tell consumers the purpose of collecting their personal data. This California Consumer Privacy Act provision is a considerably standard clause that is already set in many Privacy Policies. Personal Data You’ve Sold – If a business deals in selling personal information, it is required to list all of the categories of personal information it has sold in the past year. Personal Data You’ve Disclosed For Business Reasons – Finally, yet importantly, the CCPA Consumer Credit Protection Act requires every business to list every category of personal data it has disclosed for business reasons. The Consumer Privacy... - [What is Zero Trust Security? Successful Zero Trust Implementation](https://hideez.com/blogs/news/zero-trust-implementation): Zero Trust architecture has experienced a meteoric rise over the past couple of years, and it became a go-to choice for many organizations looking for a reliable security system. This model was first presented in 2010 but gained wide attention a few years later when Google announced that it had implemented this security concept into their business. Despite gaining popularity among big and small companies, Zero Trust model remains relatively unknown among average Internet users. That’s why, before we dig deeper into its security model and implementation of this security system, we must understand what Zero Trust is. First, let’s take a glance at the history of network security. It has taught us that security systems like Zero Trust provide reliable safety regardless of the size of a company. Massive breaches at the start of this decade proved that the existing perimeter security systems were obsolete and unable to provide maximum security to both users and companies. So, what is Zero Trust? In simple terms, the Zero Trust network architecture is a model that allows a user to identify a specific “protection surface.” This surface can include particular aspects of a network’s most crucial data, apps, or services. It is a strategy that removes the concept of trust from a company’s security structure. Based on the “always doubt” principle, Zero Trust is created in a way to protect modern digital networks without sacrificing user experience and control. What is a Security Model? The Zero Trust security model stands on three core values: Easy access to all devices despite their location Bottom-up least privileged strategy and strict control Strict monitoring of the ecosystem Judging by these three primary values of Zero Trust security, we can say that this security method requires no changes to existing security measures. Instead, it’s based on the familiar security model upon which most security policies operate. And, when we look at this from the definition of a security model, this makes perfect sense: “A security model is any computer model that’s used to identify and impose security methods. It is a framework on which specific company policy is developed”. While this definition was created years before Zero Trust security, it still applies to this security system, making Zero Trust the most successful example of a network security model to date. The Technologies behind Zero Trust The main philosophy behind Zero Trust security is to presume the network is susceptible to attackers from both within and outside. In line with this, the principle of Zero products is to assume that no user or device should be automatically trusted. Following that, Zero Trust security applies a so-called “least-privilege” access model. It means that the user only gets the minimum level of access he needs. This need-to-know basis minimizes the user’s potential exposure to the parts of the network which contain sensitive information. Besides limiting access to users, Zero Trust does the same when it comes to devices. Zero Trust model should monitor how many different devices are trying to access the system, and make sure that every device is authorized, regardless of the user’s previous activity. Another essential aspect of Zero Trust is Multi-factor authentication . We’ve touched on this topic a few weeks back when we talked about all the benefits MFA brings to its users. To recap it in a few short sentences, MFA requires a user to enter more than one piece of identification when logging into the network. The most popular examples of this are platforms like Google and Facebook, which require the user to enter both the password and code sent to another device, usually to a specific mobile phone number. The way Zero Trust works means that it is not dependent on a particular location. It has positive and negative sides. The positives are that users can access the data from anywhere: work, home, coffee shops, or even abroad, as long as they verify their identity when logging in. The negative aspect of this falls on the company, and it comes in the fact that the Zero Trust method must be spread across the company’s entire network environment. All of this also means that the workloads are highly dynamic and can move across multiple data centers, regardless if they are public, private, or hybrid. Should Zero Trust Companies Really Trust No One? While Zero Trust security has proven to be a very successful network protection model, many security experts suggest that it could operate in a slightly different way. Instead of rejecting all sites, experts suggest that Zero Trust should whitelist trusted and known websites. However, as of now, it is highly unlikely that it would happen, mainly due to two reasons – creating such a system won’t reduce the company’s workload by a significant margin. Moreover, it would increase the potential risk of infiltration through legitimate sites, as malicious ads or malware can infect even trusted sites. The... - [Cybersecurity Best Practices for Employees](https://hideez.com/blogs/news/cybersecurity-for-employees): Cyber attacks are responsible for tens of billions of dollars worth of damages just in 2019. And, employees are, by a long way, the biggest cybersecurity risk for every business operating today. Since staff members can fall victim to many different security threats, companies can never be secure enough when it comes to safeguarding their sensitive information. Continue reading to find out the best practices for employees and how to implement them to improve employee cybersecurity awareness going into 2020. Ways to Achieve Employee Cybersecurity While we tend to think of cybersecurity criminals as some super-sophisticated hackers that can penetrate any security system with little effort, the truth is far more simple and far less glamorous. The biggest reason why most employees fall to cyber attacks is that they are not educated enough on what they should and should not be doing at their workplace. While nowadays every person should possess basic cybersecurity knowledge to get around in today’s world safely, ultimately, it falls on the company itself to educate and protect its staff from any security threats lurking online. The most efficient cybersecurity employee awareness tactics include: Cybersecurity quizzes for employees Cybersecurity employee questionnaire and security flyers Cybersecurity employee education graph charts These three tips are the most essential and simple ones you should go by every so often, especially if your business experiences a constant influx of new employees in need of cybersecurity education. Of course, if your company also employs remote workers, you need to make sure that you include them in these activities as well and create specially-focused seminars that focus on cybersecurity topics for employees working off-site. With this in mind, you should also remember that remote employees most often face more security challenges than their on-site colleagues. Biggest Employee Cybersecurity Risks As we’ve learned so far, the lack of cybersecurity training and knowledge can do a lot of damage to a company. That’s why it’s essential to be aware of all of the security threats out there. Here are the biggest cybersecurity risks your employees must be conscious of at all times: Unsecured Networks While most privacy and security-conscious online users are aware of all of the risks involved with using an unsecured network, not all of your employees might have the same level of awareness. To put it simply, unsecured networks don’t encrypt the data that goes through them. It means that anyone with a little skill can access any piece of social media, email, or any other information passed through the network. Accessing any personal and financial data is a risk not worth taking on such a network, regardless if it’s a public, work, or personal one. Phishing Emails Aside from the issue of unsecured networks, the vast majority of security breaches come from phishing emails. Over two-thirds of employees who fall victim to cybersecurity attacks fall to phishing emails. Most often, these types of breaches happen when a company employee clicks on a link within an email that leads him to a fake website controlled by the