This Week's Top Ping Identity Blogs

[Facebook]( [Twitter]( [LinkedIn]( [YouTube]( [PRODUCTS]( [SOLUTIONS]( [CUSTOMERS]( [RESOURCES]( [ABOUT]( [] This Week's Top Ping Identity Blogs Hello! Here's the latest and greatest from the Ping Identity blogosphere. Enjoy! [Implementing High-quality Controls to Protect Private Keys]( Posted: Tuesday, December 12, 2017 At Ping Identity, we are always watching for new research in the area of identity standards. You may have seen one such paper recently: the blog article [Golden SAML: Newly Discovered Attack Technique Forges Authentication to Cloud Apps](. While the title of the blog post may be alarming at first glance, further examination points out the following: "This attack doesn't rely on a vulnerability in SAML 2.0. It's not a vulnerability in AWS/ADFS, nor in any other service or identity provider... Golden SAML is rather similar. It's not a vulnerability per se, but it gives attackers the ability to gain unauthorized access to any service in a federation (assuming it uses SAML, of course) with any privileges and to stay persistent in this environment in a stealthy manner." Our security and identity teams have analyzed the claims in the blog post, and we believe that there are two primary claims: 1) that an attacker gaining access to the private signing key for a SAML Identity Provider may use that key to impersonate users, and 2) that this fact is a new disclosure. [View article]( Check these out! [( Ping Identity, 1001 17th Street, Suite 100 Denver, CO, 80202 | 1.877.898.2905 ©2003-2017 Ping Identity Corporation [Unsubscribe](