Okta’s Investigation of the January 2022 Compromise

Re:Okta’s Investigation of the January 2022 Compromise by bigDinosaur on Wednesday March 23, 2022 @02:12AM (#30775514)

I view this hack as a public service - we're seeing how awfully these big security companies actually handle security in the worst case. Let that be a lesson to everyone who is in favour of mass centralisation. There needs to be a security solution where Okta essentially provides the skeleton of the infrastructure but not the entire solution, such that an Okta compromise does not compromise everyone who uses them.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by qbasic_forever on Wednesday March 23, 2022 @02:21AM (#30775555)

It's wild that apparently near full admin access to the service was handed out to subcontractors of subcontractors. There was so little oversight and so many levels of indirection that it took months to figure out the full impact of the breach and incident. This does not seem like a healthy or responsible security policy for a company whose primary business is... authentication security.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by salmo on Wednesday March 23, 2022 @08:00AM (#30777544)

No, definitely not full admin access. Just a support tool called “SuperUser”.

It was a customer service rep who could send password reset emails.

Systems listed were that app and SaaS offerings. The laptop was vendor owned and managed.

Given my experience, it probably had 0 access to anything “inside” Okta. There was no mention of vendor VPN or Virtual Desktop access. Or access to any internal system beyond what was a horribly named call center support tool.

They really wouldn’t have passed the necessary audits for their enterprise and government customer base if they allowed 3rd party devices “real” access.

Beyond a “hacker” getting access, there is very little trust in (likely) contract employees of a contract company.

The fact that the tool is named Super User is killing them more than anything here.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by tgsovlerkhgsel on Wednesday March 23, 2022 @02:46AM (#30775683)

But it was cheap!

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by a2tech on Wednesday March 23, 2022 @08:06AM (#30777584)

And don't forget that they meet all the governments BS standards and auditing checks. So lots of government contractors use them.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by staticassertion on Wednesday March 23, 2022 @02:44AM (#30775675)

One company doing a bad job does not mean it's impossible or even uncommon to do a good job. Also, if you wanted to hedge against Okta... feel free. You can U2F 2FA your services behind Okta or in front of it. We use GSuite SSO, but everywhere we can set 2FA outside of it we do so.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by pid-1 on Wednesday March 23, 2022 @06:39AM (#30777026)

> does not mean it's impossible or even uncommon to do a good job.

The only way one can reach this conclusion is by ignoring all the breaches / CVEs that happened in large companies during the past few years.

Nowadays I just assume every company is crap at security unless proven otherwise.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by staticassertion on Wednesday March 23, 2022 @12:40PM (#30780360)

I'm pretty up on my breaches :)

Yes, most companies are bad at security. Some aren't though. The problem right now is figuring out which ones are - there's very little signal.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by bigDinosaur on Wednesday March 23, 2022 @03:05AM (#30775797)

While true, Okta isn't some minor player that we can just wave away like this. I bet lots of other similar big companies will have similar issues - this is about much more than just their technical merit.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by jjav on Wednesday March 23, 2022 @03:55PM (#30782571)

> One company doing a bad job does not mean it's impossible or even uncommon to do a good job.

We all know it is very uncommon to do a great job. Everyone has been breached sooner or later. Any anyone who has worked in engineering or security in tech companies knows how often security concerns are underprioritized far behind more visible but less important work.

Hedging is a good answer. Relying on a single point of failure that, if it ever fails open, will expose everything at once? Not a smart idea.

[ Parent | on HN ]