3 ms·
How is that lots more details ? Your post is only about whether or not CF Okta account has been compromised not about what really happened for all Okta customer
by polote 5y ago
How is that lots more details ? Your post is only about whether or not CF Okta account has been compromised not about what really happened for all Okta customers
- MrStonedOne 5y agoit has more detail on the breach then okta's own statement.
- NicoJuicy 5y agoThey give more technical details than the Okta post and probably even the Okta customer contact. Eg. > Cloudflare reads the system Okta logs every five minutes and stores these in our SIEM so that if we were to experience an incident such as this one, we can look back further than the 90 days provided in the Okta dashboard. Some event types within Okta that we searched for are: user.account.reset_password, user.mfa.factor.update, system.mfa.factor.deactivate, user.mfa.attempt_bypass, and user.session.impersonation.initiate. It’s unclear from communications we’ve received from Okta so far who we would expect the System Log Actor to be from the compromise of an Okta support employee.