{
    "componentChunkName": "component---src-templates-blog-blog-list-template-blog-list-template-js",
    "path": "/articles/9",
    "result": {"data":{"allContentfulSecOktaComBlogPost":{"nodes":[{"updatedAt":"2024-06-11T20:46:01.440Z","slug":"/articles/2022/06/unlocking-mystery-700-okta-system-log-events","node_locale":"en","date":"2022-06-01T04:01:21+00:00","secAuthor":[{"name":"James Brodsky","slug":"james-brodsky","jobTitle":"Senior Director, Systems Engineering","id":"94d5712c-dbae-5810-960d-1cd7db5eaec6","bio":{"bio":"<p><span><span><span><span><span><span>I serve as a global resource for Okta’s high-growth solutions engineering organization. I have been at Okta since January, 2022 - but I’m no stranger to the industry! My team brings our customers a better awareness of Okta’s capabilities when it comes to protecting employees and business, increasing your security posture and giving your customers a frictionless-but-safe experience as they interact with you digitally</span></span></span></span></span></span><span><span><span><span><span><span>.</span></span></span></span></span></span></p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=15&h=14&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=29&h=28&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=58&h=55&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=116&h=110&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=58&h=55&q=50&fm=png","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=15&h=14&q=50&fm=png 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=29&h=28&q=50&fm=png 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=58&h=55&q=50&fm=png 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/4S4G7LW5dJLeo3NJyYOBAr/489a0430a1099f23b7a480286a9e1d3f/james_brodsky_okta.png?w=116&h=110&q=50&fm=png 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#f8f8f8","width":58,"height":55.00000000000001}}}],"title":"Unlocking the Mystery of 700+ Okta System Log Events","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Update 06-21-2022: Eleven new System Log events have been added to the \",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/stressboi/Okta-Identity-Cloud-for-Splunk/tree/Development\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Github project\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to bring the total number of cataloged events to a lucky 777.\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"When I started writing this post, there were \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-developer.pixtulate.com/docs/reference/api/event-types/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"766 potential System Log types\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that can appear in System Log, the logging platform in every Okta administrative console.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"By the time I finished it, there were 768. Things move fast in the cloud.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"While the most important of these events are well documented already, the significance of others are only understood when you \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-developer.pixtulate.com/docs/reference/api/event-types/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"look them up\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". There must be an easier way to enrich this data!\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sending System Logs to a SIEM\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The native way to leverage Okta’s System Log is via the Okta Admin console.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta offers numerous ways that System Log can be streamed, exported or programmatically queried. Many Okta customers send the log entries to their log management or SIEM of choice. These logs are provided in nicely formatted nested JSON. System Logs can either be ingested using the Okta System Log API or streamed using Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-help.pixtulate.com/en/prod/Content/Topics/Reports/log-streaming/about-log-streams.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Log Streaming\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" service, and specific logs can also be sent to an external service using Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-developer.pixtulate.com/docs/concepts/event-hooks/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Event Hook\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" feature. Partners like \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://databricks.com/blog/2022/04/07/analyzing-okta-logs-with-databricks-lakehouse-platform-to-detect-unusual-activity.html\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Databricks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" have published blog entries on ingesting System Log data, and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/Okta%20Single%20Sign-On/AzureFunctionOktaSSO_V2/AzureFunctionOktaSSO/run.ps1\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Microsoft\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://cloud.google.com/chronicle/docs/ingestion/parser-list/okta_changelog\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Google\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" have published Okta System Log connectors. Splunk has an entire \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://splunkbase.splunk.com/app/3682/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Technical Add-On\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" devoted to Okta System Log, complete with \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.splunk.com/Documentation/CIM/5.0.1/User/Overview\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Common Information Model\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" mapping.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"How Do You Use System Log?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We’ve published a number of resources about Okta System Log to help customers understand the more important entries for security monitoring and common administrative tasks. For example, we have \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-help.pixtulate.com/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"write-ups\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" on the events emitted by \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-help.pixtulate.com/en/prod/Content/Topics/Security/threat-insight/ti-index.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta ThreatInsight\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and on events that can be used to monitor for \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-support.pixtulate.com/help/s/article/System-Log-queries-for-attempted-account-takeover?language=en_US\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"account takeover attempts\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". This \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-support.pixtulate.com/help/s/global-search/%40uri?language=en_US#q=system%20log&t=Support&f:ContentTypeFacet=[Knowledge%20base]\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"search link\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" will allow you to see all Okta Knowledge Base articles that reference System Log - there are plenty more gems in there.