Cloudflare’s investigation of the January 2022 Okta compromise

What this post added

This post details Cloudflare's internal Security Incident Response Team (SIRT) process in response to a compromise of Okta, their identity provider. It outlines the timeline of investigation, actions taken (suspending accounts, forcing password resets), and the technical details of how Cloudflare uses Okta integrated with Cloudflare Access, including the use of hardware tokens and independent log storage for enhanced security. It also provides recommendations for Okta customers.