attacker. Employees are then led to share sensitive personal information that can cost both them and their company an arm and a leg. Fake Apps and Programs There are hundreds, even thousands of fake apps being uploaded on the internet every day. While most sites and platforms that feature apps do check every product before featuring it, sometimes it can happen for a malicious program to slip through the cracks. The simplest way to check if an app is harmful is to read through the online reviews and download them only from the official, secure site or a certified source such as the Apple Store or Play Store. Out of Date Software System updates mostly go on by themselves, and you don’t need to do anything besides confirm them and let them work in the background. But, a common mistake that many people make is to avoid regular updates or delay update notifications. While regular security update pop-ups can be annoying, they can make a huge difference in overall security. Not only do they help programs work better, but they also often include new features that improve your device’s security capabilities. How to Maintain Low Cybersecurity Employee Risk If you’ve implemented all of the security tips we’ve talked about above and educated your employees on all of the potential security risks, you’ve made great strides into ensuring maximum employee cybersecurity awareness. With that said, to maintain high-security standards and ensure that the company accepts a long-term culture of employee cybersecurity education, you also have to establish an effective solution for continued support. It can be done in several ways: Regular training and clear communication – Clear communication is the key to every relationship, and its value should never be underestimated. The best way to maintain it with... - [Passwordless Authentication: The Complete Guide to a More Secure Future](https://hideez.com/blogs/news/passwordless-authentication): Passwordless authentication fundamentally changes how we verify identity. It replaces vulnerable shared secrets with stronger, more user-friendly methods like biometrics and cryptographic passkeys (FIDO2). This shift delivers truly phishing-resistant security and a seamless login experience. A modern, unified authentication platform is the key to deploying this robust, password-free access across your entire organization. This guide provides the definitive roadmap to making that transition a reality. Why the World is Moving Beyond Passwords The Inherent Security Flaws of Passwords (Phishing, Breaches, Credential Stuffing) Passwords are the primary target for attackers because they represent a single, stealable point of failure. They don't prove identity, only knowledge of a secret that is fundamentally vulnerable. Phishing : Malicious actors trick users into revealing their credentials on fraudulent websites, gaining direct access. Breaches: Stolen password databases are routinely sold on the dark web, exposing millions of accounts at once. Credential Stuffing: Attackers use automated scripts to test breached credentials across countless other services, exploiting password reuse. Did you know? "Over 80% of hacking-related breaches are linked to compromised credentials." - Verizon Data Breach Investigations Report Implementing an enterprise-grade, FIDO2-certified authentication platform from a trusted partner like Hideez makes these attack vectors obsolete by removing the vulnerable credential itself. The User Experience Problem: Password Fatigue and Friction Users juggle dozens of complex password requirements , leading to frustration, forgotten credentials, and risky behaviors like writing passwords down or reusing them. This constant friction degrades the user experience for both customers and employees. A seamless biometric or security key login not only delights users but also strengthens security, turning a point of friction into a competitive advantage. The Hidden Costs for Businesses: Helpdesk, Lost Conversions, and Compliance The financial drain of passwords extends far beyond security incidents. The operational overhead is significant, impacting helpdesk resources, customer acquisition, and regulatory standing. Metric Legacy Password Systems Modern Passwordless Platform Helpdek Costs High (constant password resets) Drastically reduced User Conversion Lower (login friction, drop-offs) Higher (seamless, instant access) Compliance Risk High (violates NIST, GDPR guidance) Simplified (strong, verifiable auth) Ready to eliminate these hidden costs and secure your enterprise? Book a demo with the Hideez experts to design your passwordless strategy today. What Is Passwordless Authentication? A Clear Definition Passwordless authentication is a method of verifying a user's identity without requiring them to enter a knowledge-based secret like a password or PIN. Instead of asking "what do you know?" , it asks for proof of "what you have" or "what you are." This approach fundamentally shifts the security model away from vulnerable, static secrets toward dynamic, possession-based, and biometric credentials, making phishing and credential stuffing attacks significantly more difficult. The Core Principles: "Something You Have" and "Something You Are" Passwordless authentication replaces the password with stronger, verifiable factors. It operates on two core principles: Possession ("something you have"): This includes a physical hardware token , a registered smartphone, or a laptop with a secure cryptographic chip. The system verifies that the user is in possession of this trusted device. Inherence ("something you are"): This refers to a user's unique biological traits. Biometric authenticators like fingerprints, facial recognition, or palm scans provide a highly secure and convenient way to prove identity. The credential is no longer a secret to be stolen, but a physical or biological trait to be verified. Passwordless vs. Multi-Factor Authentication (MFA): Understanding the Difference The distinction is crucial. Traditional Multi-Factor Authentication ( MFA ) adds a second factor to a password (e.g., password + SMS code). It strengthens a weak link but doesn't remove it. Passwordless authentication replaces the password entirely with one or more different factors. One is an enhancement to an old system; the other is a fundamental replacement of the primary credential, eliminating the password as an attack vector. The Ultimate Goal: Achieving Passwordless MFA The ultimate objective is Passwordless MFA. This combines at least two distinct passwordless factors - such as using a fingerprint (inherence) on a registered device (possession) - to grant access. This model provides the robust security of multi-factor authentication without relying on any password. By implementing a solution that unifies these factors, organizations can eliminate the single greatest point of failure in enterprise security. This is... - [NYDFS Cybersecurity Regulation & NYDFS Compliance](https://hideez.com/blogs/news/nydfs-cybersecurity-regulation-nydfs-compliance): The NYDFS Cybersecurity Regulation is a set of regulations from the New York Department of Financial Services. This legislation places cybersecurity requirements on all financial institutions that operate in New York. It stipulates that all DFS-regulated companies should have cybersecurity plans, policies, and maintain detailed reporting systems for cybersecurity events. The primary purpose of this regulation is to protect sensitive private information that can be used to identify individuals. Continue reading this page and learn the most important aspects of the NYDFS Cybersecurity Regulation, covered financial institutions, and penalties for non-compliance. Who are Covered Entities under the NYDFS Cybersecurity Regulation? When it comes to entities under NYDFS, this legislation precisely defines all of the subjects that fall under this regulation. The NYDFS list includes the following types of businesses: State-chartered banks Private bankers Licensed lenders Insurance companies Service providers Mortgage companies Foreign banks with a license to operate in NY If we do a quick rundown of this list of entities under NYFDS, we can see that the covered financial institutions include all individuals, groups, or corporations that legally operate under New York financial service laws. This list covers only the broad categories of businesses, but you can find a complete and detailed list on the official DFS website. With this said, there are exemptions to the NYDFS Cybersecurity Regulation, which include: Companies with less than ten employees; Companies with gross annual revenue of $5 million or less from their New York operations in each of the previous three years; Businesses with less than $10 million in year-end assets; Charitable and foreign risks groups that operate in New York. What are the key components for the NYDFS Cybersecurity Regulation? Just like the widely-known GDPR, the NYDFS Cybersecurity Regulation was implemented in several