Chris is the Regional CSO, Americas at Okta, where he is responsible for corporate security compliance, third-party risk, and responding to customer security inquiries. Prior to Okta, Chris spent 6 years leading the adoption of Cloud Technologies at LinkedIn, helping them grow from 350 to over 6,800 employees. He started his career designing, developing, and delivering content management, system administration, and messaging solutions for customers such as Nestle, Cisco, AMD, Telus, and the US Department of Defense. He is also an active member of the Northern California ski community, where he volunteers with the Tahoe Backcountry Ski Patrol performing search & rescue, and teaching ski mountaineering & outdoor survival.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=15&h=16&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=29&h=31&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=58&h=61&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=116&h=122&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=58&h=61&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=15&h=16&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=29&h=31&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=58&h=61&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1QgavuS45zIiNfhq3Y0jk0/d33ec80d3294965b5abd63b453e8b4c6/Chris_Niggel_01_20square.jpg?w=116&h=122&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#b8b8a8","width":58,"height":61}}},{"name":"Brett Winterford","slug":"brett-winterford","jobTitle":"VP, Okta Threat Intelligence","id":"e0099522-136e-5003-b6a5-f4499896bf19","bio":{"bio":"Brett Winterford is Vice President of Okta Threat Intelligence. Okta Threat Intelligence delivers timely, highly relevant and actionable insights about the threat environment, with a focus on identity-based threats. Brett was previously the regional Chief Security Officer for Okta in the Asia Pacific and Japan, and advised business and technology leaders in the region on all things identity. Prior to Okta, Brett held a senior security leadership role at Symantec, and helmed security research, awareness and education at Commonwealth Bank. Brett is also an award-winning journalist, editor-in-chief of iTnews Australia and a contributor to the Risky Business podcast and newsletter, to ZDNet, the Australian Financial Review and the Sydney Morning Herald.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#887808","width":58,"height":47}}}],"title":"Monitoring for Abuse of Administrative Privileges","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"All applications require a highly-privileged administrator role to deploy and maintain that application. The monitoring and oversight (audit) of actions performed by users with these roles is a cornerstone of any well-designed security program.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"A number of research projects have highlighted ways in which the most privileged administrators in Okta could, if unchecked, abuse their privilege in some way. These research efforts serve to reinforce some long-held security principles: most notably the principle of “least privilege,” that a user or application should only have the permissions required to perform a specific role or function, and the principle of governance, where those responsible for holding privileged access are held to account for their actions.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Below we’ve presented some best practice advice on limiting, securing and monitoring administrative access to Okta.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Constrain Privileged Roles\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Security/healthinsight/healthinsight-security-task-recomendations.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta HealthInsight\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" is a tool that prompts administrators to address misconfigurations or conditions identified in their Okta tenant (“org”). One HealthInsight reminder recommends limiting the number of highly privileged roles (“SuperAdmins”) in any given org.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The SuperAdmin role grants its user full privileges to all the powerful administrative capabilities Okta makes available to its customers. A SuperAdmin can manage users, policies, applications and administrative permissions and set org-level security configurations. Every new Okta org is provisioned an account with the ‘SuperAdmin’ role, and the SuperAdmin has the ability to create other admin roles using this account.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"As our colleague Gurinder Bhatti recently \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support-okta.login.adsbillinghub.com/help/s/article/SuperAdmin-Best-Practices\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"blogged\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", with great power comes great responsibility. The majority of tasks an Okta administrator needs to perform do not require SuperAdmin access. For this reason, there are \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Security/administrators-admin-comparison.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"eight other standard admin roles\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" in every Okta org that can be used to constrain administrator access. Your help desk admin doesn’t need the same rights as the admin that manages API access, for example.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"As customer implementations of Okta grow larger and more complex, it creates a requirement to further align administrative capabilities with an individual’s role. To support this need, Okta developed \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Security/custom-admin-role/custom-admin-roles.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Custom Admin Roles\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to allow organizations to set even more granular permissions within a role. So your helpdesk admin might, for example, only be granted permissions relevant to users within a specific functional unit (organization or group), a specific set of duties or specific applications and resources.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/automation-hooks/delegated-flows/about-delegated-flows.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Delegated flows\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", meanwhile, provides administrators the ability to run (but not modify) specified Okta Workflows, without requiring SuperAdmin access.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Secure Admin Access\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Given what an attacker with unauthorized access to highly privileged roles in Okta can do, admin access should be locked down according to the level of risk associated with how that role might be abused.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"SuperAdmin roles should ideally make use of Privileged Access Management solutions that securely \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support-okta.login.adsbillinghub.com/help/s/article/SuperAdmin-Best-Practices\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"store and rotate ephemeral credentials\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Global Session Policies should enforce shorter session durations and idle timeouts for admins versus regular users.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"While the permissions and resources available to any given admin role might vary, access to the Okta Admin Console would nearly always meet the NIST criteria for an AAL2+ and AAL3 application. At minimum, the total session for an admin would expire at 12 hours, with an idle timeout of no greater than 15-30 minutes.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"1GXHZoMkEUj8FaRjIqSovR\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Authentication Policies for access to the Admin Console should at a minimum require:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/articles/2022/09/phishing-resistance-and-why-it-matters\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Phishing Resistant authenticators\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (select “Phishing Resistant” as a possession factor constraint) in a policy that requires any two factor types;\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Access from a trusted \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Security/network/network-zones.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"network zone\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (using an allowlist of trusted IPs/ASNs);\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Access from a \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/devices/devices-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"registered\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" or \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/devices/managed-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"managed\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" device (ideally a device exhibiting a strong security posture); and\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Re-authentication “at every sign-in”.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"RHqTwD9kVcN1R1coDCLwq\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We also recommend enabling the following features in Okta to prevent abuse of stolen administrative sessions:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/content/topics/security/admin-console-protected-actions.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Protected Actions\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"ASN and IP Session Binding\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Auditing and Monitoring Admin Access\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"As employees change roles throughout their employment, it is common that they also amass and retain privileged access to systems and data.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Organizations should perform periodic access reviews of admin role assignments and ensure that privileged access is appropriate for each individual. Okta offers an \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/Reports/admin-role-assignments-report.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"out-of-the-box report\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that provides a snapshot of all admin roles in use.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"2OCKXRSstHC8anFd9vjokr\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Outside of these pre-built reports, privileged access to Okta’s administrative functions can be monitored by security teams using Okta System Log. System Log events can be browsed, searched or filtered in the admin console, queried and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/system-log/#filtering-results\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"filtered\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" programmatically via the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/system-log/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"System Log API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", and can be \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support-okta.login.adsbillinghub.com/help/s/article/Exporting-Okta-Log-Data?language=en_US\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"exported\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" or \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Reports/log-streaming/about-log-streams.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"streamed\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to third-party security monitoring tools.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Given there are over \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/event-types/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"700+ events\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" emitted by System Log, it might seem exhausting to know where to begin monitoring or auditing this access.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"There are a few ways to narrow it down. Keep in mind that most events in System Log follow a similar pattern:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"David Bradbury is Chief Security Officer at Okta. As CSO, he leads overall security execution for the organization and his team is responsible for navigating the evolving threat landscape to best protect employees and customers. In addition, he is instrumental in helping Okta’s customers continue to adopt and accelerate Zero Trust security strategies.
\n\nPrior to joining Okta, Bradbury was Senior Vice President and Chief Security Officer at Symantec where he led and had global oversight of all cyber security and physical security programs.