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Enriched System Log = Added Value\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Many SIEM, security analytics, and log management solutions have ways of adding enrichment to events, either upon ingestion or upon query. Elastic does this \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://medium.com/@carlosrpjunior/logstash-enrich-documents-using-data-from-different-index-615f67141981\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"upon ingestion\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". Microsoft Sentinel has the concept of \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.microsoft.com/en-us/azure/sentinel/watchlists\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"watchlists\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", and IBM’s QRadar provides \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.ibm.com/docs/en/qradar-on-cloud?topic=qradar-types-reference-data-collections\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"reference data sets\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". Google Chronicle offers both: via references or directly in the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"parser\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" during ingestion - more about this later.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Both \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Aboutlookupsandfieldactions\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Splunk\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://help.sumologic.com/05Search/Search-Query-Language/Search-Operators/lookup\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sumo Logic\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" call this functionality “lookup tables”. Since Okta maintains a Technical Add-On for Splunk (TA), I thought it might be helpful to \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/stressboi/Okta-Identity-Cloud-for-Splunk/tree/Development\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"extend the existing TA\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to leverage a \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/stressboi/Okta-Identity-Cloud-for-Splunk/blob/Development/lookups/okta_system_log_lookup.csv\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"custom .csv lookup\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that provides significant additional enrichment to System Logs as you search them in Splunk.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"While this is designed for Splunk, the same methodology – and the same .csv file – should be applicable to many other SIEM/log management solutions.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"An important note!\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" Splunk is, at the time of this writing, taking over responsibility from Okta for the Technical Add-On for Splunk. Once this new TA releases in the next month or two, I will evaluate it, and ensure that the .csv file above remains compatible, at which point I will update this post. Also, this new TA will be Splunk Cloud certified.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"What Additional Information Do You Get?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"As you search in Splunk for each of the System Log events defined in the .csv, this solution enriches them automatically with the following new fields, using the field format_event_type as a matching key.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"event_type_description\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": The full-text description of the event.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"event_type_tags\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": The various tags (pipe-delimited) that the event is categorized under, such as “admin” or “oauth2” or “workflows.”\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"admin_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": A field set to “1” if the event is pertaining to admin-level activity, such as the modification of an email template, or the creation of an app sign-on policy.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"security_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": A field set to “1” if the event has particular security interest, such as the identification of a threat within ThreatInsight, or the start of a support technician impersonation session. This incorporates, and extends, the Okta Events categorization found here. (Note: events can be of both admin and security interest.)\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"legacy_event_types\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\": The various former event types that mapped to this event, pipe-delimited.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Once this lookup is loaded into Splunk, it can be viewed quickly via the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Inputlookup\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"inputlookup\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" command, as shown below.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"4PMcCaRBswZpkepQiwRnxx\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Splunk console, using inputlookup command\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Leveraging the Additional Info\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"With this lookup in place, Okta admins or security personnel searching this data in Splunk no longer have to pivot out of Splunk and view Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-developer.pixtulate.com/docs/reference/api/event-types/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Event Type Catalog\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" to understand what an event means, or if it is of admin and/or security interest. Reports, dashboards, and detections can be created leveraging these new fields. Security teams in particular can easily build dashboards of Okta events that are of interest to them, and can create alerts or “notable events” from particularly important security events.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"As an example to get you started, also provided at the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://github.com/stressboi/Okta-Identity-Cloud-for-Splunk/tree/Development\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"GitHub link\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" above is a usable dashboard that displays all events of admin or security interest. Multi-select dialogs at the top of the dashboard allow the viewer to select event categories and tags of interest, as well as free-form search the events returned. Here’s a screencap!\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"4JSffAVvKgAYwA5VonXu4B\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Sample Dashboard, using enriched events of interest\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"“That’s Nice. But We Don’t Use Splunk….”\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If you don’t use Splunk, you may still leverage the .csv file in order to build your own parser or reference table for the SIEM or log management platform of your choice. We reached out to our friends at Google Cloud Security, who took the .csv file and built it into a new version of the parser that brings Okta System Logs into Google Chronicle.