4 ms·
It's wild that apparently near full admin access to the service was handed out to subcontractors of subcontractors. There was so little oversight and so many l
by qbasic_forever 5y ago
It's wild that apparently near full admin access to the service was handed out to subcontractors of subcontractors. There was so little oversight and so many levels of indirection that it took months to figure out the full impact of the breach and incident. This does not seem like a healthy or responsible security policy for a company whose primary business is... authentication security.
- tgsovlerkhgsel 5y agoBut it was cheap!
- salmo 5y agoNo, definitely not full admin access. Just a support tool called “SuperUser”. It was a customer service rep who could send password reset emails. Systems listed were that app and SaaS offerings. The laptop was vendor owned and managed. Given my experience, it probably had 0 access to anything “inside” Okta. There was no mention of vendor VPN or Virtual Desktop access. Or access to any internal system beyond what was a horribly named call center support tool. They really wouldn’t have passed the necessary audits for their enterprise and government customer base if they allowed 3rd party devices “real” access. Beyond a “hacker” getting access, there is very little trust in (likely) contract employees of a contract company. The fact that the tool is named Super User is killing them more than anything here.
- a2tech 5y agoAnd don't forget that they meet all the governments BS standards and auditing checks. So lots of government contractors use them.