How Cloudflare mitigated yet another Okta compromise
Oct 20, 2023Sourov Zaman, Lucas Ferreira, Kimberly Hall, Grant Bourzikas
Summary
This post details Cloudflare's response to a security incident where threat actors leveraged a compromised Okta authentication token to pivot into Cloudflare's Okta instance. It highlights the effectiveness of Cloudflare's Security Incident Response Team (SIRT) in detecting the compromise early (over 24 hours before Okta's notification), validating the scope using Zero Trust Access, Gateway, and Data Loss Prevention tools, and containing the incident before any customer data or systems were impacted. The post also provides specific recommendations for Okta and its customers to improve security practices, emphasizing hardware MFA, session management, and comprehensive monitoring.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack