[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-63":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",210,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST guidelines for digital identity services, covering identity proofing and enrolment, authentication and federation. They define assurance levels for each area: identity assurance, authenticator assurance and federation assurance. The current revision is SP 800-63-4, organised into a base document and volumes A, B and C.\n\n**In practice.** Organisations assess the risk of each digital service and select the assurance level needed for proofing, authentication and federation. They choose authenticators accordingly, favour phishing-resistant options for higher risk, and follow the guidance on password handling, such as checking against compromised password lists rather than forcing periodic changes. Evidence includes the risk assessment, chosen assurance levels and configuration of identity systems.\n\n**Common gaps.** Common gaps are applying one authentication level to everything, keeping outdated password rules, and weak account recovery processes that undermine strong authentication.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F63\u002F4\u002Ffinal","Read the publication at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},208,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":24,"title":25,"published_at":26},"phishing-smishing-attacks-target-election-officials-ahead-of-2026-midterms","Phishing & Smishing Attacks Target Election Officials Ahead of 2026 Midterms","2026-10-16T16:21:30.17+00:00",{"slug":28,"title":29,"published_at":30},"ai-powered-android-defenses-target-voice-cloning-and-messaging-scams","AI-Powered Android Defenses Target Voice Cloning and Messaging Scams","2026-10-15T20:20:20.548+00:00",{"slug":32,"title":33,"published_at":34},"olvx-cybercrime-marketplace-operator-charged-after-500k-in-stolen-data-sales","OLVX Cybercrime Marketplace Operator Charged After $500K in Stolen Data Sales","2026-10-14T22:20:20.643+00:00",{"slug":36,"title":37,"published_at":38},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","2026-10-14T18:20:33.817+00:00",{"slug":40,"title":41,"published_at":42},"telco-fined-for-failing-to-verify-identities-enabling-gdpr-violating-fraud","Telco Fined for Failing to Verify Identities, Enabling GDPR-Violating Fraud","2026-10-14T18:20:19.96+00:00",{"slug":44,"title":45,"published_at":46},"billion-message-phishing-ecosystem-targeting-microsoft-users-dismantled","Billion-Message Phishing Ecosystem Targeting Microsoft Users Dismantled","2026-10-14T14:20:50.56+00:00",{"slug":48,"title":49,"published_at":50},"ai-agent-exposes-critical-otp-bypass-in-live-insurance-portal","AI Agent Exposes Critical OTP Bypass in Live Insurance Portal","2026-10-14T12:21:03.121+00:00",{"slug":52,"title":53,"published_at":54},"ai-powered-crypto-impersonation-scams-surge-1400-in-2025","AI-Powered Crypto Impersonation Scams Surge 1,400% in 2025","2026-10-13T22:20:45.127+00:00",{"slug":56,"title":57,"published_at":58},"mfa-gaps-in-internal-systems-leave-the-door-open-for-ransomware","MFA Gaps in Internal Systems Leave the Door Open for Ransomware","2026-10-13T16:21:32.111+00:00",{"slug":60,"title":61,"published_at":62},"wazza-phishing-kit-bypasses-detection-to-harvest-credentials-across-critical-sectors","Wazza Phishing Kit Bypasses Detection to Harvest Credentials Across Critical Sectors","2026-10-08T12:20:37.933+00:00",{"slug":64,"title":65,"published_at":66},"fake-ai-ad-portals-steal-credentials-and-mfa-codes-via-browser-in-the-browser-phishing","Fake AI Ad Portals Steal Credentials and MFA Codes via Browser-in-the-Browser Phishing","2026-10-06T22:21:47.539+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",151,{"slug":74,"name":75,"problem":76,"stories":77},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",111,{"slug":79,"name":80,"problem":81,"stories":82},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",86,{"slug":84,"name":85,"problem":86,"stories":87},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",63,{"slug":89,"name":90,"problem":91,"stories":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",37,{"slug":94,"name":95,"problem":96,"stories":97},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",14,[99,105,111,117,121,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",174,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","6","Control 6","Access Control Management",171,{"family":112,"item":113,"code":114,"title":115,"together":116},"nist-800-53","ac-2","AC-2","Account Management",124,{"family":106,"item":118,"code":119,"title":120,"together":77},"14","Control 14","Security Awareness and Skills Training",{"family":112,"item":122,"code":123,"title":124,"together":125},"ac-17","AC-17","Remote Access",93,{"family":127,"item":128,"code":129,"title":129,"together":130},"itil","overview","ITIL",71,{"family":106,"item":132,"code":133,"title":134,"together":135},"4","Control 4","Secure Configuration of Enterprise Assets and Software",69,{"family":112,"item":137,"code":138,"title":139,"together":140},"ia-5","IA-5","Authenticator Management",59]