4 ms·

It took them almost a month to review their initial analysis? What is going on at this company that they can afford to be so aloof? > Today we are sharing new

It took them almost a month to review their initial analysis? What is going on at this company that they can afford to be so aloof? > Today we are sharing new information that potentially impacts the security of our customers Maybe in another month they will conclude whether or not that “potentially” is a yes or no.

toomuchtodo 3y ago
Total clown show running on enterprise inertia. https://en.wikipedia.org/wiki/Okta,_Inc.#Security_incidents https://en.wikipedia.org/wiki/Okta,_Inc.#Security_incidents
- rychco 3y ago
  I did not realize it was a $6 billion/6000 person public company. Their product is single sign-on services & they’ve got this bad of a track record? I guess I shouldn’t be surprised anymore
dzikimarian 3y ago
I assume their customers are vendor-locked to hell. Crazy what people do for convenience.
bri3d 3y ago
What blows my mind is that they've somehow managed to turn relatively minor incidents that aren't even compromises to their core systems into top-of-the-news-cycle meltdowns. The Lapsus$ compromise in 2022 was a third-party IT subcontractor getting their spy-on-the-employees RDP popped, and then Lapsus$ using incredibly limited access to the Okta admin tool to take some screenshots of support dashboards. Honestly it could have been spun into a "hey, our defense in depth pretty much worked!" story. Then, the most recent issue was an employee's third-party password manager getting compromised, allowing an attacker to log in to the support ticket tracker, which happened to contain HAR files with creds in them as well as details on support contacts. I bet a lot of enterprises are vulnerable to this, the HAR file thing is actually a great lesson in a highly unexpected threat vector. But somehow Okta have managed to turn it into a months-long top-of-the-news cycle incident, first by denying the compromise happened at all and then by underplaying the access the threat actor had to the support ticket tracker.
- sonicanatidae 3y ago
  Drama sells ads. It's the same reason most news stories are shit today. They aren't about conveying information or educating anyone about events in the world. They are clickbait garbage, meant solely to drive traffic in for Ad revenue and in recent history, they are slanted based on a bias that the owner wants, not any sort of factual, unbiased reporting that one may have erroneously expected from the 4th Estate. What a shit world humans have created.
  - skilled 3y ago
    That about sums it up. Journalists either washing the dirty laundry of trillion dollar companies or peddling their product launches for the off-chance of a special scoop in the future. The big sites are definitely no more than this, with very few exceptions for opinion pieces, but even those are heavily being guard-railed against all the “politically correct” nonsense.

toomuchtodo 3y ago

Total clown show running on enterprise inertia. https://en.wikipedia.org/wiki/Okta,_Inc.#Security_incidents https://en.wikipedia.org/wiki/Okta,_Inc.#Security_incidents

rychco 3y ago
I did not realize it was a $6 billion/6000 person public company. Their product is single sign-on services & they’ve got this bad of a track record? I guess I shouldn’t be surprised anymore

dzikimarian 3y ago

I assume their customers are vendor-locked to hell. Crazy what people do for convenience.

bri3d 3y ago

What blows my mind is that they've somehow managed to turn relatively minor incidents that aren't even compromises to their core systems into top-of-the-news-cycle meltdowns. The Lapsus$ compromise in 2022 was a third-party IT subcontractor getting their spy-on-the-employees RDP popped, and then Lapsus$ using incredibly limited access to the Okta admin tool to take some screenshots of support dashboards. Honestly it could have been spun into a "hey, our defense in depth pretty much worked!" story. Then, the most recent issue was an employee's third-party password manager getting compromised, allowing an attacker to log in to the support ticket tracker, which happened to contain HAR files with creds in them as well as details on support contacts. I bet a lot of enterprises are vulnerable to this, the HAR file thing is actually a great lesson in a highly unexpected threat vector. But somehow Okta have managed to turn it into a months-long top-of-the-news cycle incident, first by denying the compromise happened at all and then by underplaying the access the threat actor had to the support ticket tracker.

sonicanatidae 3y ago
Drama sells ads. It's the same reason most news stories are shit today. They aren't about conveying information or educating anyone about events in the world. They are clickbait garbage, meant solely to drive traffic in for Ad revenue and in recent history, they are slanted based on a bias that the owner wants, not any sort of factual, unbiased reporting that one may have erroneously expected from the 4th Estate. What a shit world humans have created.
- skilled 3y ago
  That about sums it up. Journalists either washing the dirty laundry of trillion dollar companies or peddling their product launches for the off-chance of a special scoop in the future. The big sites are definitely no more than this, with very few exceptions for opinion pieces, but even those are heavily being guard-railed against all the “politically correct” nonsense.