\n\nBradbury has built an international reputation for leading and delivering cybersecurity at scale. He has worked across his native Australia, as well as in the United Kingdom and the United States, leading highly-regarded security teams at some of the world’s largest banks, including ABN AMRO, Barclays, Morgan Stanley and the Commonwealth Bank of Australia. He holds a B.S. in Computer Science from the University of Sydney.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=15&h=23&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=29&h=44&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=116&h=174&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=15&h=23&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=29&h=44&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=116&h=174&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#e8e8d8","width":58,"height":87}}}],"title":"System Log: a Window into Supporting the Okta Cloud","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Transparency is a core value at Okta.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In April 2022, Okta \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/blog/2022/04/okta-concludes-its-investigation-into-the-january-2022-compromise/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"committed to a range of initiatives\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that aim to drive greater transparency in how we respond to security incidents.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"One of those commitments was to provide our customers with insights into all the things our customer support teams do behind the scenes to deliver the unrivaled experience that is the Okta Identity Cloud.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Under 2.6 in our Security Action Plan:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"“Okta will enhance the Okta System Log so that every customer support activity - even simply viewing configurations - is visible to customers in the log. We will ensure the log includes the user id of the support person performing any actions including but not limited to viewing data and performing impersonation.”\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This was about seizing the opportunity to advance the transparency of cloud operations.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"With this change, our customers will not only have an audit log of any configuration activity they perform in their Admin Console, but also an audit log of activities Okta staff perform in our \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"internal\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" customer support tool, if and when those tasks are relevant to any given customer.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If Okta customer support \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"so much as views\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" a page relevant to a customer’s configuration, it is logged for the customer.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"As of August 1, 2022, two new events started appearing in customer-facing logs:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"hr\",\"data\":{},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"support.org.update\",\"marks\":[{\"type\":\"code\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta has updated the configuration or data within the Org. These actions are typically taken in response to a customer request, such as a request to enable an Early Access feature.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"support.org.view\",\"marks\":[{\"type\":\"code\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta has viewed a page which contains customer data. These actions are typically taken in response to a customer request, such as in the process of investigating an issue raised through a support case.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"hr\",\"data\":{},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"These events include descriptive details about what action was performed, and also why it was performed (included in the supportAction object within the debugContext.debugData object).\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta customers can \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/Reports/syslog-filters.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"browse, search or filter\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" on these events in the Okta Admin Console. They can also be queried and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/system-log/#filtering-results\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"filtered\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" programmatically via the System Log API, and can be \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support-okta.login.adsbillinghub.com/help/s/article/Exporting-Okta-Log-Data?language=en_US\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"exported\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" or \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Reports/log-streaming/about-log-streams.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"streamed\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to third-party security monitoring tools.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"One of the benefits of moving to a cloud service is the ability to hand off many such support tasks. This frees up your employees to perform higher value-add tasks.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"However, the traditional opacity of Cloud Service Providers had made it difficult for organizations to quantify the value and time saved. By offering visibility into the actions performed by Okta’s support agents, these events also offer Okta customers a unique insight into the work it takes to deliver our service. Sometimes the cloud feels like “magic”, but the magic of the experience is as much about the hard work of Oktanauts behind the scenes.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta’s System Log contains over 700 other events that provide transparency into the actions that are occurring within your Org*, and we continue to add visibility to our customers at no additional charge. You can learn more about Okta’s System Log events in our \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/system-log/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"help center\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We hope that this commitment to transparency sets a new benchmark for all SaaS (software-as-a-service) providers.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"An Okta ‘Org’ is synonymous with a tenant - a single customer often has multiple test and production orgs.\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-11T20:34:05.479Z","slug":"/articles/2022/10/human-factor-phishing-resistance","node_locale":"en","date":"2022-10-05T20:23:27+00:00","secAuthor":[{"name":"Brett Winterford","slug":"brett-winterford","jobTitle":"VP, Okta Threat Intelligence","id":"e0099522-136e-5003-b6a5-f4499896bf19","bio":{"bio":"Brett Winterford is Vice President of Okta Threat Intelligence. Okta Threat Intelligence delivers timely, highly relevant and actionable insights about the threat environment, with a focus on identity-based threats. Brett was previously the regional Chief Security Officer for Okta in the Asia Pacific and Japan, and advised business and technology leaders in the region on all things identity. Prior to Okta, Brett held a senior security leadership role at Symantec, and helmed security research, awareness and education at Commonwealth Bank. Brett is also an award-winning journalist, editor-in-chief of iTnews Australia and a contributor to the Risky Business podcast and newsletter, to ZDNet, the Australian Financial Review and the Sydney Morning Herald.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#887808","width":58,"height":47}}}],"title":"The Human Factor in Phishing Resistance","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In the wake of recent security events at Uber and Twilio, organizations are understandably interested in \",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/articles/2022/09/phishing-resistance-and-why-it-matters\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"pivoting to authenticators\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that offer the most resistance to phishing attacks. In this second part of our series on phishing resistance, we consider the human element.\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"All organizations should aspire to a state in which technical and operational controls reduce the burden on end users to identify and respond appropriately to social engineering.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Large numbers of Okta customers are pivoting toward phishing resistant authenticators, as we discussed \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/articles/2022/09/phishing-resistance-and-why-it-matters\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"in part one\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" of this series. Many Okta customers have chosen to limit all user authentication to phishing resistant factors. Typically these are leading edge organizations, “born in the cloud”, that are not locked into legacy technologies.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta’s mission is to enable anyone to use any technology. So we recognize that, by necessity, organizations encumbered by legacy apps will need to support a mix of authenticators for some time into the future. Our policy engine is designed such that these organizations can enforce phishing resistance where it matters most, and only allow weaker (less phishing resistant) authenticators by exception.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"So for most organizations, there remains a need to empower users in the fight against phishing. User empowerment can take many forms, including:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Providing users with sufficient context whenever they sign-in\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Ensuring users are aware of common social engineering techniques\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Providing users with the tools to report suspicious requests\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The power of context\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/scatterswine\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"The Scatter Swine attacks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" of July and August 2022 demonstrated one of the critical limitations in authentication flows that use passwords and OTP (one time password) authenticators. An authentication flow that requires an OTP doesn’t provide opportunities for the user to assess context about the origin of a request.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"A push request can provide this context. Depending on your configuration, an Okta Verify Push request displays a range of information including:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The recorded location of the browser making the request\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The recorded device making the request\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Identity Engine admins can also add further context to each request using a feature now available in Early Access. This adds to each Push request:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"the name of the application requested, and\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"the sign-in URL.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Crucially, if the organization enables Number Challenge (which can be applied to all Push notifications, or only for risky sign-ins), the user also has to verify a random number presented on the sign-in widget.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"475lwmyyqMduuCsDAVhabo\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Verify Push with Number Challenge\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"All of this context can help users identify when an attacker attempts to use stolen credentials to access their account.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The power of training\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"To be effective, users need to be aware of what this context means. That’s where security awareness training comes in. As I’ve \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://symantec-enterprise-blogs.security.com/blogs/feature-stories/5-must-have-elements-include-your-security-awareness-program\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"previously opined\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", learners are more likely to retain and apply advice if it is provided in the context of their daily work, and where opportunities are provided for strong, positive habits to form.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Historically, security awareness training has appropriately focused on the areas of the most heightened risk: password hygiene. Given the increasing prevalence and effectiveness of multi-factor authentication, there is also value in training users about the methods an attacker armed with stolen credentials might employ when attempting to bypass MFA challenges.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The most common social engineering techniques we have observed, and some corresponding learning outcomes to target for your security awareness training, are included in the table below:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"1cdIkKOCHlERWGsujFO1MO\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sample Learning Outcomes\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Introducing \\\"Push Bomb\\\"\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Push Bomb\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" is an example of a learning experience that can be used to raise user awareness about Push Fatigue attacks and teaches them how to assess the context of a Push notification.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Push Bomb\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" is a proof of concept Okta Workflow developed by Solution Engineer Marc Miller that schedules unsolicited push notifications to a defined group of users to test whether they accept, reject or ignore the request. It provides users a first-hand experience of an MFA Fatigue attack, just as phishing simulations do for credential phishing campaigns.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Marc's Workflow (which is not an Okta supported product) does all of the following at the push of a button:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Selects a random percentage of users from a defined Okta Group(s) to test according to an admin-defined schedule;\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Leverages the Okta Factors API to check whether each user is enrolled in Push MFA\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sends a Verify push notification to users and polls for the results at admin-defined intervals, logging whether the user accepts, rejects or ignores the request.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sends the user a message on Slack, Teams or email (customer configurable) to confirm they were subject to the test, and offers further guidance based on user actions.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Prepares a detailed summary report of results for the admin.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"43AlESspXjG6oTOkvNF9wM\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"An End User Notification delivered by the Push Bomb Workflow\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The power of positive reporting\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The most important learning outcome, irrespective of the attacker’s methods, is that users are well practiced in alerting the security team about suspicious behavior via channels that are well monitored.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"One way for users to develop this muscle memory is via phishing simulations. While the focus of these drills can often lean too heavily into identifying “at-risk” users, the most crucial learning outcome is for users to learn how to quickly report suspicious activity to the right place in both simulated and real-world attacks.