3 ms·

I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. It would be the equivalent of trying to s

I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. It would be the equivalent of trying to self-host email. Also - never having worked for a company that hosted their own - what's the experience like - with Okta, you can essentially SSO onto hundreds (thousands?) of different cloud service providers. Similiar if you self-host?

Nextgrid 3y ago
> I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. Not saying you can do better, just saying that you can get the same level of quality for free without paying for an incompetent & expensive snake-oil vendor. But if you want a non-exhaustive list, there are a few lessons we can learn at Okta's expense: Not outsource support to low-wage boiler rooms could be a good start - that's what got them their previous breach some time ago, and the current breach isn't that far off although it seems more down to the support infrastructure than the people themselves. If you can, restrict access per IP address. Even better, if everyone works out of the office or VPNs into it, don't expose the service publicly in the first place. Defense in depth, something we seem to have forgot in the process of putting everything on the public internet. If you see an existing session token suddenly show up with a different user-agent and IP address (not matching previous usage patterns or expected wifi-to-mobile handover), invalidate the session and ask the user to reauth again. If possible, high-value accounts need to be IP restricted in the first place to known IPs or at least subnets (if the employee is on a dynamic IP).
mike_d 3y ago
> I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. If you use Okta, every single Okta support person is a super-admin in your environment with access to every role in every app. It is trivial to do better than that.
- nixgeek 3y ago
  It’s extremely unlikely that every Okta Support employee has this level of access, much less on a persistent ongoing basis. It would be nearly impossible to achieve this level of compliance certification if it were this simple and this broken. https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/
  - Veserv 3y ago
    Why do you have a link: https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/ to the list of Okta certifications in your bookmarks? You absolutely did not do a search for it just now because that is a stale link so there is no way you even clicked through that link before pasting it and you already knew what was supposed to be on that page. This is the current link: https://trust.okta.com/compliance/ https://trust.okta.com/compliance/ And anyways, yeah, those certifications are useless box checking garbage that a totally broken system can get. Solarwinds has most of those same certifications: https://www.solarwinds.com/trust-center https://www.solarwinds.com/trust-center and they are a total clown show. In fact, basically all of the clown shows have those because all most of those standards amount to is verifying your paperwork is consistent.
    - nixgeek 3y ago
      I got that back from a search and do not have it in my bookmarks, and I did quickly skim it before pasting as well. You have a creative imagination about how I use the internet though, sorry.
      - Veserv 3y ago
        The link you posted: https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/ returns a 404, page not found. There is nothing on that page. I replied to you at most a few hours after you posted that link. Are you going to claim that Okta updated the url in that few hour long window? For that matter, you did not even double check the link after I said it was stale or you would have used that argument in your post since it is the only credible reason to claim a dead link had contents.

Nextgrid 3y ago

> I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. Not saying you can do better, just saying that you can get the same level of quality for free without paying for an incompetent & expensive snake-oil vendor. But if you want a non-exhaustive list, there are a few lessons we can learn at Okta's expense: Not outsource support to low-wage boiler rooms could be a good start - that's what got them their previous breach some time ago, and the current breach isn't that far off although it seems more down to the support infrastructure than the people themselves. If you can, restrict access per IP address. Even better, if everyone works out of the office or VPNs into it, don't expose the service publicly in the first place. Defense in depth, something we seem to have forgot in the process of putting everything on the public internet. If you see an existing session token suddenly show up with a different user-agent and IP address (not matching previous usage patterns or expected wifi-to-mobile handover), invalidate the session and ask the user to reauth again. If possible, high-value accounts need to be IP restricted in the first place to known IPs or at least subnets (if the employee is on a dynamic IP).

mike_d 3y ago

> I guess I'm curious as to how someone self-hosting would be able to perform their security better than a Tier 1 iDP. If you use Okta, every single Okta support person is a super-admin in your environment with access to every role in every app. It is trivial to do better than that.

nixgeek 3y ago
It’s extremely unlikely that every Okta Support employee has this level of access, much less on a persistent ongoing basis. It would be nearly impossible to achieve this level of compliance certification if it were this simple and this broken. https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/
- Veserv 3y ago
  Why do you have a link: https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/ to the list of Okta certifications in your bookmarks? You absolutely did not do a search for it just now because that is a stale link so there is no way you even clicked through that link before pasting it and you already knew what was supposed to be on that page. This is the current link: https://trust.okta.com/compliance/ https://trust.okta.com/compliance/ And anyways, yeah, those certifications are useless box checking garbage that a totally broken system can get. Solarwinds has most of those same certifications: https://www.solarwinds.com/trust-center https://www.solarwinds.com/trust-center and they are a total clown show. In fact, basically all of the clown shows have those because all most of those standards amount to is verifying your paperwork is consistent.
  - nixgeek 3y ago
    I got that back from a search and do not have it in my bookmarks, and I did quickly skim it before pasting as well. You have a creative imagination about how I use the internet though, sorry.
    - Veserv 3y ago
      The link you posted: https://www.okta.com/trust-page/compliance/ https://www.okta.com/trust-page/compliance/ returns a 404, page not found. There is nothing on that page. I replied to you at most a few hours after you posted that link. Are you going to claim that Okta updated the url in that few hour long window? For that matter, you did not even double check the link after I said it was stale or you would have used that argument in your post since it is the only credible reason to claim a dead link had contents.