{"componentChunkName":"component---src-pages-markdown-remark-fields-slug-js","path":"/engineering/okta-and-the-lapsus-breach/","result":{"data":{"markdownRemark":{"id":"8d3dc4bb-0d79-5975-bd3b-dd8eefa2f1fd","excerpt":"Protecting customer data is paramount to every business organization. Even though businesses deploy the most stringent security measures to safeguard data…","html":"

Protecting customer data is paramount to every business organization. Even though businesses deploy the most stringent security measures to safeguard data, malicious actors somehow find security shortcomings to access network systems and cause data breaches, compromising the confidentiality, integrity, and availability of information.

\n

Cybersecurity firms like Okta, which provides identity management solutions and deals in authentication space, make the backbone of an organization's cybersecurity posture. Okta serves 15000+ customers worldwide. The Okta data breach by Lapsus$ is a recent example of what can happen if business organizations depend on third-party solution providers who show laxity in implementing robust cybersecurity strategies, frameworks, and controls.

\n

It is also a cautionary tale for cybersecurity MSPs (Managed Services Providers) and ITSPs (IT Solution Providers) to ensure that they have the best of security controls in place to prevent incidents like this.

\n

What Is Okta?

\n

Okta is an identity platform and offers identity and access management solutions such as Single sign-on (SSO), Multi-Factor Authentication (MFA), etc., for an organization's customers and employees.

\n

Why Is Okta In the News?

\n

Okta’s CSO (Chief Security Officer) David Bradbury recently published an official statement about a support engineer whose computer was accessed by malicious actors for five days in mid-January (between January 16 to 21, 2022) and said they detected the unsuccessful attempt early on.

\n

How Was the Attack Executed?

\n

Okta has now confirmed that malicious actors had access to one of its employees' laptops for five days in January 2022 but maintained there has been no data breach and remains fully operational. However, they concede that around 2.5% of its customers (about 366) might have been affected.

\n

Here is how the attack happened.

\n\n

Who Is Behind Okta’s Breach?

\n

News reports show that a group of unscrupulous actors identifying themselves as Lapsus$ in their Telegram channel was behind this Okta breach. They were aided by a customer support engineer working for a third-party service provider whose laptop was accessed by these hackers to gain vital information. Lapsus$ is also known as a notorious threat actor group — DEV-0537. This group has a history of taking over individual user accounts to drain their crypto holdings at cryptocurrency exchanges.

\n

The Key Reasons That Caused The Security Breach

\n

The forensics report cited by Okta's CSO did not state how the hackers managed to gain access to the support engineer’s laptop, but the fingers point towards negligence by the engineer. However, the hackers claim to have had access to Okta's systems for more than a month before the January 2022 incident. If these claims are valid, it indicates a significant security breach at Okta's network center.

\n

Okta Breach: What Was the Impact?

\n

The Okta breach exposed the security frailties of the Okta network system and put 15,000 Okta customers’ data at risk. However, Okta stated it had contacted the affected 2.5% of customers, appraising them of the matter. Okta further noted that the customers need not take any precautionary measures as their data is safe.

\n

The CSO blog post went on to add that the damage was restricted to the access that support engineers have, such as Jira tickets and lists of users. Though customer support engineers facilitate password resetting and MFA, the hackers did not seem to have obtained this information. The CSO also confirmed that customer service engineers could not create or delete users.

\n

Notably, Okta's customers include high-profile enterprises like FedEx Corporation and Moody's Corporation. Hence, Okta's shares plunged 11% immediately after hackers claimed the breach that has put thousands of Okta customers at risk.

\n

What to Learn From Okta's Cyber Hack?

\n

1) Limit Access on a ‘Need-to-Know’ Basis

\n

Limiting access and permissions to the employees is the first step to take. Employees and contractors should only be provided access on a 'need-to-know' basis and must be provided on a ‘least privilege’ basis (minimum access needed to perform a task or job). For example, support engineers shouldn't be able to access internal HR, accounting, or payroll systems. At the same time, marketing personnel should not have access to network configuration or applications that they do not use.

\n

2) Validate Third-party Apps and SaaS Solutions

\n

In an increasing multi-cloud and hybrid-cloud environment, it's paramount to understand the s IT ecosystem, third-party APIs (Application Programming Interfaces) and applications, and Software as a Service (SaaS) solutions deployed. Requesting SOC reports from vendors and contractors can help understand how their information systems are maintained and secured.

