1. We didn't compromise any laptop? It was a thin client.
2. "Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider." -
I'm STILL unsure how its a unsuccessful attempt? Logged in to superuser portal with the ability to reset the Password and MFA of ~95% of clients isn't successful?
4. For a company that supports Zero-Trust. Support Engineers seem to have excessive access to Slack? 8.6k channels? (You may want to search AKIA* on your Slack, rather a bad security practice to store AWS keys in Slack channels )
5. Support engineers are also able to facilitate the resetting of passwords and MFA factors for users, but are unable to obtain those passwords. -
Uhm? I hope no-one can read passwords? not just support engineers, LOL. - are you implying passwords are stored in plaintext?
6. You claim a laptop was compromised? In that case what suspicious IP addresses do you have available to report?
7. The potential impact to Okta customers is NOT limited, I'm pretty certain resetting passwords and MFA would result in complete compromise of many clients systems.
8. If you are committed to transparency how about you hire a firm such as Mandiant and PUBLISH their report? I'm sure it would be very different to your report :)
21. Security Breach Management.
a) Notification: In the event of a Security Breach, Okta notifies impacted customers of such Security Breach. Okta
cooperates with an impacted customer’s reasonable request for information regarding such Security Breach, and Okta
provides regular updates on any such Security Breach and the investigative action and corrective action(s) taken. -
But customers only found out today? Why wait this long?
9. Access Controls. Okta has in place policies, procedures, and logical controls that are designed:
b. Controls to ensure that all Okta personnel who are granted access to any Customer Data are based on leastprivilege principles;
kkkkkkkkkkkkkkk
1. Security Standards. Okta’s ISMP includes adherence to and regular testing of the key controls, systems and procedures of
its ISMP to validate that they are properly implemented and effective in addressing the threats and risks identified. Such
testing includes:
a) Internal risk assessments;
b) ISO 27001, 27002, 27017 and 27018 certifications;
c) NIST guidance; and
d) SOC2 Type II (or successor standard) audits annually performed by accredited third-party auditors (“Audit
Report”).
I don't think storing AWS keys within Slack would comply to any of these standards?
the Hive infograpgh (amongst others) always comes to mind; 18 characters long, upper, lower, numerical, special. estimate time to brute force 438tn years.
ironic how just a few stories down is an article about how approx 50% of steam payments with bitcoin (when they accepted it) were fraudulent... everyone wanting a quick buck without doing the work
i think I'll still with the sheldon method, built countless amounts of wheels and never needed or thought i needed to add unnecessary tech to what is such a simple job
I think this can be pretty much summed up along the lines of: way back when colour was introduced into film people wanted to show it off more, it was something magical whereas now everyone wants to be all edgy and gritty.
Or.... it's the lizard people controlling the world and making everyone miserable by using only dark grim colours?!
all that says is: Google have the money and power to buy people out. Thats business 101, nothing new. Yeah it sucks but if you don't agree with it stop using google and apple products.
that opening line of needing a million dollar budget LOL if anyone follows @_MG_ you'll know that this has been a very long project thats really not been that expensive the dude dropped a load around defcon then hak5 came in and said hey we can charge and arm and a leg for these...
Not to poop all over this article but doesn't the advance in automotive industry also bring things like automatic brakes etc to protect against collisions, lane swerve etc. :/
and I also enjoy a lot of cycling and have been hit by plenty idiots drived opening doors or making turns and not looking.
Can we get ISO to make all papers free next...? You know since moat industries need to abide by their standards but they refuse to freely make available these standards...
Lets bury our carbon waste using plants, not address the issues that we're burning fossil fuels and creating carbon waste at an increasingly alarming rate or focus on renewable clean recyclable energy...
it's called marketing 101, offer something as free but include it in the price this making the customer feel like they're getting something for nothing...