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Creating easy methods of reporting suspicious activity is critical. \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Suspicious Activity Reporting\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" allows Okta admins to configure their org to email a user whenever their account is accessed from a new device, when a new authenticator (factor) is enrolled or when an existing one is reset. Admins can optionally provide the user a one-click path to reporting a suspicious event from the body of the same email.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Just as training and awareness programs need to anticipate the potential bypass of technical controls, your detection and response capability needs to anticipate that users will fail to recognize or act on social engineering attacks.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The next post in this series on phishing resistance will focus on how to use Okta System Log to detect phishing-related events.\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-07T03:38:57.047Z","slug":"/articles/2022/09/auth0-code-repository-archives-2020-and-earlier","node_locale":"en","date":"2022-09-26T12:39:34+00:00","secAuthor":[{"name":"Auth0","slug":"auth0","jobTitle":"","id":"5a22e442-84ac-51b8-8b5e-3644b2409a03","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=58&h=58&q=50&fm=png","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=15&h=15&q=50&fm=png 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=29&h=29&q=50&fm=png 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=58&h=58&q=50&fm=png 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/2gSAmLiqN9DEQXci1YqBvH/6d0ec38b369d8ae7a7b10ec93fdb664c/Auth0_logo_0.png?w=116&h=116&q=50&fm=png 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":58}}}],"title":"Auth0 Code Repository Archives From 2020 and Earlier","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"content\":[{\"nodeType\":\"text\",\"value\":\"Notification of Auth0 Code Repository Archives Security Event - \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"No Customer Action Required, Auth0 Fully Operational\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}],\"data\":{}},{\"nodeType\":\"paragraph\",\"content\":[{\"nodeType\":\"text\",\"value\":\"In alignment with our core value of transparency, we are communicating about a recent security event related to certain Auth0 archival code repositories; there is no impact to customer data. This does not impact any other Okta products.\",\"marks\":[],\"data\":{}}],\"data\":{}},{\"nodeType\":\"paragraph\",\"content\":[{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://auth0.com/blog/auth0-code-repository-archives-from-2020-and-earlier/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Read more\",\"marks\":[],\"data\":{}}]}],\"data\":{}}]}"}},{"updatedAt":"2024-06-11T20:38:56.695Z","slug":"/articles/2022/09/phishing-resistance-and-why-it-matters","node_locale":"en","date":"2022-09-22T20:47:16+00:00","secAuthor":[{"name":"Brett Winterford","slug":"brett-winterford","jobTitle":"VP, Okta Threat Intelligence","id":"e0099522-136e-5003-b6a5-f4499896bf19","bio":{"bio":"Brett Winterford is Vice President of Okta Threat Intelligence. Okta Threat Intelligence delivers timely, highly relevant and actionable insights about the threat environment, with a focus on identity-based threats. Brett was previously the regional Chief Security Officer for Okta in the Asia Pacific and Japan, and advised business and technology leaders in the region on all things identity. Prior to Okta, Brett held a senior security leadership role at Symantec, and helmed security research, awareness and education at Commonwealth Bank. Brett is also an award-winning journalist, editor-in-chief of iTnews Australia and a contributor to the Risky Business podcast and newsletter, to ZDNet, the Australian Financial Review and the Sydney Morning Herald.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#887808","width":58,"height":47}}}],"title":"Phishing Resistance and Why it Matters","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In the wake of recent security events at Uber and Twilio, organizations are understandably interested in pivoting to authenticators that offer the most resistance to phishing attacks. So what is phishing resistance, and why does it matter?\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Credential theft remains the primary means by which attackers gain unauthorized access to systems. In 2021, over 80 percent of successful attacks on web applications stemmed from credential-based attacks such as phishing, credential stuffing and password sprays. According to the not-for-profit Anti-Phishing Working Group, the first quarter of 2022 saw the highest rate of phishing attacks \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.apwg.org/reports/apwg_trends_report_q1_2022.pdf\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"on record (pdf)\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", with financial services and cloud service providers being targeted the most often.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Multi-factor authentication (MFA) remains the most effective form of protection against all forms of credential theft. MFA limits what an adversary can do with a stolen password, and creates numerous detection opportunities when an adversary attempts to bypass it.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"By definition, MFA should include authenticators with more than two of the following properties:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"something you know (a knowledge factor)\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"something you have (a possession factor)\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"something you are (an inherence factor)\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"There are \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/resources/datasheet-factor-assurance/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"numerous authenticators\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" an Okta administrator can choose from to satisfy those properties in access policies. A spate of successful social engineering attacks has renewed interest in the degree to which any given authenticator is “phishing resistant”. But what exactly is \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"phishing resistance\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Measuring resistance\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Phishing resistance can be viewed in relative or absolute terms. All authenticators offer \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/resources/datasheet-factor-assurance/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"varying degrees of resistance\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to social engineering, as all authenticators impose costs and risks on adversaries seeking to take over an account. For example, Push authenticators offer greater resistance to static credential phishing campaigns than authenticators that rely on One Time Passwords (OTP).\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Combining Push with \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/authenticators/configure-okta-verify-options.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Number Challenge\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", which asks the user verifying a push request to identify a number presented on the sign-in page, offers resistance to a broader set of adversary techniques including \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/everythingisyes\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"“MFA Fatigue” attacks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"But usually when somebody says “phishing resistant”, they are defining it in absolute terms and referring to authenticators that can withstand \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/sessioncookietheft\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"real-time, AiTM phishing attacks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". This narrows the number of authentication choices significantly.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The most reliable definition for phishing resistance is maintained by the US National Institute of Standards and Technology (NIST). According to \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://pages.nist.gov/800-63-FAQ/#q-b04\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"NIST\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", phishing resistance requires that the channel being authenticated is cryptographically bound to the output of the authenticator. In more simple terms, this means that the domain (address) of the website you are signing in to is tied to your authenticator, to ensure it won't issue your credentials to a fake phishing web page.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Several authenticators available in Okta’s platform meet this definition. Okta supports roaming FIDO2 WebAuthn authenticators (security keys) and device-bound FIDO2 WebAuthn authenticators (e.g. FaceID, TouchID, Windows Hello) and also supports the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/blog/2022/08/okta-helps-federal-agencies-deploy-phishing-resistant-mfa/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"use of PIV smart cards as an “external IdP”\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". Depending on your deployment model, FastPass (Okta’s device-bound passwordless authenticator) also meets this definition.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"But given the rate of change in operating systems, browsers and apps (not to mention the constant evolution of adversary tradecraft), it shouldn’t be left to administrators to work out what authentication flows are more or less resistant to phishing. That’s why Okta Identity Engine provides administrators the ability to create application assurance policies that can \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"enforce\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" phishing resistance.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"5ggBWDlzYV6gcq9ZqQvNqc\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In the policy above, for example, access to a particular set of applications is only allowed from a managed device using at least one authenticator that meets the NIST definition for phishing resistance. Over 1.5m Okta users have enrolled in phishing resistant authenticators like WebAuthN today. Early adopters like Figma have \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://twitter.com/frgx/status/1379504541666701313?s=20&t=c41cs60uEK5ReCa71dTnzw\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"rolled out\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" phishing resistant authenticators across their workforce.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Defense in depth\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Irrespective of your authenticator, your access policies should assume there will be scenarios in which a phishing resistant authenticator isn’t available for a given application or for a given user. That’s why we recommend a defense-in-depth approach to phishing prevention, including:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Security awareness programs\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" that teach users how to: Identify the emotive cues social engineers use to pressure users into acting abruptly; Identify suspicious variations on domains used in phishing websites; Report suspicious messages, websites or \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"access requests\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to security teams.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Email and web filtering technologies\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" that can identify and prevent employees from clicking on phishing emails or connecting to phishing websites.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Endpoint security software\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" to protect against malware infection and identify browser-based attacks in which malware is hosted on phishing websites.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Authentication policies\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" that limit access to \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/network/network-zones.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"trusted networks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/guides/devices/devcontext-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"trusted devices\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", with maximum and idle session durations based on the criticality of the application. NIST’s Authenticator Assurance Levels are a good guide:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"AAL1 applications 30 days maximum\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"AAL2 applications: 12 hours maximum AND 30 minutes idle\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"AAL3 applications: 12 hours maximum AND 15 minutes idle\",\"marks\":[],\"data\":{}}]}]}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Detection and response\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" programs that proactively identify phishing websites, identify anomalous login activities and provide an ability to respond to phishing campaigns in-flight.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We will provide more details on how Okta features can be incorporated into your security awareness and detection and response programs in later blog posts in this series.\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-07-11T02:05:27.288Z","slug":"/scatterswine","node_locale":"en","date":"2022-08-25T11:49:59+00:00","secAuthor":[{"name":"Defensive Cyber Operations","slug":"defensive-cyber-operations","jobTitle":"","id":"40144a58-c93f-5b84-895a-5658f212b168","bio":{"bio":"The Defensive Cyber Operations (DCO) team is responsible for detecting and responding to cyber threats that impact Okta or our customers via the Okta platform. Our intelligence-driven capability identifies the adversaries most likely to impact Okta and our customers, and prioritises our defensive capabilities based on the threats most likely to be realised.