phases to allow every company to develop an effective incident response plan for all possible cybersecurity events. There were a total of four stages in the NYDFS Cybersecurity Regulation regulation implementation: The First Phase - The first phase came into effect on February 18th, 2018. It covered practices such as capacity and performance planning, the security of information systems, systemic and network security, and periodic risk assessment, among other provisions. Covered entities must report any data breaches that have a reasonable likelihood of causing material damage. The Second Phase - The following phase went into effect on March 1st the same year. It focuses mostly on Chief Information Security Officers, of whom it requires to prepare annual reports that include the company's cybersecurity policies and procedures, the effectiveness of current measures, and possible cybersecurity risks. The Third Phase - Implemented on September 3rd, 2018, the third phase was focused on the functionality of the cybersecurity programs of covered entities. By the end of the third phase, every business should maintain a detailed database of their audit trails and records. The third phase also requires all covered entities to continue evaluating vulnerabilities, invest in data security, and create defensive infrastructure under the previously completed risk assessment tests. The Fourth Phase - The fourth and final phase went into effect on March 1st, 2019. By this date, covered entities should meet all of the above-mentioned cybersecurity requirements and have adequate privacy practices set in place. They should also develop a written risk management policy and include a third-party risk assessment framework. Aside from the measures covered in the four phases above, there are also some additional requirements. These include multi-factor authentication for all covered entities, penetration testing for risk assessment, usage of the principle of least privilege, and use of qualified and continuously trained cybersecurity personnel. How does the NYDFS Cybersecurity Regulation Work? The four phases we listed above cover the entire process every business must undertake. To put it simply, the NYDFS Cybersecurity Regulation requires every organization to do a risk assessment and develop an incident response plan for various cybersecurity events. This includes, at a minimum, the following specific aspects: Risk Assessments - Conducted periodically to assess the integrity, security, confidentiality, and availability of the company's IT infrastructure and Personally Identifiable Information. Audit Trails - Records will have to be maintained for five years. Their primary purpose is to record and respond to cybersecurity events. Limitations on Data Retention - Companies are required to develop procedures for secure disposal of Personally Identifiable Information that is no longer necessary for business purposes. Incident Response Plan - Create written plans and document internal processes... - [Secure Remote Work during a Pandemic. Best Authentication Tips](https://hideez.com/blogs/news/secure-remote-work-during-a-pandemic): What do you do at times like these, when a pandemic is wreaking havoc on the work environment practices? Many companies, including tech giants like Microsoft, Alphabet, Facebook, and Apple, have begun urging employees to work from home. However, when employees are working remotely at times of crisis, it’s much harder to institute sound network-based authentication practices. Not only network telemetry checks become problematic, but there’s also a dramatic increase in phishing and other breach attempts as cybercriminals are increasingly seeking to profit off the coronavirus panic, filling the information void to trick people and steal their data. How do you protect your organization from such attacks? Here are some basic tips you may use to ensure a productive workflow without compromising security: 1. Recognize and avoid phishing scams Over two-thirds of employees who fall victim to cybersecurity attacks fall to phishing emails. Most often, these types of breaches happen when a company employee clicks on a link within an email that leads him to a fake website controlled by the attacker. During a crisis like this, cyber-criminals are on the lookout for new phishing opportunities, knowing full well that people are rattled by the panic and are likely to open emails or click on sites that are promising relevant information. Here are some useful articles about newly designated coronavirus phishing scams: Coronavirus Scam Alert: Watch Out For These Risky COVID-19 Websites And Emails Coronavirus Scam Alert: Watch Out For These Risky COVID-19 Websites And Emails Hackers Posing as CDC, WHO Using Coronavirus in Phishing Attacks There are multiple steps a company can take to protect against such attacks. First of all, it is necessary to educate your employees about phishing tactics and encourage them not to open suspicious emails. Let’s consider some of the main additional recommendations briefly: Set email filters to protect against spam Hover over the link attachment to check SSL credentials (secure sites use SSL encryption, meaning that their addresses begin with HTTPS instead of HTTP.) Adjust the browser settings to prevent malicious link attachments 2. Use enforced MFA wherever possible Multi-Factor Authentication is a combination of authentication factors that provide additional protection for your accounts. If you’re a business that interacts with other companies online regularly, MFA can protect the most sensitive data, such as financial and personal information, and massively reduce the chance of it leaking into unwanted hands. Multifactor authentication encompasses a wide range of authentication technologies, such as biometrics, smartphone apps/codes received via text messages, or wireless security tokens, which will provide an additional layer of security. The services that offer and recommend different types of MFA are Apple (iCloud and other services), Google (Gmail and other services), Microsoft Office 365, Yahoo!, PayPal, Dropbox, Facebook, Twitter, Instagram, LinkedIn, Snapchat, Tumblr, etc. All you need is to adjust the necessary account settings. 3. Enforce your employees to use strong passwords People are not very creative when it comes to generating passwords; they commonly use their date of birth, address, phone number, social security, car’s registration number, mother and father’s name, etc. According to NIST recommendations, IT systems should allow a minimum of 8 characters and a maximum of 64 characters and include all kinds of characters, including lowercase and uppercase letters, numbers, punctuation, and spaces. Such types of passwords are more difficult to decipher from a cryptographic standpoint. However, the National Institute of Standards and Technology recommended dropping complex passwords and using multifactor authentication (MFA) instead. If you’re looking for more protection for your company, you can use a multifunctional security device such as Hideez Security Key , which can help cope with all the above tasks efficiently and with no extra efforts. It represents a good solution as it’s an administrator controlled password and security key device, with built-in phishing protection via the resource/password vault. Hideez can act as 2nd-factor authentication for company employees and keep about 1,000 accounts per device. A couple of simple customizations and that's it! All of the workers` credentials are safe and sound, and authentication works in the background. To learn more about the device – check out Hideez Key features & specifications or schedule a free demo: SCHEDULE A DEMO - [Save Time To Save Lives. Security Tools for Healthcare in the Time of Crisis](https://hideez.com/blogs/news/healthcare-security-amid-covid): Doctors and nurses are leading the fight for human lives amidst the coronavirus outbreak. Once again, they rise to the challenge, providing help for those in need, and giving hope to others. What they need right now is time. Time to treat current patients and time to get ready for the new ones. As individuals and companies, we can buy them some time by washing hands, staying at home, and practicing social distancing. In reality of the pandemic, hospitals have to do more with less. To maximize the time they have, they need to review and optimize all of their processes. One of the biggest complaints of doctors and nurses is the time they spend logging into various systems. As doctors and nurses move between patients and rooms, they often need to switch between workstations wasting time on multiple logins. What if they could log in faster? In just 3 seconds. What if they could enter their login and password automatically? No more typing and re-typing in case of a mistake. What if they could forget their passwords and not have to call the IT administrator to restore it? What if they could click on any link and remain protected from