Re:Okta’s Investigation of the January 2022 Compromise
by qbasic_forever on Wednesday March 23, 2022 @02:21AM
(#30775555)
It's wild that apparently near full admin access to the service was handed out to subcontractors of subcontractors. There was so little oversight and so many levels of indirection that it took months to figure out the full impact of the breach and incident. This does not seem like a healthy or responsible security policy for a company whose primary business is... authentication security.
[ Parent
| on HN ]
Re:Okta’s Investigation of the January 2022 Compromise
by salmo on Wednesday March 23, 2022 @08:00AM
(#30777544)
No, definitely not full admin access. Just a support tool called “SuperUser”.
It was a customer service rep who could send password reset emails.
Systems listed were that app and SaaS offerings. The laptop was vendor owned and managed.
Given my experience, it probably had 0 access to anything “inside” Okta. There was no mention of vendor VPN or Virtual Desktop access. Or access to any internal system beyond what was a horribly named call center support tool.
They really wouldn’t have passed the necessary audits for their enterprise and government customer base if they allowed 3rd party devices “real” access.
Beyond a “hacker” getting access, there is very little trust in (likely) contract employees of a contract company.
The fact that the tool is named Super User is killing them more than anything here.
Re:Okta’s Investigation of the January 2022 Compromise
by tgsovlerkhgsel on Wednesday March 23, 2022 @02:46AM
(#30775683)
But it was cheap!