And a follow up to the Okta story. The company clarified in a new blog post that about 2.5% of customers have QUOTE potentially been impacted and whose data may have been viewed or acted upon. We have identified those customers and are contacting them directly. END QUOTE.
that about 2.5% of customers have “potentially been impacted and whose data may have been viewed or acted upon. We have identified those customers and are contacting them directly”.
The company claims that the service was not breached, and that the quote “potential impact to Okta customers is limited to the access that support engineers have. These engineers are unable to create or delete users, or download customer databases. Support engineers do have access to limited data – for example, Jira tickets and lists of users – that were seen in the screenshots. Support engineers are also able to facilitate the resetting of passwords and multi-factor authentication factors for users, but are unable to obtain those passwords.”
As opposed to Microsoft, this leaves some pretty open concerns – particularly about the resetting of passwords and multi-factor authentication. That feels like potential game over for blocking customer access. Note that’s my opinion, not necessarily evidence…. But five days of access to a support engineer’s laptop, which is what was noted, is the concern. The statement noted an “an unsuccessful attempt to compromise the account of a customer support engineer”,
It’s a bit of a mixed message, and thus my takeaway. Transparency helps – knowing what happened allows everyone down the supply chain to understand their own risks. My criticism is that this is causing more confusion… not less. Crisis management 101, be clear with your communications.