\n

3) Implement Robust IAM-PAM Solutions

\n

Implementing robust processes around Identity and Access Management (IAM) and Privileged Access Management (PAM) can help strengthen the cybersecurity posture by making it almost impossible for attackers to barge into the organization’s periphery.

\n

4) Train Employees and Customers

\n

'People' are the most valuable asset for any organization but can also be the weakest link in the cybersecurity chain. Therefore, organizations must regularly review the processes around training and educating employees, vendor-contractors, customers, and users to follow basic cyber hygiene.

\n

5) Be Vigilant

\n

Organizations must continue to monitor and audit the control environments. Leveraging automated monitoring and alerting tools can help overcome many challenges SOC teams face.

\n

6) Audit and Review Regularly

\n

Organizations should perform internal audits and review the systems and monitor the traffic and access permission more frequently. It is also advisable to engage third-party audit firms to get an external and independent view of the cybersecurity posture.

\n

7) Communicate Transparently

\n

In case of a security incident, it is essential to be transparent to the employees, customers, vendors, and regulators and communicate with them immediately about the incident. Organizations should also provide specific guidance on how to safeguard the information assets.

\n

To Conclude

\n

The Okta breach shows that no business organization is 100% safe from malicious attacks. One simplest security issue is sufficient for malicious actors to wreak havoc.

\n

In this specific example, the hackers accessed the laptop of one of Okta's customer service engineers to gain vital insights into the company's customer data. Such incidents prove that customers can never be sure that their information is safe and leak-proof.

\n

However, it offers a valuable learning experience that business entities should not ignore the minutest of details regarding network security. It surfaces the adage that ' A chain is only as strong as its weakest link.'

\n

\n \n \n

\n","headings":[{"value":"What Is Okta?","depth":2},{"value":"Why Is Okta In the News?","depth":2},{"value":"How Was the Attack Executed?","depth":2},{"value":"Who Is Behind Okta’s Breach?","depth":2},{"value":"The Key Reasons That Caused The Security Breach","depth":2},{"value":"Okta Breach: What Was the Impact?","depth":3},{"value":"What to Learn From Okta's Cyber Hack?","depth":2},{"value":"1) Limit Access on a ‘Need-to-Know’ Basis","depth":3},{"value":"2) Validate Third-party Apps and SaaS Solutions","depth":3},{"value":"3) Implement Robust IAM-PAM Solutions","depth":3},{"value":"4) Train Employees and Customers","depth":3},{"value":"5) Be Vigilant","depth":3},{"value":"6) Audit and Review Regularly","depth":3},{"value":"7) Communicate Transparently","depth":3},{"value":"To Conclude","depth":2}],"fields":{"slug":"/engineering/okta-and-the-lapsus-breach/"},"frontmatter":{"metatitle":null,"metadescription":null,"description":"Businesses have to be extra vigilant in safeguarding customer data. Minor mistakes can cause a massive data breach, violating data privacy regulations and attracting penalties from regulatory authorities.","title":"How Lapsus$ Breached Okta and What Organizations Should Learn","canonical":null,"date":"March 25, 2022","updated_date":null,"tags":["Breach","Cybersecurity"],"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/77821bf8e2f3b044726de88f2494a879/03979/how-lapsus-breached-okta.png","srcSet":"/static/77821bf8e2f3b044726de88f2494a879/f5f11/how-lapsus-breached-okta.png 200w,\n/static/77821bf8e2f3b044726de88f2494a879/6d133/how-lapsus-breached-okta.png 400w,\n/static/77821bf8e2f3b044726de88f2494a879/03979/how-lapsus-breached-okta.png 800w,\n/static/77821bf8e2f3b044726de88f2494a879/aca38/how-lapsus-breached-okta.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Kundan Singh","github":null,"bio":"Director of Product Development @ LoginRadius.","avatar":null}}}},"pageContext":{"id":"8d3dc4bb-0d79-5975-bd3b-dd8eefa2f1fd","fields__slug":"/engineering/okta-and-the-lapsus-breach/","__params":{"fields__slug":"engineering"}}},"staticQueryHashes":["1171199041","1384082988","1711371485","1753898100","2100481360","229320306","23180105","528864852"]}