"},"image":null}],"title":"Detecting Scatter Swine: Insights into a Relentless Phishing Campaign ","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Summary\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Twilio recently identified unauthorized access to information related to 163 Twilio customers, including Okta. Access was gained to internal Twilio systems, where data of some Okta customers was accessible to a threat actor (detailed below).\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta has determined that a small number of 1) Mobile phone numbers and 2) Associated SMS messages containing one-time passwords (“OTPs”) were accessible to the threat actor via the Twilio console.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta has notified any customers where a phone number was visible in the console at the time the console was accessed.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"There are no actions necessary for customers at this time. Details regarding this access, our response, and best practices can be found below.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In recent months, a number of technology companies were subject to persistent phishing campaigns by a threat actor we refer to as “Scatter Swine”.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta’s Defensive Cyber Operations (DCO) has proactively notified these companies when we have observed phishing infrastructure deployed by this threat actor, among others. It is commonplace for DCO to detect Scatter Swine repeatedly targeting the same organizations with multiple phishing sites within a matter of hours.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"On the evening of Sunday, August 7, 2022, Twilio \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.twilio.com/blog/august-2022-social-engineering-attack\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"disclosed\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that a number of Twilio customer accounts and internal applications were accessed in attacks that resulted from one or more of these phishing campaigns.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta offers customers a range of authenticators to choose from, including the use of SMS for the delivery of one-time codes. Twilio provides one of two services Okta leverages for customers that choose to use SMS as an authentication factor.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"On August 8, 2022, Twilio provided an initial notification to Okta, to inform us that unspecified data relevant to Okta was accessed during Twilio’s incident.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta prioritized routing of SMS-based communications to an alternative provider while we worked with Twilio’s security team to understand the scope and impact of the incident.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The Twilio security team supported our investigation by subsequently providing internal system logs which we were able to use to correlate and identify the extent of the threat actor’s activity as it pertains to Okta customer data.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Using these logs, Okta’s Defensive Cyber Operations’ analysis established that two categories of Okta-relevant mobile phone numbers and one-time passwords were viewable during the time in which the attacker had access to the Twilio console. A one-time passcode is valid for five minutes.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"A \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"primary\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" category (see “Targeted Activity” below) are those mobile phone numbers the threat actor searched for directly in the Twilio console.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"A \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"secondary\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" category (see “Incidental Exposure” below) are mobile phone numbers that can be considered ‘incidental’ to the specific actions or objectives of the threat actor.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta has notified customers with mobile phone numbers in both of the above categories.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-3\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Targeted Activity\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor searched for 38 unique phone numbers in the Twilio console, nearly all of which can be linked to a single targeted organization.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"A review of logs provided to us by Twilio revealed that the threat actor was seeking to expand their access. We assess that the threat actor used credentials (usernames and passwords) previously stolen in phishing campaigns to trigger SMS-based MFA challenges, and used access to Twilio systems to search for One Time Passwords sent in those challenges.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-3\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Incidental Exposure\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The second category of exposed mobile phone numbers were incidental to this activity. Incidental, in this case, can be defined as phone numbers that may have been present in the Twilio portal during the threat actor's limited activity window. Okta's analysis reveals no indication that the threat actor targeted or used such mobile phone numbers.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor performed their searches using Twilio administrative portals that (by default) list the most recent 50 messages sent using Okta’s Twilio account.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta usernames are not visible in Twilio logs.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor took no actions that indicated an intent to use access to this information, an observation we have verified via extensive investigation (described below).\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-3\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Intrusion Analysis\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"After analyzing suspicious activity and identifying key TTPs used by the threat actor, Okta performed threat hunting across our platform logs during the time period that the threat actor was known to have had access to Twilio’s systems. Some example threat hunting searches are provided below.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This exercise uncovered an event in which the threat actor successfully tested this technique against a single account unrelated to the primary target. The threat actor did not perform any additional actions once they had validated this access, and returned to their prior activity.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Outside of this isolated event, there is no evidence that the threat actor successfully used this technique to expand the scope of its access outside of their primary target.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Tactics, Techniques and Procedures\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Scatter Swine has directly targeted Okta via phishing campaigns on several occasions, but was unable to access accounts due to the strong authentication policies that protect access to our applications.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Security has observed the following TTPs (tactics, techniques and procedures) employed by Scatter Swine:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor makes use of infrastructure provided by Bitcoin-friendly provider Bitlaunch, providing servers from DigitalOcean, Vultr, and Linode.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Preferred domain name registrars include Namecheap or Porkbun, both of which accept Bitcoin as payment.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We have observed the threat actor delivering phishing lures in bulk to individuals in targeted organizations via text messages. We are aware of multiple instances where hundreds of messages were sent to employees and even to family members of employees.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor likely harvests mobile phone numbers from commercially available data aggregation services that link phone numbers to employees at specific organizations.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor calls targeted individuals and impersonates support trying to understand how authentication works. The accent of the threat actor appears to be North American, confident and clearly spoken.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor’s targets have included technology companies, telecommunications providers and organizations and individuals linked to cryptocurrency.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor predominately hosts self-contained, HTTP-based phishing infrastructure. Their sites do not use TLS certificates.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If the threat actor successfully harvests user credentials during a SMishing (SMS phishing) campaign, attempts are made to authenticate using anonymizing proxy services. In this particular campaign the threat actor favored Mullvad VPN.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The phishing kit used by the threat actor is designed to capture usernames, passwords and OTP factors. We have also observed the threat actor triggering multiple push notifications in an attempt to trick a target into allowing access to the account.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor has been observed connecting to multiple users from the same Windows device.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor registers domain names in common formats in order to socially engineer targets into entering their credentials into their phishing sites.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-corp.net\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-help.com\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-help.net\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-helpdesk.com\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-login.co\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-mfa.com\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-okta.co\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-okta.com\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-okta.net\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-okta.org\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-okta.us\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-onelogin.com\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-sso.com\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-sso.net\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-vpn.com\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-vpn.net\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"{targeted organization}-vpn.org\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"okta-{targeted organization}.com\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Stepping up your defenses\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Based on our analysis of this intrusion, we recommend that customers embrace a “defense in depth” approach to protecting user accounts from phishing attacks.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Use strong authenticators with the most phishing-resistant properties, such as FIDO2 WebAuthn platform and roaming authenticators and smart cards. Consider FastPass, Okta’s passwordless solution as a longer-term strategy to minimize exposure to credential-based attacks.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Train users to identify indicators of suspicious emails, phishing sites and common social engineering techniques used by attackers. Okta customers can make it easy for users to report potential issues by configuring \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/Security/Security_General.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"End User Notifications\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Suspicious Activity Reporting\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". \",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Authentication policies can be used to restrict user access to applications based on a range of customer-configurable prerequisites.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Use \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/Security/behavior-detection/configure-behavior-detection.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Behavior Detection\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to act (via step-up authentication) or alert (via System Log) when a user’s sign in behavior deviates from a previous pattern of activity. This threat actor is almost always attempting to authenticate from a new device and new IP that has no previous association with the user.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Use \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/network/network-zones.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Network Zones\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to deny or perform step-up authentication on requests from rarely-used networks and anonymizing proxies.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Restrict access to applications to only those \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/guides/devices/devcontext-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"devices\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that are \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/devices/fp/fp-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"registered\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (with Okta FastPass) or devices \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/devices/managed-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"managed\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" by endpoint management tools, and\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Restrict access to the most sensitive applications and data using application-specific authentication policies. Require re-authentication \\\"every time\\\" a user signs into these resources.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Protect administrative sessions: Take a \\\"Zero Standing Privileges\\\" approach to administrative access. Assign administrators \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/content/topics/security/custom-admin-role/custom-admin-roles.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Custom Admin Roles\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" with the least permissions required for daily tasks, and require dual authorization for JIT (just-in-time) access to more privileged roles. Apply ASN and IP Session Binding (from Settings > Features) to all administrative apps to prevent the replay of stolen administrative sessions. Enable \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/content/topics/security/admin-console-protected-actions.