4 ms·

Sounds like the main point of disagreement is the definition of a single word, "breached". Otherwise, everyone is in agreement about what happened, right? I agr

Sounds like the main point of disagreement is the definition of a single word, "breached". Otherwise, everyone is in agreement about what happened, right? I agree with your definition of the word for whatever it's worth. At this point, it would be helpful for Okta to stop using the term "breached", because apparently they aren't using the word in the same way everyone else is, and it's a point of contention.

Closi 5y ago
Everyone else is using the plain English definition because it’s accurate. Okta is intentionally using their own definition to down-play what’s happened. A breach is simply ‘to overcome defences’ (ie to get access to something you shouldn’t). In this case their defence against someone else accessing the super user application was the support employee and their credentials, but this defence was clearly overcome by the hackers. I agree that they need to stop using the word.
kerng 5y ago
Agreed. It's obvious that lawyers are deeply involved already at this point. The most likely reason they dont wanna use the common sense term "breached" is because it implies legally a breach of contract, which means liability and getting sued and having to show up in front of congress. Very sad to see their response be so intransparent and flawed. I wish technical people would be more involved in writing these responses, not lawyers.
- Beltiras 5y ago
  The breach is technical in nature. The disclosure and response is a legal matter.
zmmmmm 5y ago
I actually think the definitional conflict might be on the term "Okta service" - > the Okta service has not been breached If you consider the Okta service as the infrastructure acutally providing auth services to customers - then it wasn't breached. Only Okta support services were breached and that did not (going with Okta's line here) actually allow for somebody to access the actual Okta auth services.

Closi 5y ago

Everyone else is using the plain English definition because it’s accurate. Okta is intentionally using their own definition to down-play what’s happened. A breach is simply ‘to overcome defences’ (ie to get access to something you shouldn’t). In this case their defence against someone else accessing the super user application was the support employee and their credentials, but this defence was clearly overcome by the hackers. I agree that they need to stop using the word.

kerng 5y ago

Agreed. It's obvious that lawyers are deeply involved already at this point. The most likely reason they dont wanna use the common sense term "breached" is because it implies legally a breach of contract, which means liability and getting sued and having to show up in front of congress. Very sad to see their response be so intransparent and flawed. I wish technical people would be more involved in writing these responses, not lawyers.

Beltiras 5y ago
The breach is technical in nature. The disclosure and response is a legal matter.

zmmmmm 5y ago

I actually think the definitional conflict might be on the term "Okta service" - > the Okta service has not been breached If you consider the Okta service as the infrastructure acutally providing auth services to customers - then it wasn't breached. Only Okta support services were breached and that did not (going with Okta's line here) actually allow for somebody to access the actual Okta auth services.