3 ms·
I feel like companies have invested a lot in securing internal services from external actors, and the threat model has moved to compromise these organizations f
by davikr 5y ago
I feel like companies have invested a lot in securing internal services from external actors, and the threat model has moved to compromise these organizations from the inside with underpaid disgruntled employees being promised riches. It should be important not only to punish those insiders involved, but also to have the least possible permissions for developers, support desk workers or anyone really.
- chockchocschoir 5y ago> but also to have the least possible permissions for developers, support desk workers or anyone really. Considering that Okta say they already do "Zero Trust security" and giving people least possible authorization (and also that they were never breached in the first place, still), I don't have a lot of fate in the industry realizing anything from this breach.
- dboreham 5y agoA single low paid employee shouldn't have the access rights to do serious damage. For example Okta probably has rate-limits on how many users a CSR can reset the password for.