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Protected Actions\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (under Settings > Features) to force re-authentication whenever an administrative user attempts to perform sensitive actions.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Talk to your SaaS partners about support for \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/appsofthefuture\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Demonstrating Proof-of-Possession, Continuous Access Evaluation Profile (CAEP) and Universal Logout\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Searching Okta System Log for Scatter Swine TTPs\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The following \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Reports/Reports_SysLog.htm#Filters\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta System Log\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" query searches for SMS events (authentication challenges, password resets or factor enrolment events) from new devices and network locations for a given user, filtered according to known TTPs discovered through the analysis of this campaign.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"eventType sw \\\"system.sms.send\\\" \\nand client.device eq \\\"Computer\\\" \\nand client.userAgent.os sw \\\"Windows\\\" \\nand securityContext.isProxy eq \\\"true\\\" \\nand ((debugContext.debugData.behaviors co \\\"New Device=POSITIVE\\\" and debugContext.debugData.behaviors co \\\"New IP=POSITIVE\\\") \\nOR (debugContext.debugData.logOnlySecurityData co \\\"\\\\\\\"New Device\\\\\\\":\\\\\\\"POSITIVE\\\\\\\"\\\" and debugContext.debugData.logOnlySecurityData co \\\"\\\\\\\"New IP\\\\\\\":\\\\\\\"POSITIVE\\\\\\\"\\\"))\",\"marks\":[{\"type\":\"code\"}],\"data\":{}}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If customers are seeking to check which of these messages transited Twilio, add the following to the query:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"and debugContext.debugData.smsProvider eq \\\"TWILIO\\\"\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Customers using the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://splunkbase.splunk.com/app/6553/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Add-On for Splunk\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" can run a similar search using the following query:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"index=main sourcetype=\\\"OktaIM2:log\\\" eventType=\\\"system.sms.send*\\\" AND\\nclient.device=\\\"Computer\\\" AND \\\"client.userAgent.os\\\"=\\\"Windows*\\\" AND\\n\\\"securityContext.isProxy\\\" = true AND\\n((debugContext.debugData.behaviors=\\\"*New Device=POSITIVE*\\\" AND\\ndebugContext.debugData.behaviors=\\\"*New IP=POSITIVE*\\\") OR\\n(debugContext.debugData.logOnlySecurityData=\\\"*\\\\\\\"New\\nDevice\\\\\\\":\\\\\\\"POSITIVE\\\\\\\"*\\\" AND\\ndebugContext.debugData.logOnlySecurityData=\\\"*\\\\\\\"New IP\\\\\\\":\\\\\\\"POSITIVE\\\\\\\"*\\\"))\",\"marks\":[{\"type\":\"code\"}],\"data\":{}}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Further Threat Hunting\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Using the above TTPs, below is an example query for how you might hunt for potential account takeover attempts.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This is a starting point and should be adjusted for your environment. A filter for securityContext.isProxy eq \\\"true\\\" could reduce the scope of events to review.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Equally, consider that the threat actor is known to use VPS providers that accept Bitcoin as payment. Virtual Private Servers are not classified as proxies.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In the example below, we assume that:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor was NOT using FIDO2/WebAuthn factors.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor was using a Computer with a Windows Operating System.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor made the request using a New Device and New IP for the target user.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The threat actor often uses proxies or other anonymization services.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"debugContext.debugData.factor ne \\\"FIDO_WEBAUTHN\\\" and eventType sw\\n\\\"user.authentication.auth_via\\\" and client.device eq \\\"Computer\\\" and\\nclient.userAgent.os sw \\\"Windows\\\" and ((debugContext.debugData.behaviors\\nco \\\"New Device=POSITIVE\\\" and debugContext.debugData.behaviors co \\\"New\\nIP=POSITIVE\\\") OR (debugContext.debugData.logOnlySecurityData co \\\"\\\\\\\"New\\nDevice\\\\\\\":\\\\\\\"POSITIVE\\\\\\\"\\\" and debugContext.debugData.logOnlySecurityData co\\n\\\"\\\\\\\"New IP\\\\\\\":\\\\\\\"POSITIVE\\\\\\\"\\\"))\",\"marks\":[{\"type\":\"code\"}],\"data\":{}}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"For further advice on searching Okta System Log for suspicious events, see \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support-okta.login.adsbillinghub.com/help/s/article/System-Log-queries-for-attempted-account-takeover?language=en_US\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"this support article\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Change log:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-3\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"1.2 - 03/08/2024\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Updated recommendations to include reauthentication frequency.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Updated recommendations to include new features released as part of Okta Secure Identity Commitment: Protected Actions, ASN/IP Session Binding.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-3\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"1.1 - 08/30/2022\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Detection Logic edited in System Log events to reflect that attributes in logOnlySecurityData are captured in a json format {\\\"Key\\\":\\\"Value\\\"}. Detections that evaluate behaviours (debugContext.debugData.behaviors) take the form of Key=Value and remain unchanged.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-3\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"1.0 - 08/25/2022\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Original version published.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2025-11-05T01:30:04.958Z","slug":"/sessioncookietheft","node_locale":"en","date":"2022-08-09T06:00:56+00:00","secAuthor":[{"name":"Moussa Diallo","slug":"moussa-diallo","jobTitle":"Sr Manager, Identity Threat Research","id":"2d0612d0-ea24-5a48-bed3-797e6306eea4","bio":{"bio":""},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=15&h=15&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=29&h=29&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=58&h=58&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=116&h=116&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=58&h=58&q=50&fm=png","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=15&h=15&q=50&fm=png 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=29&h=29&q=50&fm=png 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=58&h=58&q=50&fm=png 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/1uHU5vrZGhUcNFNAzgylU2/e92b96b2d85e5fb3c5da8a2c1695ddc9/md_profile.png?w=116&h=116&q=50&fm=png 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#181818","width":58,"height":58}}},{"name":"Tim Peel","slug":"tim-peel","jobTitle":"Director, Cyber Threat Research","id":"94fa25fb-5f59-5711-92cc-f79d533ee5e2","bio":{"bio":"Tim Peel leads Cyber Threat Research within Okta's cyber defence team.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=15&h=23&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=29&h=44&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=58&h=87&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=116&h=174&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=58&h=87&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=15&h=23&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=29&h=44&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=58&h=87&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/3VRUhNsn36rqnvpTCbIgnM/c7b494d1e58fd50e1495da6876a8a450/TP_profile_photo.jpg?w=116&h=174&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":87}}},{"name":"Brett Winterford","slug":"brett-winterford","jobTitle":"VP, Okta Threat Intelligence","id":"e0099522-136e-5003-b6a5-f4499896bf19","bio":{"bio":"Brett Winterford is Vice President of Okta Threat Intelligence. Okta Threat Intelligence delivers timely, highly relevant and actionable insights about the threat environment, with a focus on identity-based threats. Brett was previously the regional Chief Security Officer for Okta in the Asia Pacific and Japan, and advised business and technology leaders in the region on all things identity. Prior to Okta, Brett held a senior security leadership role at Symantec, and helmed security research, awareness and education at Commonwealth Bank. Brett is also an award-winning journalist, editor-in-chief of iTnews Australia and a contributor to the Risky Business podcast and newsletter, to ZDNet, the Australian Financial Review and the Sydney Morning Herald.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#887808","width":58,"height":47}}}],"title":"Defending against Session Hijacking","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Multi-factor Authentication (MFA) is very effective at limiting what an adversary can do with a stolen password.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"According to \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"research\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" commissioned by Google in 2019, MFA thwarted 99% of automated credential-based attacks and 93% of phishing campaigns. It remains one of the most essential and effective controls against account takeovers.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In some circumstances (outlined below), MFA can be bypassed. Okta Threat Intelligence has observed the proliferation of malware designed to extract session cookies from the browser of an infected user, and increasing use of phishing techniques designed to bypass authenticators that rely on a shared secret.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Both of these techniques rely on extracting a session cookie from the browser of a legitimate user that has already authenticated to an application.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In this article we will:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Explain how adversaries steal session cookies,\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Discuss how to defend against session cookie theft, and\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Discuss approaches to detecting abuse of session cookies.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"About Session Cookies\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Session cookies are small blocks of data stored in a user’s browser after they sign-in to a web application. The cookie includes an identifier generated by the app that helps keep track of a signed-in user, ensuring they won’t need to sign-in again until the session expires or the user logs out.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If an attacker steals a session cookie and injects it into their browser, they can often access the same session as the legitimate user. The two most common techniques used to steal session cookies are:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Malware infection on a legitimate user’s endpoint, and\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Phishing attacks that use transparent HTTP proxies (adversary-in-the-middle attacks).\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Cookie-hungry Malware\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Many of the most prevalent malware families observed today include ‘infostealer’ modules that have the ability to extract cookies from browser sessions running on an infected machine. The majority of malware families the US Cybersecurity and Infrastructure Security Agency (CISA) listed in its \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.cisa.gov/uscert/ncas/alerts/aa22-216a\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Top 10 Malware Strains of 2021 report\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" are capable of stealing session cookies.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This malware is often deployed via “cracked” (pirated) games or delivered as malspam. Once installed, these modules silently extract cookies, which are in turn bought and sold in dark web forums, occasionally accompanied by tools that attempt to mimic the browser configuration used by the target.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Adversary-in-the-Middle Attacks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Attackers also use social engineering to obtain session cookies by directing users to a malicious website that is configured as a reverse proxy server. These phishing sites are able to relay requests between a targeted user and an impersonated web application. If a user is tricked into signing in to the legitimate web application via one of these malicious sites, the attacker can access the user’s credentials and the session token returned to the browser.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"These attacks can be effective against user accounts protected only by factors that rely on codes sent via SMS, email or authenticator apps.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In any successful attack, the attacker is subject to the constraints of the stolen session: both it's duration and the resources accessible during the session. If the legitimate user logs out (or is logged out by administrators), the session cookie is invalidated.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Defending Against Session Cookie Theft\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The advice below is also available to \",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www-assets-okta.login.adsbillinghub.com/pdfs/sec-okta.login.adsbillinghub.com/Session_Cookie_Infographic_v2.pdf\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"download as an infographic\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Due to the variety of ways session cookies can be stolen, there is no single solution that will prevent their theft. We recommend a “defense in depth” approach to protecting your organization:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Endpoint protection\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" software can protect user devices against malware that extracts session cookies from the user’s browser. Okta offers \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/devices/edr-integration-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"integrations\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" with several EDR vendors that allow administrators to deny authentication requests from devices exhibiting poor security hygiene.