phishing? What if they could rush away from their computer, and it would lock automatically to safeguard patients' health data (ePHI) and comply with HIPAA? What if they could get it all in one solution? The good news is that they can have it all. Hideez developed a solution that allows hospitals to increase employee productivity without overwhelming them with complicated technology. They just need to do their work as usual and press one button to log in. In the time of a crisis and beyond, medical professionals can focus on their patients, while we as cybersecurity professionals take care of them. Learn how Hideez can support your organization by filling up the form below. In a spirit of solidarity we offer our solution to the hospitals for free for one year*. * Excludes hardware - [Wireless Electronic Signature “Almaz-1K”: convenience and safety in your pocket](https://hideez.com/blogs/news/almaz-1k): Hideez Group, together with the Institute of Information Technologies JSC, presented a new tool for secure data storage - the Almaz-1K electronic key, which supports Bluetooth wireless technology. More and more services are moving online. Thanks to an electronic digital signature, you can confirm your identity on the website, remotely manage electronic document management, and even register a new business. A qualified electronic signature is considered similar to a paper version with a regular signature, and therefore is used without additional consent between representatives in electronic communication. The software development company Hideez Group, together with JSC Institute of Information Technologies, has launched a new product for Ukraine - an electronic key, which allows not only to safely use a personal key and store data, but also to generate an electronic signature via a secure Bluetooth channel. The main difference between the new tool and the previously existing Almaz-1K is the replacement of USB with a built-in Bluetooth wireless communication module, to which other devices can now be connected. The main advantages of Almaz-1K: mobility and versatility of use; fast user authentication; use on mobile devices with iOS and Android operating systems; generation of personal and public keys of electronic signature; storing private keys in internal memory, which protects data from unauthorized access. “For the Ukrainian market, our device has unique functions, including compatibility with the iOS and Android mobile platforms, as well as the Windows and MacOS operating systems. With one Almaz-1K electronic key, you can store up to five personal keys and easily connect to different gadgets within range of the Bluetooth signal. This is convenient, since you no longer need to insert the key into the USB port and be afraid of forgetting it there,” commented Oleg Naumenko, head of Hideez Group. “We believe that the new product will be in demand among users of electronic document management on mobile devices and other software systems. Now, to work with a personal electronic signature key, you do not need a USB port, which not all gadgets have. Users of stationary workstations and laptops with a limited number of USB ports will also be able to appreciate the convenience and versatility of the product,” added Viktor Onoprienko, General Director of the Institute of Information Technologies JSC. You can learn more about the product at https://iit.com.ua You can order a sample device for testing and review here sales@hideez.com - [[Webinar] Revolution in authentication Fast Identity Online. Technology that will change the world](https://hideez.com/blogs/news/fast-identity-online-webinar): Speakers: Oleg Naumenko, Yuriy Ackermann Topics discussed: 🔺Passwords must die! What in return? - Yuriy Ackermann 🔺Hideez wireless digital key as a universal authenticator - Oleg Naumenko 🔺 The magic of passwordless authentication Fast Identity Online, how to get rid of smart cards? - Yuri Ackermann 🔺 Case studies of Fast Identity Online - Oleg Naumenko 🔺Questions and answers - [ How to Secure your Accounts in 2022? Top Online Security Tips ](https://hideez.com/blogs/news/online-security-tips): 2021 is finally behind us, but the troubles it brought along have spilled over into the new year as well. The ongoing pandemic shifted how we operate and significantly accelerated the switch to remote work. With this, it also brought a long list of online privacy and security concerns. And, although there’s no telling when the Covid-19 pandemic will die down, one thing is certain – the post-COVID world will not be the same. The crisis introduced us to a series of cybersecurity challenges for which most online users haven’t been prepared. If you want to start the new year right, read our cybersecurity predictions and best tips on how to secure your accounts in 2022. What are the Main Threats to Online Security? As the Covid-19 pandemic has shown us, cybersecurity trends are often a mix of old scams and new techniques. That’s why, to enhance our online security, we must first understand the latest cybersecurity trends. With that in mind, here is the list of the main threats to online security: Increase of Spear Phishing Campaigns – One of the more worrying cybersecurity trends is the apparent increase of automated phishing . Automation means that phishers can send many more emails and dramatically increase the number of potential victims. Rising Concern over Smart Device Security – From the mobile phone you’re holding in your hand to your car and many other devices in your household, smart devices have become a significant part of our everyday lives. The algorithms are getting more complicated year after year, invading more of our privacy than ever before. With this, so rise the concerns regarding account security and protecting private user information stored in your account. Increase of Attacks on Accounts Without MFA – We’ve seen this occur already in 2021. Many users still fail to add strong Multi-factor Authentication (MFA) and hackers regularly take advantage of this. Moreover, no service or website is safe from potential security breaches if it doesn’t have Multi-factor Authentication set up for its valuable data. Hacker Attacks Aimed at VPN Servers – Virtual Private Networks have become prevalent tools for obtaining online privacy and anonymity. That said, we can expect a significant increase against VPNs and remote servers. This is because many businesses have switched to using VPNs for their daily operations. Hackers have realized that by cracking through the VPN encryption, they get free access to valuable financial info, credentials, and exploit the network. How to keep your accounts secure? Fortunately, making your devices more secure and less prone to breaches is not that difficult, even if you are not that tech-savvy. Let’s take a close look at the most effective methods of how to increase your account security and protect valuable data: Close the Accounts you’re Not Using – If you have any accounts or apps, you don’t use anymore, close and delete them from your devices. It’s also always a good idea to do an occasional app check and update permissions to apps you don’t use regularly. Use Unique Passwords – Stealing data through obtaining a username and password combination is still the most common practice among hackers. The most effective way you can prevent data breach incidents is to use a strong and unique password for every account and profile. Probably as equally as important, make sure to often change your passwords for each of your online accounts. Use Different Emails for Different Accounts – Consider using several different emails for different purposes. For example, use disposable accounts for your social media and keep a personal email address you only use for banking or business. Use MFA – Multi-factor authentication makes your accounts significantly harder to breach. Even if a hacker gets ahold of your password, it will be useless if your online accounts are secured with an MFA device. Notwithstanding the popularity of software tokens, we don’t recommend trusting your second factor to the same device you want to protect (see one of our previous articles for more details ). Turn off the “Save Password” Feature in Browsers – Utilizing the “Save Password” in your browser daily might seem like a convenient way of accessing all of your accounts, but the security risk tradeoff that comes with it isn’t worth the convenience. Try Passwordless Authentication – There is no arguing that passwordless access is the future. The new FIDO2 framework is gradually replacing passwords altogether with a new type of credentials that cannot be stolen. By going down this route, you eliminate the risk that comes with traditional passwords while obtaining a convenient way of accessing your online accounts from anywhere. What are the Benefits of Going Passwordless? – A Close-up Analysis Passwordless authentication is a type of MFA that aims to eliminate traditional information verification systems