9 ms·

This wasn't really an additional failure at Okta. This was credentials lost during the original Okta compromise that CloudFlare failed to rotate out. Okta dese

This wasn't really an additional failure at Okta. This was credentials lost during the original Okta compromise that CloudFlare failed to rotate out. Okta deserves criticism for their failure, but this feels like CloudFlare punching down to shift blame for a miss on their part.

jamiesonbecker 3y ago
Agreed, but Okta's still a $14B company.
cowsandmilk 3y ago
This wasn’t a new compromise, but there were still two Okta compromises that impacted CloudFlare January 2022: https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/ https://blog.cloudflare.com/cloudflare-investigation-of-the-... October 2023: https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/ https://blog.cloudflare.com/how-cloudflare-mitigated-yet-ano...
bigbluedots 3y ago
> They did this by using one access token and three service account credentials that had been taken, and that we failed to rotate, after the Okta compromise of October 2023 It's fair to "punch down" imo as that's how the credentials were originally compromised. I'd agree with you if CF were trying to minimize their own mistake but that doesn't seem to be what is happening here
- BeefWellington 3y ago
  If a breach is disclosed and some time later your systems are compromised because you didn't bother to take appropriate action in response to that, it's not "fair" to punch down, or even reasonable to do so.
  - cheeze 3y ago
    Okta was painfully negligent, with CF going as far as posting "recommendations for Okta" because it was their only way to get through to them. I don't love CF, but IMO Okta deserves to be punched down on.
    - BeefWellington 3y ago
      Sure but for how long and in what contexts? Is it really reasonable to come out and say your company utterly failed a pretty basic security practice when faced with a compromise but that it was really some other company's problem originally? Of course it's not. It's still your company's failure. Own it.
    - longcat 3y ago
      In both situations Okta and Cloudflare a generic or system account has been compromised. CloudFlare would have had to upload or provide a session tokens or secret to Okta's support system.
sophacles 3y ago
How is Cloudflare ($384M in revenue, q3 2023) punching down at Okta ($584M in revenue, q3 2023) by stating exactly what happened. If anything Okta is a bigger company (by revenue, by employee count) and they were founded a year earlier.

jamiesonbecker 3y ago

Agreed, but Okta's still a $14B company.

cowsandmilk 3y ago

This wasn’t a new compromise, but there were still two Okta compromises that impacted CloudFlare January 2022: https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/ https://blog.cloudflare.com/cloudflare-investigation-of-the-... October 2023: https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/ https://blog.cloudflare.com/how-cloudflare-mitigated-yet-ano...

bigbluedots 3y ago

> They did this by using one access token and three service account credentials that had been taken, and that we failed to rotate, after the Okta compromise of October 2023 It's fair to "punch down" imo as that's how the credentials were originally compromised. I'd agree with you if CF were trying to minimize their own mistake but that doesn't seem to be what is happening here

BeefWellington 3y ago
If a breach is disclosed and some time later your systems are compromised because you didn't bother to take appropriate action in response to that, it's not "fair" to punch down, or even reasonable to do so.
- cheeze 3y ago
  Okta was painfully negligent, with CF going as far as posting "recommendations for Okta" because it was their only way to get through to them. I don't love CF, but IMO Okta deserves to be punched down on.
  - BeefWellington 3y ago
    Sure but for how long and in what contexts? Is it really reasonable to come out and say your company utterly failed a pretty basic security practice when faced with a compromise but that it was really some other company's problem originally? Of course it's not. It's still your company's failure. Own it.
  - longcat 3y ago
    In both situations Okta and Cloudflare a generic or system account has been compromised. CloudFlare would have had to upload or provide a session tokens or secret to Okta's support system.

sophacles 3y ago

How is Cloudflare ($384M in revenue, q3 2023) punching down at Okta ($584M in revenue, q3 2023) by stating exactly what happened. If anything Okta is a bigger company (by revenue, by employee count) and they were founded a year earlier.