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Use \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/articles/2022/09/phishing-resistance-and-why-it-matters\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"strong authenticators\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" such as WebAuthn, U2F keys, smart cards: these offer the strongest resistance to “Adversary-in-the-Middle” attacks. Okta FastPass also offers strong phishing resistance \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/authenticators/configure-authenticators.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"in most deployment scenarios\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Authentication policies\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" can be used to restrict access to user accounts based on a range of customer-configurable prerequisites. We recommend administrators restrict access to applications to only those \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/guides/devices/devcontext-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"devices\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that are \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/devices/fp/fp-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"registered\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (with Okta FastPass) and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/devices/managed-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"managed\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" by Endpoint Management tools, and if they are assessed to have a \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/devices/edr-integration-main.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"strong security posture\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". We also recommend forcing re-authentication every time a sensitive resource is accessed.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Deny or perform step-up authentication on requests to access applications from rarely-used networks. With \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/identity-engine/network/network-zones.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Network Zones\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", access can be limited by location, ASN (Autonomous System Number), IP, and IP-Type (which identifies known anonymizing proxies).\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Use \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/Security/behavior-detection/configure-behavior-detection.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Behavior Detection\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to act (via step-up authentication) or alert (via System Log) when a user’s sign in behavior deviates from a previous pattern of activity.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Fine-tune application session time-outs \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://pages.nist.gov/800-63-3/sp800-63b.html\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"based on the risk\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that unauthorized access to the data poses to the organization. This limits the window available for an attacker to exploit access to stolen session cookies.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/articles/2022/10/human-factor-phishing-resistance\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Train users\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to identify indicators of suspicious emails, phishing sites and common social engineering techniques used by attackers. No matter how advanced the attacker’s infrastructure, most cookie thieves rely on social engineering. Make it easy for users to report potential issues by configuring \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/Security/Security_General.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"End User Notifications\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Suspicious Activity Reporting\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Protect administrative sessions: Take a \\\"Zero Standing Privileges\\\" approach to administrative access. Assign administrators \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/content/topics/security/custom-admin-role/custom-admin-roles.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Custom Admin Roles\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" with the least permissions required for daily tasks, and require dual authorization for JIT (just-in-time) access to more privileged roles. Apply ASN and IP Session Binding (from Settings > Features) to all administrative apps to prevent the replay of stolen administrative sessions. Enable \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/content/topics/security/admin-console-protected-actions.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Protected Actions\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (under Settings > Features) to force re-authentication whenever an administrative user attempts to perform sensitive actions.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Talk to your SaaS partners about support for \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/appsofthefuture\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Demonstrating Proof-of-Possession, Continuous Access Evaluation Profile (CAEP) and Universal Logout\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Detecting Abuse of Session Cookies\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Application Logs often contain the first signs of cookie theft. Authentication and Access Requests to Okta are logged in \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/Reports/Reports_SysLog.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta System Log\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", which can be viewed in the admin console, \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/oie/en-us/Content/Topics/Reports/log-streaming/about-log-streams.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"streamed\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to security analytics tools or programmatically requested using the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/system-log/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"System Log API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"For more advice on common avenues for detection, we recommend the following resources:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/articles/2023/08/telling-more-okta-detection-stories-google-chronicle\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Telling More Okta Detection Stories with Google Chronicle\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/shareddetections\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta and Splunk Combine to Detect Common Attacks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://sec-okta.login.adsbillinghub.com/fastpassphishingdetection\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Detecting Real-Time Phishing Attacks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"When writing detections, try to enumerate the legitimate reasons in your environment why user attributes might change mid-session and alert on anything that remains.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Strongly consider updating incident response playbooks to quickly invalidate active sessions any time a malware infection is detected on an endpoint. Given the prevalence of infostealers in commodity malware campaigns – and considering the relatively minor impact to a user when a session is invalidated – we view this as a pragmatic precaution.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta administrators have several tools available for invalidating a session cookie, which in turn invalidates the session. They can clear a user’s sessions in the admin console (People > Select Person > More Actions > Clear User Sessions), via the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/sessions/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" or from \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/wf/en-us/Content/Topics/Workflows/workflows-main.htm#:~:text=Workflows%20is%20an%20interface%2Ddriven,third%2Dparty%20apps%20and%20functions.\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Workflows\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta admins can only invalidate IdP sessions and the sessions of third-party app providers that support \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en-us/Content/Topics/Apps/Apps_Single_Logout.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Single Log Out\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" as part of their integration with Okta. Ask your SaaS providers about APIs or other features that help alert on a change in user context.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Change Log\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"1.1 - March 8, 2024\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Updated recommendations to include new features released as part of Okta Secure Identity Commitment: Protected Actions, ASN/IP Session Binding.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"1.0 - August 9, 2022\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Original Article Published\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-11T20:46:01.440Z","slug":"/articles/2022/06/unlocking-mystery-700-okta-system-log-events","node_locale":"en","date":"2022-06-01T04:01:21+00:00","secAuthor":[{"name":"James Brodsky","slug":"james-brodsky","jobTitle":"Senior Director, Systems Engineering","id":"94d5712c-dbae-5810-960d-1cd7db5eaec6","bio":{"bio":"I serve as a global resource for Okta’s high-growth solutions engineering organization. I have been at Okta since January, 2022 - but I’m no stranger to the industry! My team brings our customers a better awareness of Okta’s capabilities when it comes to protecting employees and business, increasing your security posture and giving your customers a frictionless-but-safe experience as they interact with you digitally.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=15&h=14&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=29&h=28&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=58&h=55&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=116&h=110&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=58&h=55&q=50&fm=png","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=15&h=14&q=50&fm=png 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=29&h=28&q=50&fm=png 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=58&h=55&q=50&fm=png 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=116&h=110&q=50&fm=png 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":55.00000000000001}}}],"title":"Unlocking the Mystery of 700+ Okta System Log Events","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Update 06-21-2022: Eleven new System Log events have been added to the \",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/stressboi/Okta-Identity-Cloud-for-Splunk/tree/Development\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Github project\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to bring the total number of cataloged events to a lucky 777.\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"When I started writing this post, there were \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/event-types/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"766 potential System Log types\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that can appear in System Log, the logging platform in every Okta administrative console.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"By the time I finished it, there were 768. Things move fast in the cloud.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"While the most important of these events are well documented already, the significance of others are only understood when you \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/event-types/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"look them up\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". There must be an easier way to enrich this data!\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sending System Logs to a SIEM\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The native way to leverage Okta’s System Log is via the Okta Admin console.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta offers numerous ways that System Log can be streamed, exported or programmatically queried. Many Okta customers send the log entries to their log management or SIEM of choice. These logs are provided in nicely formatted nested JSON. System Logs can either be ingested using the Okta System Log API or streamed using Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Reports/log-streaming/about-log-streams.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Log Streaming\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" service, and specific logs can also be sent to an external service using Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/concepts/event-hooks/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Event Hook\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" feature. Partners like \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://databricks.com/blog/2022/04/07/analyzing-okta-logs-with-databricks-lakehouse-platform-to-detect-unusual-activity.html\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Databricks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" have published blog entries on ingesting System Log data, and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/Okta%20Single%20Sign-On/AzureFunctionOktaSSO_V2/AzureFunctionOktaSSO/run.ps1\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Microsoft\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://cloud.google.com/chronicle/docs/ingestion/parser-list/okta_changelog\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Google\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" have published Okta System Log connectors. Splunk has an entire \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://splunkbase.splunk.com/app/3682/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Technical Add-On\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" devoted to Okta System Log, complete with \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.splunk.com/Documentation/CIM/5.0.1/User/Overview\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Common Information Model\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" mapping.