vulnerabilities. The most significant benefits of passwordless authentication include: A More Intuitive MFA... - [CPRA explained. What does it mean for Businesses?](https://hideez.com/blogs/news/cpra-explained): The CCPA, California Consumer Privacy Act, has been legally enforceable since July 1st of last year. It is the first significant privacy law in the US pertaining to consumer control of personal data. And, even though it hasn’t even been a year since the official legal enforcement of the CCPA started, Californians have already voted for the follow-up act, called the California Privacy Rights Act (CPRA). So, why are these CPPA modifications significant, and how does the CPRA differ from the CCPA? More importantly, how will the changes to the CPPA affect data privacy enforcement? On this page, we’ll discuss all of the new amendments to determine how the CPRA would change the CPPA. What is the New California Privacy Law (CPRA)? In November 2020, the new California Privacy Rights Act was approved by voters 56% to 44%. Although the existing CCPA legislation was supposed to help the state pass a stricter privacy law, the new law brings about more stringent legislation, closer to one of the GDPR than the existing CPPA. The new regulations’ main goal under the CPRA is to toughen privacy requirements and reduce the overall risk in other points stated by the previous law. The new legislation will go into effect on January 1st, 2023, and legal enforcement will begin six months after that. This means that from this point, businesses have two years to prepare for the new legislation piece. CPRA vs. CPPA. What is the difference? There’s a common misconception in the public that the CPRA is an entirely different law, which isn’t the case. The main difference between the old version and the new one is stronger consumer protection and more precise CPRA compliance questions for businesses. With that in mind, this new legislation is an expansion of the existing law. To comply with the CPRA, companies will have more responsibilities than they had under the CPPA. The CPRA is often looked at as the CCPA 2.0. However, if you’ve had the chance to read through the rules and guidelines, you’ll also notice that this legislation draws close similarities with the General Data Protection Regulation (GDPR). It features similar elements that you can find in the GDPR compliance guidelines, although the CPRA requirements and definitions are a bit broader. Differences aside, the crucial similarity between the two that everyone should take note of is that the compliance isn’t only limited to the state of California . It extends worldwide and covers every California resident, regardless of their exact location at the time. If your website doesn’t block California residents from accessing it, compliance is required for it. CPRA enforcement and penalties A new significant change is the introduction of the California Privacy Protection Agency, an independent watchdog organization established by the CPRA. The primary mission of the CalPPA is to ensure businesses and consumers are well-informed about their rights and obligations stated under the CPRA provisions. The CalPPA will replace the attorney general’s office as the main regulatory body controlling CPRA rules’ implementation. As for the penalties, they will be tripled for violations regarding minors under the age of 16 (penalty increased to $7,500). Moreover, consumers’ private right of action will be expanded to cover email address breaches that occurred in combination with a password and security question and answer permitting account access. While all of this might seem overwhelming to take in for the average business owner, companies that have already prepared for the previous law will feel a minimal impact from the new CPRA privacy rules and guidelines. Businesses that are already in compliance with the previous requirements, especially with the GDPR, won’t have to make any significant changes. On the opposite side of the spectrum, companies that haven’t implemented any changes as of yet will have a tough road ahead of them. The most significant alteration businesses will have to make revolves around the minimization of personal information. Under the CRPA, companies will also have to meet more stringent data-sharing requirements. They must offer their California customers the opportunity to opt-out of the opportunity of having their personal information sold to third parties. Of course, this stringent data policy will also result in extra costs for data collection for businesses. Tips to Become Compliant Under the CPRA When news of the CCPA modifications first dropped, many businesses were disturbed by the perceived significant changes to the original CCPA compliance requirements. And, while new legislation brings big and significant changes, these changes aren’t necessarily bad. Businesses that have previously undertaken the necessary CCPA compliance steps are in an excellent position to comply with CPRA requirements as well. Here are some tips that will help you ensure CPRA compliance: Identify all Sensitive Personal Data - The new CPRA rules introduce a new term, “sensitive personal... - [What is a Hardware Token? Hard Tokens vs. Soft Tokens](https://hideez.com/blogs/news/hardware-tokens): Passwords are flawed, and nowadays, obsolete methods of authentication. For this reason, cybersecurity companies have developed more sophisticated authentication methods for ensuring enhanced user security. The most notable examples are hardware tokens, dedicated portable devices that authenticate the user’s identity and prevent unauthorized access. Hardware tokens have been the top security standard in the industry for decades. But, in the past few years, they have been challenged by another means of authentication, software tokens. These tokens are stored on general-purpose devices, eliminating the need for dedicated hardware. On this page, we’ll take a closer look at the forms and types of hardware tokens and how each type works. In the end, we’ll also compare hard tokens and soft tokens to help you decide which authentication method is the better choice for you. What is a Hardware Token? Before we move on to the more in-depth and complex topics, we should first understand what a hardware token is. In simple terms, a hardware token (also known as a security or authentication token) is a small physical device that you use to authorize your access to a specific network. Its purpose is to provide an extra security layer by ensuring two-factor authentication. As the token owner, you connect the hard token to the system you want to enter to get access to its service. Forms and Types of Hardware Tokens Hardware tokens are created with customization and user experience in mind. For this reason, they can come in many forms, most commonly as USB tokens, key fobs, and wireless Bluetooth tokens. Also, there are three main types of hardware tokens. Let’s take a closer look at each: Connected Tokens - In order to access the system with a connected token, you must physically tie it to the system. The way this works is that you slide your hardware security token into a reader. When you do so, your token device automatically pushes relevant authentication information to the system. Common examples of connected tokens include key fobs and USB tokens such as Yubikey. Disconnected Tokens - Unlike connected tokes, disconnected ones don’t require you to physically insert a hardware security token into the system when you want to access it. Instead, you need to set up your device to generate a one-time access code. The most common example of a disconnected token is a phone you set up as a two-factor authentication device. Contactless Tokens - With contactless tokens, you don’t need to connect to a device or enter any access codes. Instead, contactless devices connect with the system wirelessly. Based on the connection’s credentials, the system either grants or denies access. The most noteworthy examples of contactless tokens are Bluetooth tokens and wireless keychains like Hideez Key . How Do Hardware Tokens Work? Knowing the types and forms of hardware tokens, we can better understand how hardware tokens work. To make a simple hardware token example, let’s say that you use your mobile device as your hardware security token. When accessing a system, you first enter a secure and unique password you’ve memorized. After you’ve input your login credentials, the system will prompt you for additional verification by sending a message to your mobile device. You must enter the password or code sent to you via message, or your access attempt is denied. At first glance, such a login system looks like the classic authentication and authorization system credit card users have implemented for years. You simply enter your credentials to get access. But, the added layer of protection comes from the hard token authentication step, for which you need some tool to complete. Just memorizing your