TechPrufer
Get started
Dropbox
Dropbox logoDropbox · Feature trail

Phishing Incident Response and Security Controls

2 posts · Jan 2021 – Oct 2022

What this trail covers

Dropbox has experienced a phishing incident targeting GitHub accounts, leading to the compromise of some code repositories. The company responded by disabling access, rotating credentials, and conducting forensic analysis. To enhance security, Dropbox is accelerating the adoption of WebAuthn for multi-factor authentication across its environment to mitigate future phishing attacks. This capability evolves to address evolving threat landscapes and improve the resilience of access controls.

All Dropbox trails
  1. How we handled a recent phishing incident that targeted DropboxThis post details a specific phishing incident where threat actors impersonated CircleCI to gain access to Dropbox's GitHub accounts. The incident resulted in the exfiltration of 130 code repositories containing developer credentials (API keys) and employee/customer/vendor PII. The response involved disabling access, rotating credentials, and engaging external forensic experts. The post highlights the adoption of WebAuthn as a key technical control to prevent similar future incidents, emphasizing its phishing-resistant nature compared to OTP/TOTP.
  2. Lessons learned in incident managementThis post details Dropbox's incident management process, focusing on the SEV (Severity) process for availability incidents. It outlines the roles (IMOC, TLOC, BMOC), the DropSEV tool for declaring incidents, and the three phases of incident response: Detection, Diagnosis, and Recovery. The post highlights the importance of a reliable monitoring system (Vortex), optimized metrics and alerts, and streamlining the incident declaration process to reduce response time. It also touches upon the business impact of downtime and the company's uptime targets.