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"How Do You Use System Log?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We’ve published a number of resources about Okta System Log to help customers understand the more important entries for security monitoring and common administrative tasks. For example, we have \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"write-ups\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" on the events emitted by \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Security/threat-insight/ti-index.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta ThreatInsight\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and on events that can be used to monitor for \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support-okta.login.adsbillinghub.com/help/s/article/System-Log-queries-for-attempted-account-takeover?language=en_US\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"account takeover attempts\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". This \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://support-okta.login.adsbillinghub.com/help/s/global-search/%40uri?language=en_US#q=system%20log&t=Support&f:ContentTypeFacet=[Knowledge%20base]\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"search link\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" will allow you to see all Okta Knowledge Base articles that reference System Log - there are plenty more gems in there.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Enriched System Log = Added Value\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Many SIEM, security analytics, and log management solutions have ways of adding enrichment to events, either upon ingestion or upon query. Elastic does this \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://medium.com/@carlosrpjunior/logstash-enrich-documents-using-data-from-different-index-615f67141981\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"upon ingestion\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". Microsoft Sentinel has the concept of \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.microsoft.com/en-us/azure/sentinel/watchlists\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"watchlists\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", and IBM’s QRadar provides \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.ibm.com/docs/en/qradar-on-cloud?topic=qradar-types-reference-data-collections\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"reference data sets\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". Google Chronicle offers both: via references or directly in the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"parser\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" during ingestion - more about this later.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Both \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Aboutlookupsandfieldactions\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Splunk\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help.sumologic.com/05Search/Search-Query-Language/Search-Operators/lookup\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sumo Logic\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" call this functionality “lookup tables”. Since Okta maintains a Technical Add-On for Splunk (TA), I thought it might be helpful to \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/stressboi/Okta-Identity-Cloud-for-Splunk/tree/Development\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"extend the existing TA\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to leverage a \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/stressboi/Okta-Identity-Cloud-for-Splunk/blob/Development/lookups/okta_system_log_lookup.csv\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"custom .csv lookup\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that provides significant additional enrichment to System Logs as you search them in Splunk.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"While this is designed for Splunk, the same methodology – and the same .csv file – should be applicable to many other SIEM/log management solutions.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"An important note!\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" Splunk is, at the time of this writing, taking over responsibility from Okta for the Technical Add-On for Splunk. Once this new TA releases in the next month or two, I will evaluate it, and ensure that the .csv file above remains compatible, at which point I will update this post. Also, this new TA will be Splunk Cloud certified.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"What Additional Information Do You Get?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"As you search in Splunk for each of the System Log events defined in the .csv, this solution enriches them automatically with the following new fields, using the field format_event_type as a matching key.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"event_type_description\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": The full-text description of the event.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"event_type_tags\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": The various tags (pipe-delimited) that the event is categorized under, such as “admin” or “oauth2” or “workflows.”\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"admin_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": A field set to “1” if the event is pertaining to admin-level activity, such as the modification of an email template, or the creation of an app sign-on policy.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"security_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": A field set to “1” if the event has particular security interest, such as the identification of a threat within ThreatInsight, or the start of a support technician impersonation session. This incorporates, and extends, the Okta Events categorization found here. (Note: events can be of both admin and security interest.)\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"legacy_event_types\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": The various former event types that mapped to this event, pipe-delimited.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Once this lookup is loaded into Splunk, it can be viewed quickly via the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Inputlookup\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"inputlookup\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" command, as shown below.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"4PMcCaRBswZpkepQiwRnxx\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Splunk console, using inputlookup command\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Leveraging the Additional Info\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"With this lookup in place, Okta admins or security personnel searching this data in Splunk no longer have to pivot out of Splunk and view Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/event-types/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Event Type Catalog\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to understand what an event means, or if it is of admin and/or security interest. Reports, dashboards, and detections can be created leveraging these new fields. Security teams in particular can easily build dashboards of Okta events that are of interest to them, and can create alerts or “notable events” from particularly important security events.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"As an example to get you started, also provided at the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/stressboi/Okta-Identity-Cloud-for-Splunk/tree/Development\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"GitHub link\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" above is a usable dashboard that displays all events of admin or security interest. Multi-select dialogs at the top of the dashboard allow the viewer to select event categories and tags of interest, as well as free-form search the events returned. Here’s a screencap!\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"4JSffAVvKgAYwA5VonXu4B\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sample Dashboard, using enriched events of interest\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"“That’s Nice. But We Don’t Use Splunk….”\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If you don’t use Splunk, you may still leverage the .csv file in order to build your own parser or reference table for the SIEM or log management platform of your choice. We reached out to our friends at Google Cloud Security, who took the .csv file and built it into a new version of the parser that brings Okta System Logs into Google Chronicle.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Chronicle feeds operate much the same as feeds in any other SIEM. However, the capabilities and goals diverge quickly once the data is ingested. In Chronicle, the parser adds metadata fields and populates the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://cloud.google.com/chronicle/docs/reference/udm-field-list\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Universal Data Model\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" fields needed for Chronicle operations to happen on the data. This happens at ingest time, so any time dependent data are added to the meta of that log and are able to persist over the life of the log. If we were to change the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"event_type_description\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\", or \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"security_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" of a log at a later date, the values would remain the same for older logs and be updated for new logs.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Operating within Chronicle, you can use both raw and structured search. When combined with the new fields \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"admin_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"security_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\", structured search allows the operator to quickly select only the relevant logs using Procedural Filtering combined with Prevalence on domain, user, or asset occurrence. Without using a search language, the operator can also find the most frequently occurring username generating logs of \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"security_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\". For more information on enrichment, check out the Chronicle documentation on \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://cloud.google.com/chronicle/docs/investigation/investigate-user\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"user investigation\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Conclusion\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"I hope this foray into enrichment methods helps you get even more use out of this valuable resource.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If you create dashboards based on the additional fields, feel free to create a pull request against the Github project so that we can include it in the repo.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"And if you create enrichment capabilities for another SIEM, I’d love to hear about it - please DM me at \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://twitter.com/james_brodsky\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"@james_brodsky\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-11T20:47:43.253Z","slug":"/articles/2022/03/official-okta-statement-lapsus-claims","node_locale":"en","date":"2022-03-22T09:22:26+00:00","secAuthor":[{"name":"David Bradbury","slug":"david-bradbury","jobTitle":"Chief Security Officer","id":"87a8e5b7-da9e-56f7-95dc-37bd1aaee0d9","bio":{"bio":"David Bradbury is Chief Security Officer at Okta. As CSO, he leads overall security execution for the organization and his team is responsible for navigating the evolving threat landscape to best protect employees and customers. In addition, he is instrumental in helping Okta’s customers continue to adopt and accelerate Zero Trust security strategies.
\n\nPrior to joining Okta, Bradbury was Senior Vice President and Chief Security Officer at Symantec where he led and had global oversight of all cyber security and physical security programs.