PIN or password isn’t enough in a hardware token-based authentication system. Hard Tokens vs. Soft Tokens When discussing hard tokens vs. soft tokens, the most apparent difference between the two is discernible even for those with a basic understanding of how these authentication methods work. A hardware token is a physical device you must have in your possession. A software token is a virtual tool you have on your device. Essentially, both work in the same principle when accessing a system, with this one, significant difference. To help you choose which one is better for you, we want to discuss some pros and cons of both. Hard Tokens Pros and Cons In most parts of the world, hardware tokens are still considered the standard for every user who wants to increase their security with multi-factor authentication . They are much more secure than simple passwords and, as long as you have hardware tokens for authentication by your side, you can be worry-free that only you can access the system by using your unique credentials. With this in mind, we should also mention that hard tokens suffer from a list of inherent and unavoidable limitations. Since they are physical devices, they can get lost or stolen, though in most cases you can easily unlink your... - [What is a Bluetooth Dongle and How to Choose the Best One?](https://hideez.com/blogs/news/adding-bluetooth-dongle-to-your-computer): Adding a Bluetooth dongle to PC or Mac devices seems like a reasonably straightforward process. However, a lot of things can go wrong, not to your fault. On this page, we won’t try to convince you why you need a Bluetooth dongle, but we will share tips on how you can add it to your computer. We’ll even help you choose the right Bluetooth dongle based on your personal needs. If you also worry that you don’t have a Bluetooth feature on your PC or Mac because you have an older model, we’ll also share useful advice on adding a Bluetooth adapter to your device. Let’s just get to it. Step 1. Check if Your Computer Has Bluetooth Before you can connect your Bluetooth device, you need to check if your computer has a Bluetooth option in the first place. Here’s how to check it on Mac and Windows devices, starting with the latter: On Windows Open “ Start ” and then look up “ Device Manager ” in it. Look for the “ Bluetooth ” mark. If you find it, your Windows PC has built-in Bluetooth. If not, it doesn’t have such capabilities. On Mac Open the Apple Menu and click on the Apple logo in the top-left corner. Select the “ About this Mac ” option to open the pop-up window. Select “ System Report ” and expand the “ Hardware ” section Look for the “ Bluetooth ” heading. If you don’t see it, your Mac device doesn’t have a built-in Bluetooth. How to Add Bluetooth to Your Computer? If you’ve determined that your computer doesn’t have Bluetooth capabilities, you’ll need to add this feature manually. Luckily, this isn’t an uphill task and won’t take up much of your time or money. The only thing you need is a Bluetooth adapter. It comes in the form of a simple USB dongle and, don’t worry; you don’t have to look up how to use a Bluetooth adapter. You don’t even need to know how does a Bluetooth dongle work. All you need to do is to plug the USB Bluetooth adapter dongle into your computer, and you’re good to go. Step 2. Find a Bluetooth Dongle that Best Fits Your Need To know which Bluetooth dongle will best fit your needs, you first need to understand what a Bluetooth dongle does. In simple terms, Bluetooth technology allows devices to communicate with each other over short distances through high-frequency wireless technology. The list of reasons why you might need a Bluetooth dongle is fairly extensive. The most notable uses for a Bluetooth dongle include wireless communication with cell phones and desktop computers, wireless printing, file transfers, and network sharing. Even wireless keyboard and mouse devices are a typical example which most of us often overlook. Which Bluetooth Dongle to Buy? With Bluetooth adapters and dongles flooding the tech market, singling out specific products can be challenging if you don’t know what you primarily look for. So, which is the best dongle to buy? In truth, there’s no across-the-board answer, as your choice will ultimately depend on your needs and preferences. But, to help you out, we’ll highlight the most critical factors you should pay attention to when choosing a Bluetooth dongle: Transmission Range - The most obvious thing to pay attention to, the overall transmission range can be the difference-maker in your user experience. Although the connection’s quality is equally crucial as distance itself, never overlook transmission range when choosing a Bluetooth adapter. OS Support - Range, network stability, and performance are irrelevant if the dongle you buy isn’t compatible with your OS. Ideally, a dongle should be compatible with all major platforms. It should also have an available US 2.0 or 1.2 port. Bluetooth Version - Another crucial aspect to pay attention to is the adapter’s Bluetooth version. Buying any version that’s lower than 4.0 will disappoint you. It simply can’t provide you with the range and performance characteristics modern users have grown used to. Versions 4.0 and higher are not only better performers but also consume less energy. This is especially important for laptop users. Step 3. Set Up Your Dongle and Use it With Bluetooth Devices In this guide, we’ll demonstrate the setup process using the Hideez USB Bluetooth Dongle , which is compatible with various versions of macOS, Windows, Linux, Raspberry Pi, and Chrome OS. It offers a range of up to 20 meters (65 ft) and includes free shipping for customers in the US, UK, and most EU countries. Let’s get started with the step-by-step setup instructions for Windows. How to Set Up Your Bluetooth Dongle on Windows Setting up your Bluetooth dongle on Windows is straightforward. To help you make sure that this process goes without a hitch, we’ve created a detailed step-by-step guide you can follow as you go. Here’s how to connect Bluetooth dongle to PC Windows 10: 1. Insert the Bluetooth dongle in your computer’s USB port. 2. Open the Device Manager and Bluetooth will appear. 3. Go to “ Settings ”, click on “ Bluetooth and other devices ” and choose the “ Add Bluetooth or other device ” option 4. Select the device of your... - [NIST Password Guidelines 2021. Password Policy Best Practices](https://hideez.com/blogs/news/nist-password-guidelines): A recent survey has shown that two-thirds of companies don’t change passwords . The reasoning behind this statistic is even more worrying, as over half of employees avoid doing so because they worry about forgetting their new passwords, think that this practice is annoying, or simply don’t see the point in doing so. Healthy and robust password management policies are essential. Both companies and employees need to understand the importance of implementing proper password practices. The National Institute of Standards and Technology (NIST) provides password guidelines that are regarded as the gold standard for general privacy and data security compliance in the US. At the start of this year, officials from NIST teased potential changes to their security recommendations. With that in mind, we want to take a look at the current NIST password guidelines for 2021 to help you recognize the best password practices to protect against current cybersecurity threats. NIST Password Guidelines Since 2014, the National Institute of Standards and Technology has issued guidelines, recommendations, and controls for identity authentication, including optimal password policy practices. These guidelines have evolved over the years, as there have been several revisions, most notably in 2017 and 2019. The NIST password guidelines cover crucial practices for creating and managing passwords and requirements for the validation of these passwords. The main goal of the NIST password guidelines is to create strong password security for users and businesses and strictly control privileged access. These guidelines allow organizations and companies to better protect themselves against credential stuffing, brute force attacks, and other intrusion attempts. With all of that in mind, let’s first take a look at the outdated password recommendations and then move to the latest NIST guidelines for passwords for 2021. Outdated Password Recommendations Most companies apply outdated password practices, based on a set of fundamental criteria. These criteria generally include three main password security guideline: Forcing regular password changes Requiring that each new password is unique and hasn’t been used before in any form Making sure that each password is complex and consists of alphabetic (lowercase and uppercase) and numeric characters, and other special symbols. These guidelines are widely accepted by many businesses and have been used for decades. While there’s nothing inherently wrong with the above-listed policies, they’re not sophisticated enough to support modern security requirements. The fact that around 57% of people still employ these outdated practices means that the door for phishing and malware attacks is still very much open for attackers. We’ve grown accustomed to the outdated recommendations and need to apply new password management practices to ensure maximum security. This brings us to the next crucial topic. Updated Password Recommendations NIST has published a revised set of guidelines that cover the recommended security practices that best apply to today’s environment. This topic requires an entire article of its own, so we won’t go into all of the tiny details. That said, we want to take a close look at the latest password recommendations pertaining to the existing security practices: Alphanumeric Characters The alphanumeric password system seems like it’s been around since the passwords themselves. Combining lowercase and uppercase letters with numbers and special characters to make a password “stronger” is a practice nearly every security system employs nowadays. However, the NIST password guidelines state that this system doesn’t necessarily make for more robust and more secure passwords. The new NIST password guidelines emphasize a more dynamic system, in which the users would craft their passwords by comparing their new passwords with weak passwords and those that led to leaks. Password Length The current practice is that passwords should be around 8 to 10 characters. This is one of the essential aspects that need change, as NIST password guidelines recommend that passwords of at least 64 characters should be allowed. Having such a lengthy password might seem like an inconvenience. However, remembering a unique sentence as a password is much easier than using a gibberish one comprised of random numbers and characters. Password Hints “What was the name of your childhood pet?” and “The name of your first teacher” are everyday password hints users employ when they need to recover a password they’ve forgotten. However, the quality of these password hints often leaves a lot to be desired, especially in today’s over-exposed social media era. The new NIST password guidelines advise that users should stray away from password hints. Instead, they should utilize multi-factor authentication as a more advanced and more secure method of password security. You can set the MFA to identify you based on your fingerprint, digital... - [How to Remove Password from Windows 10 and Avoid Security Risks?](https://hideez.com/blogs/news/login-without-password-in-windows): Tired of punching in your Windows password every single time? You're not alone. If your password looks like a random string of hieroglyphics, typing it out multiple times a day can get annoying fast. The catch? You still want to stay secure — especially if your PC holds sensitive work files, client data, or just your private stuff. So, is it possible to make Windows logins quicker without using passwords and opening the door to security risks? Short answer: Yes, and we’ll show you how. At Hideez, we believe secure access should be simple — not stressful. That’s why we created a free SaaS platform that lets employees log into Windows PCs and web services — no passwords required. In this guide, we’ll show you how to safely remove the password from your Windows 10 login, along with some bonus tips for IT teams looking to simplify access across the board. How to Disable Windows 10 Login and Password? Before we take a closer look at how to disable the Windows 10 login password, we want to note an important caveat. This is that disabling your Windows 10 login and password doesn’t mean that you’re removing it entirely. To do this, you’ll have to complete a different set of actions, as it is a more sensitive action from a security standpoint. With that in mind, here’s a simple step-by-step guide on how to disable the Windows 10 login / password: 1. Press the Win key + R 2. Once the dialog box opens, type in “netplwiz” and click OK to proceed 3. When the new window pops up, uncheck the box for “user a must enter a user name and password to use this computer” and click OK to save changes. 4. A window will appear, prompting you to enter the account name and password you need to type in to enable automatic login. 5. After completing step four, restart your Windows to check if it will boot up directly without requiring a password. How to Remove Windows 10 Login and Password? If disabling the Windows 10 login / password isn’t enough, you can go a step further and remove it entirely. Additionally, we should mention that you won’t be able to remove your password altogether if you use a Microsoft account because your credentials will be linked to it. In order to complete the steps we’ll talk about, you’ll have to switch to a local account. Let’s take a close look at how to do it: 1. Click on the “Start” tab and search for “Settings”. 2. Once in the “Settings” tab, click on “Accounts and then “Your Info”. 3. Select the “Sign in with a local account instead” and click on “Next”. 4. Confirm your existing password and proceed. 5. Create a new username while leaving the password field blank. 6. Proceed by clicking the “Sign out and finish” button. Once you go through all of the above steps, your Windows 10 device will no longer be connected to a Microsoft account. In line with that, you will successfully remove the password from Windows 10. Alternatively, you can also remove the Windows 10 password from a local account. Here’s how to do it: 1. Click on the “Start” tab and open up “Settings”. 2. Go to “Accounts” and then “Sign-in options”. 3. Navigate to the “Password” option under the “Manage how you sign in to your device” and click on “Change”. 4. Confirm your existing password and proceed. 5. When prompted, leave the new password fields empty. 6. Click on “Next” and then “Finish” to complete the change. If the main reason why you want to remove or disable the Windows 10 login and password is that you want a more convenient service, consider switching to a different, faster, and more secure authentication method. For example, you can set up Windows Hello to log in with a fingerprint, facial recognition, or a simple PIN. You can also use a hardware security key like tne Hideez Key 4 that will enter your credentials automatically and lock computers when users step away from them. Security Risks of Removing the Windows 10 Login and Password If you’ve gotten to this point of the page and are seriously set on removing your password, there are several things you should be aware of before you disable your password in Windows 10. Here are the most significant threats you have to consider before getting rid of your Windows 10 password: Open Access to Anyone - The first and most obvious security risk of removing the password from your Windows 10 device is that this will open access to anyone who can physically reach the device. While removing your password won’t make you more vulnerable to remote attacks, anyone who is in the proximity of your device can just walk up to it and open any information you store on it. Elevated Access for Malware - If you have an administrator account on your Windows 10 and remove the password, you potentially give enhanced access to any malicious apps running on your device. It Requires a Local Account - While this isn’t inherently a drawback, it is a complication that you need to be aware of before you try removing your login password. You can’t remove your Windows 10 password using a Microsoft account.... - [What Is Single-Factor Authentication? SFA Pros and Cons](https://hideez.com/blogs/news/single-factor-authentication): Single-factor authentication (SFA) was the norm for many years before multi-factor authentication started gradually replacing it. In today’s era of highly developed information systems, most security experts agree that single-factor authentication simply isn’t enough to keep you safe. There are many reasons that back up this widespread opinion. If you want to learn everything you need to know about single-factor authentication, make sure to read all of the information we’ll share with you on this page. We’ll discuss the most significant pros and cons of single-factor authentication, compare it to multi-factor authentication and analyze many other important aspects. Let’s jump right in. What is Single-Factor Authentication? Single-factor authentication or simply, SFA, is a logging method that uses only one way of verifying user identity when attempting access. It’s the simplest and most widespread form of authentication. In common terms, the way single-factor authentication works is to use a password and username to confirm you’re the account holder. Speaking of single-factor authentication examples, the most common ones include a password-based authentication system. The user who sets his account needs to create a unique and robust password to ensure no one can access the data behind it. In contrast to this, authentication methods that include two or more steps often require the user to confirm his identity after verifying his username and password combination. More specifically, multi-factor authentication (MFA) uses a combination of at least two of these three factors: Something you Know - A username and password combination, security question, or unique PIN. Something you Have - A smart card, one-time authentication passcode, or simply a smartphone that can authenticate your identity. Something you Are - A biometrical proof of authenticity, most commonly in the form of a fingerprint. It also could be in the form of a voice recognition scan or a retina scan. Single-factor Authentication Pros and Cons With the understanding of single-factor authentication and how it works, let’s take a deeper look into the characteristics of single-factor authentication through the most significant advantages and drawbacks of SFA. We’ll start with the most notable pros of single-factor authentication. What are the Benefits of Single-factor Authentication? Single-factor authentication comes with a set of unique advantages over other authentication methods. Here are the two most notable benefits of single-factor authentication: Ease of Use SFA’s convenience and simplicity are among the significant reasons this authentication method became so prevalent in nearly every field, from the banking industry to social media sites. Single-factor authentication simply works, and you don’t have to put in any effort to make it work consistently. Just type in the name and password, and you’re in. It’s an incredibly fast way of authenticating the user’s identity and doesn’t require any other input or cooperation from the user’s side beyond that point. Cost of Implementation This factor pertains more to businesses than individual users. For companies, especially those employing a large number of workers, implementing sophisticated multi-factor authentication measures can be a very costly investment. Oppositely, single-factor authentication is simple and relatively straightforward to set into place. Plus, the employees don’t need any advanced technical skills to use it on an everyday basis. What are the Disadvantages of Single-factor Authentication? Of course, besides the advantages of this authentication method, it’s also crucial to consider single-factor authentication risks. Here are the best significant disadvantages of single-factor authentication: Low Protection Levels The most apparent and most problematic aspect of single-factor authentication is that it doesn’t offer solid and reliable security. Regardless of what specific single-factor is used, the main issue with the system is that there’s only one authentication factor. If an intruder manages to break through it, nothing is stopping him after that. Like most convenient and user-friendly solutions, this is an innate issue of SFA that can’t be prevented in any discernible way other than switching to MFA. The Security is On the User With SFA, the user is the primary factor determining how secure his account will be, based on the strength of his password. The simpler the password, the easier the hackers can get in. This may seem like an easily avoidable problem, but users often avoid using strong passwords because they are difficult to remember. Single-factor vs. Multi-factor Authentication With both the pros and cons of single-factor authentication in mind, we can draw a parallel between SFA and MFA to determine which is better from the user’s standpoint. In truth, there’s not much competition between the two, as any form of MFA will always be better than simple SFA security. The... - [SAML Basics: What is SAML And How Does It Work?](https://hideez.com/blogs/news/what-is-saml-and-how-does-it-work): SAML authentication is a widely used method that makes all of our lives easier. But, most online users don’t know how SAML works or what it even is, for that matter. There are many terms you can use to describe the features and capabilities of SAML for authentication purposes. On this page, we’ll run you through all of the SAML basics and help you understand this open standard the majority of people use daily. What is SAML? Short for Security Assertion Markup Language, SAML is a standardized way of verifying your identity with external applications and services. It’s like your online identification card in the way that it helps authenticate your identity once and then transmit this authentication to other applications. It makes SSO (single sign-on) technology possible and is widely accepted among cloud service providers as a way of communicating the user’s identity. SAML is an interoperable standard, meaning that it allows services and devices from many different providers to interact with each other and work together. From this perspective, it’s also essential to know the relationship between SAML and SSO. SSO is easy to accomplish across one domain. But, when you want to extend SSO across several security domains, interoperability issues quickly arise, making this process challenging. SAML was explicitly designed to provide a standardized way of extending SSO across many platforms and services as an interoperable method. The current version of SAML is the SAML 2.0 one, which has been in use since 2005. It’s the modern standard and combines several SAML authentication standards that have been previously in use. Many systems support backwards compatibility with SAML, most notably with the 1.1 version. Is SAML a Protocol? No, it’s essential to understand that SAML is not a protocol but instead a complete authentication standard. To be more specific, it’s an XML-based makeup language that also includes the following SAML components and characteristics: A unique set of XML-based protocol messages A set of protocol message bindings A set of profiles, utilizing the two aspects above How SAML Authentication Works In simple terms, SAML authentication works by transferring your identity from one place to another. It’s an exchange of the subject’s digitally signed XML documents between the identity provider and the service provider. For example, let’s say that you’re trying to access a service provider such as Gmail . The traditional way is to log in to the service directly. But, when you’re using SSO, SAML is used to give you direct access instead of you manually logging in. In this context, the identity provider is the service that stores and confirms your identity. In other words, it serves to verify your identity and confirm to the service provider what you’re allowed to do. This system also allows you to conveniently and safely log into a remote application without much effort. You can access the remote app through a link, bookmark, or similar access point. The remote app identifies your device by origin and redirects you to the identity provider, which then authenticates you. The identity provider builds the authentication response through an XML document containing all of the relevant information on the user. It will either establish a new session or bring up an existing one if you’ve already authenticated your identity on a previous occasion. The service provider will validate the authentication response, after which you’ll gain access to the app or service you want to use. The Benefits of SAML Authentication With the understanding of how SAML works, let’s take a closer look at the most significant benefits of SAML authentication: Single User Identity - From the user’s standpoint, one of the most significant benefits of SAML is the convenient user experience it comes with. SAML provides you with a single user identification method across all devices and services you’re using. Single Sheet Management - Since SAML is interoperable, it has a massive advantage over proprietary SSO mechanisms. With SAML, you can support a single implementation with many different partners. This flexibility allows for more convenient single-sheet management of all services and user identities. Reduced Risk of Data Breaches - As the authentication process includes securely passing authorizations between the identity provider and the service providers, the risk of potential data breaches is significantly lowered. Lower Help Desk Costs - The previous benefits also mean that you can save a considerable amount of money on help desk services. On average, SAML authentication can help you lower your help desk costs by around twenty percent. SAML vs. OAuth One narrative that’s often pushed by some security experts is that SAML is dead and that we need a new authentication method, mainly an alternative one like OAuth. With that in mind, how can you tell which way is better from the user’s standpoint? Should you use SAML or OAuth? Here’s a... ## Shopping Cart - [Shopping Cart](https://hideez.com/cart): Allows users to view and manage their shopping cart. ## Checkout - [Checkout](https://hideez.com/checkout): Allows users to checkout and complete their purchase.