Companies must enforce more security on their own third-party providers and retain the ability to conduct independent investigations, experts say.
Identity cloud provider Okta concluded its investigation into a recent breach of its systems by the Lapsus$ extortion group, which gained access to some of the company’s systems through a third-party contract firm and then revealed the compromise in March.
The breach impacted only two customers, with the hackers maintaining control of a single computer at contract firm Sitel for a 25-minute period, Okta said in the postmortem analysis published on Tuesday. While the identity and access management firm had initially considered as many as 366 customers at risk, the impact ended up being far less, David Bradbury, a chief security officer at Okta, stated in the analysis.
The breach caused consternation within the security community because of the lack of notice from Okta and worries that access to the company’s systems could undermine much of the security of its single sign-on (SSO) services — an issue of trust that Bradbury acknowledged.
“While the overall impact of the compromise has been determined to be significantly smaller than we initially scoped, we recognize the broad toll this kind of compromise can have on our customers and their trust in Okta,” he said, adding: “The conclusions from the final forensic report do not lessen our determination to take corrective actions designed to prevent similar events and improve our ability to respond to security incidents.”
To head off attacks in the future, Okta intends to create more stringent security requirements for third-party contractors and have processes in place to confirm compliance. The company has already cut ties with Sitel, according to the postmortem report.
The Okta breach raised the profile of attacks on software supply chains and third-party providers, adding on to lessons from previous compromises such as SolarWinds and Kaseya, says Merritt Maxim, vice president at business intelligence firm Forrester Research. Third-party firms and service providers need to have measures in place to continuously assure customers that their services are secure, he says.
“This is an issue that has to be front and center for security organizations, to push beyond doing just security questionnaires for providers, to doing actual assessments and auditing of third parties,” he says. “Simulate breaches and test your incident response plans, and rather than rely on the vendors to do it perfectly, Read more:https://bit.ly/3ED6HBc
You can also read this: New Report on Okta Hack Reveals the Entire Episode LAPSUS$ Attack