\n\nBradbury has built an international reputation for leading and delivering cybersecurity at scale. He has worked across his native Australia, as well as in the United Kingdom and the United States, leading highly-regarded security teams at some of the world’s largest banks, including ABN AMRO, Barclays, Morgan Stanley and the Commonwealth Bank of Australia. He holds a B.S. in Computer Science from the University of Sydney.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=15&h=23&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=29&h=44&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=116&h=174&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=15&h=23&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=29&h=44&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=116&h=174&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#e8e8d8","width":58,"height":87}}}],"title":"Official Okta Statement on LAPSUS$ Claims","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Last updated: 03/22/2022 12.00pm, Pacific Time\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Please note - Following this update all further information will be published at: \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/blog/2022/03/updated-okta-statement-on-lapsus/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"https://www-okta.login.adsbillinghub.com/blog/2022/03/updated-okta-statement-on-lapsus/\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The Okta service has not been breached and remains fully operational. There are no corrective actions that need to be taken by our customers. In January 2022, Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider. As part of our regular procedures, we alerted the provider to the situation, while simultaneously terminating the user’s active Okta sessions and suspending the individual’s account. Following those actions, we shared pertinent information (including suspicious IP addresses) to supplement their investigation, which was supported by a third-party forensics firm.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Following the completion of the service provider’s investigation, we received a report from the forensics firm this week. The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop. This is consistent with the screenshots that we became aware of yesterday.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The potential impact to Okta customers is limited to the access that support engineers have. These engineers are unable to create or delete users, or download customer databases. Support engineers do have access to limited data - for example, Jira tickets and lists of users - that were seen in the screenshots. Support engineers are also able to facilitate the resetting of passwords and Multi Factor Authentication for users, but are unable to obtain those passwords.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We are actively continuing our investigation, including identifying and contacting those customers that may have been impacted. There is no impact to Auth0 customers, and there is no impact to HIPAA and FedRAMP customers.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We take our responsibility to protect and secure our customers' information very seriously. We are deeply committed to transparency and will communicate additional updates when available.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Update (3/22/2022 2.15am, Pacific Time):\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In late January 2022, Okta detected an attempt to compromise the account of a third-party customer support engineer working for one of our sub-processors.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The matter was investigated and contained by the sub-processor.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January.\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-11T20:52:26.059Z","slug":"/articles/2022/03/protection-without-perimeters","node_locale":"en","date":"2022-03-14T00:47:12+00:00","secAuthor":[{"name":"Brett Winterford","slug":"brett-winterford","jobTitle":"VP, Okta Threat Intelligence","id":"e0099522-136e-5003-b6a5-f4499896bf19","bio":{"bio":"Brett Winterford is Vice President of Okta Threat Intelligence. Okta Threat Intelligence delivers timely, highly relevant and actionable insights about the threat environment, with a focus on identity-based threats. Brett was previously the regional Chief Security Officer for Okta in the Asia Pacific and Japan, and advised business and technology leaders in the region on all things identity. Prior to Okta, Brett held a senior security leadership role at Symantec, and helmed security research, awareness and education at Commonwealth Bank. Brett is also an award-winning journalist, editor-in-chief of iTnews Australia and a contributor to the Risky Business podcast and newsletter, to ZDNet, the Australian Financial Review and the Sydney Morning Herald.
"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#887808","width":58,"height":47}}}],"title":"Protection, without perimeters","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Given the premise that “identity is the new perimeter”, we’re often asked about the role network attributes should play in restricting access to applications, servers and data.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Can we, and should we, for example, deny access requests originating in high-risk countries or countries involved in conflict?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The reality is that network context still matters. We can take into account the identity of the network and location our users are authenticating from. If a customer determines that there are no authorized users in a region or country, a least privilege approach might warrant a decision to not allow networks from that region to connect to its applications and data.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The network source of an access request is one of the many attributes that can be dynamically evaluated prior to or during authentication as part of “Zero Trust” approach to security.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In Okta, the building blocks of this assessment are what we call \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Security/Security_Network.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Network Zones\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"1czREiHfXmY6LFeVrvLIZE\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Identity Engine - for illustrative purposes only\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Administrators can configure a network zone by IP (or IP range), which is useful when allowlisting trusted network locations, for example, or denying requests from IPs known to be untrustworthy.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Security/network/create-dynamic-zone.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Dynamic Zones\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" go one step further. These zones are based on a dynamic evaluation of IP attributes, such as what country, organization, or Autonomous System Number (ASN) / Internet Service Provider (ISP) is associated with an IP, whether the IP is associated with known proxies such as TOR, or whether those proxies attempt to anonymize the true source of the request.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Network zones can be taken into account prior to authentication, during authentication, or at any other time the security context of a session is re-evaluated.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Pre-authentication\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Network attributes can first be evaluated during pre-authentication: that is, when a user attempts to load an Okta sign-in page in their browser. Administrators can configure a network zone to limit access to their sign-in page to the trusted locations they expect users to sign-in from.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"During authentication\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"An organization might choose to block access requests from anonymizing proxies, or from ASNs with a poor reputation, or from high-risk countries where they don’t expect to have any legitimate users at pre-authentication. But this approach is less ideal when you need to provision access by exception - such as to a handful of legitimate users in a country or from an ASN where you ordinarily wouldn’t conduct business.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"You might, for example, have a small set of known users with a legitimate reason to authenticate from a country that you would otherwise be considered risky. In these circumstances, network zones can be evaluated \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"during\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" authentication.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"An administrator might, for example, require that users authenticating from a specific network zone(s) meet an additional set of security requirements than those authenticating from a trusted network.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"4swlqRJD34OqT5GHXmBs2B\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Identity Engine - for illustrative purposes only\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta allows for these use-cases to be managed through group membership or user and device attributes. Policies can then require these users to present higher assurance factors (such as those that are device bound, hardware protected, or otherwise phishing resistant). Or they might be limited to only authenticating from a known, registered or managed device, and/or from a device that exhibits specific device posture.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Administrators may also take an “adaptive” approach - applying a differentiated set of access conditions based on an evaluation of risk. How risk scores are calculated varies by organization: Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/risk-events/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Risk Events API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" allows admins to factor in risk scores derived from external signals, such as their third-party security partners. “Out of the box” scores are determined by evaluation of both network reputation and any \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Security/proc-security-behavior-detection.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"changes in user or device behavior\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (new device, new location, new IP, impossible travel, or other factors).\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Administrators can use this breadth of policy and authenticator options to develop “zero trust” access policies from a single control plane. A zero trust approach to security requires a “trust, but verify” approach around any single attribute.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"What does that mean in practice?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We should anticipate a small number of users will choose common passwords and re-use them. Okta allows admins to deny common passwords and apply strong password policies.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We should anticipate that even strong passwords will be reused and occasionally stolen. Use of rate limiting controls on authentication endpoints and allows admins to protect accounts using multifactor authentication.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We should anticipate attackers will attempt to anonymize or spoof their location. Okta provides admins a broad mix of complementary attributes to assess in access policies: everything from behavior detection to device context, high assurance factors and integrations with third party security providers.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"While typically network zones are configured in the Okta administration console, they can also be programmatically managed using Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/zones/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Zones API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". The API provides the ability to poll, create and update network zones. This comes in handy when updating larger sets of IPs across multiple network zones using intelligence gleaned from outside Okta.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Modern internet infrastructure is highly ephemeral, with many IP addresses being rapidly assigned and reassigned to users and devices. Because of this, determining the reputation of any given IP is relatively dynamic and highly contextual. Okta will only block an IP address globally where malicious intent can be inferred with high confidence. We strongly recommend organizations complement it with their own blocklists.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This shapeshifting environment requires a defensive approach that can rapidly assign reputation to an IP as soon as it is observed in attacks. That’s where Okta’s ThreatInsight – and machine learning more generally – can play a role.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"ThreatInsight\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help-okta.login.adsbillinghub.com/en/prod/Content/Topics/Security/threat-insight/about-threatinsight.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"ThreatInsight\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" is a default security capability available to every Okta customer that is designed to detect and block high-volume credential-based attacks that target Okta endpoints.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"ThreatInsight uses heuristics and machine learning to recognise common password spraying, credential stuffing and similar brute-force attacks. Importantly, it harnesses the network effect of the many millions of authentication requests made to thousands of Okta orgs on any given day to provide currency to the reputation of any given IP.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The capability offers a security baseline for all Okta customers, with minimal configuration required. An Okta admin simply selects enforce mode in the Okta Admin Console to automatically deny requests identified as malicious at pre-authentication, or audit mode to tag the malicious request with a higher risk score during authentication or to generate alerts in your SIEM/SOAR.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Security is a Team Sport\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The Okta Identity Cloud can assess all of this context from one control plane and intuitive administration console. But we also view zero trust security as a “team sport”. Okta deliberately constrains our assessment of IP reputation to behaviors observed across the Okta Identity Cloud and the intelligence we consume from trusted partners.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Your security and threat teams have a much better understanding of your cloud and data usage patterns, including your use of Okta. The \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://developer-okta.login.adsbillinghub.com/docs/reference/api/risk-events/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Risk Events API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" offers an ability for administrators to ingest signals from other sources of risk data: such as network service providers with broader visibility, partners that assess risk across an entire Content Delivery Network, specialist providers of bot management services, or data collected by customers themselves. These can augment native Okta capabilities and give customers a larger set of data from which to evaluate the risk of any given request.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This open and neutral approach and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www-okta.login.adsbillinghub.com/blog/2021/04/oktane21-introducing-oktas-new-risk-ecosystem-api-a-fraud-fighting-toolset\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"partnerships\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" with other best-of-breed providers offers the best opportunity for you to provide users with frictionless access to applications and data using a least privilege model across both user and network identities.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Chris Niggel contributed to this article\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]}]}"}}]}},"pageContext":{"limit":10,"skip":80,"numBlogPages":10,"currentPage":9}}, "staticQueryHashes": []}