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Chronicle feeds operate much the same as feeds in any other SIEM. However, the capabilities and goals diverge quickly once the data is ingested. In Chronicle, the parser adds metadata fields and populates the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://cloud.google.com/chronicle/docs/reference/udm-field-list\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Universal Data Model\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" fields needed for Chronicle operations to happen on the data. This happens at ingest time, so any time dependent data are added to the meta of that log and are able to persist over the life of the log. If we were to change the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"event_type_description\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\", or \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"security_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" of a log at a later date, the values would remain the same for older logs and be updated for new logs.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Operating within Chronicle, you can use both raw and structured search. When combined with the new fields \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"admin_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"security_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\", structured search allows the operator to quickly select only the relevant logs using Procedural Filtering combined with Prevalence on domain, user, or asset occurrence. Without using a search language, the operator can also find the most frequently occurring username generating logs of \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"security_interest\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\". For more information on enrichment, check out the Chronicle documentation on \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://cloud.google.com/chronicle/docs/investigation/investigate-user\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"user investigation\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Conclusion\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"I hope this foray into enrichment methods helps you get even more use out of this valuable resource.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If you create dashboards based on the additional fields, feel free to create a pull request against the Github project so that we can include it in the repo.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"And if you create enrichment capabilities for another SIEM, I’d love to hear about it - please DM me at \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://twitter.com/james_brodsky\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"@james_brodsky\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-11T20:47:43.253Z","slug":"/articles/2022/03/official-okta-statement-lapsus-claims","node_locale":"en","date":"2022-03-22T09:22:26+00:00","secAuthor":[{"name":"David Bradbury","slug":"david-bradbury","jobTitle":"Chief Security Officer","id":"87a8e5b7-da9e-56f7-95dc-37bd1aaee0d9","bio":{"bio":"<p>David Bradbury is Chief Security Officer at Okta. As CSO, he leads overall security execution for the organization and his team is responsible for navigating the evolving threat landscape to best protect employees and customers. In addition, he is instrumental in helping Okta’s customers continue to adopt and accelerate Zero Trust security strategies. </p>\n\n<p>Prior to joining Okta, Bradbury was Senior Vice President and Chief Security Officer at Symantec where he led and had global oversight of all cyber security and physical security programs. </p>\n\n<p>Bradbury has built an international reputation for leading and delivering cybersecurity at scale. He has worked across his native Australia, as well as in the United Kingdom and the United States, leading highly-regarded security teams at some of the world’s largest banks, including ABN AMRO, Barclays, Morgan Stanley and the Commonwealth Bank of Australia. He holds a B.S. in Computer Science from the University of Sydney.</p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=15&h=23&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=29&h=44&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=116&h=174&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=15&h=23&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=29&h=44&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=58&h=87&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/6TmzH9CPucdERKO5GNXf0y/9be194da88159d15d0faa88d84c5f70b/okta_062624_David_Bradbury_0819.jpg?w=116&h=174&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#e8e8d8","width":58,"height":87}}}],"title":"Official Okta Statement on LAPSUS$ Claims","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Last updated: 03/22/2022 12.00pm, Pacific Time\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Please note - Following this update all further information will be published at: \",\"marks\":[{\"type\":\"bold\"}],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-www.pixtulate.com/blog/2022/03/updated-okta-statement-on-lapsus/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"https://okta-www.pixtulate.com/blog/2022/03/updated-okta-statement-on-lapsus/\",\"marks\":[{\"type\":\"bold\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The Okta service has not been breached and remains fully operational. There are no corrective actions that need to be taken by our customers. In January 2022, Okta detected an unsuccessful attempt to compromise the account of a customer support engineer working for a third-party provider. As part of our regular procedures, we alerted the provider to the situation, while simultaneously terminating the user’s active Okta sessions and suspending the individual’s account. Following those actions, we shared pertinent information (including suspicious IP addresses) to supplement their investigation, which was supported by a third-party forensics firm.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Following the completion of the service provider’s investigation, we received a report from the forensics firm this week. The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop. This is consistent with the screenshots that we became aware of yesterday.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The potential impact to Okta customers is limited to the access that support engineers have. These engineers are unable to create or delete users, or download customer databases. Support engineers do have access to limited data - for example, Jira tickets and lists of users - that were seen in the screenshots. Support engineers are also able to facilitate the resetting of passwords and Multi Factor Authentication for users, but are unable to obtain those passwords.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We are actively continuing our investigation, including identifying and contacting those customers that may have been impacted. There is no impact to Auth0 customers, and there is no impact to HIPAA and FedRAMP customers.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We take our responsibility to protect and secure our customers' information very seriously. We are deeply committed to transparency and will communicate additional updates when available.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Update (3/22/2022 2.15am, Pacific Time):\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In late January 2022, Okta detected an attempt to compromise the account of a third-party customer support engineer working for one of our sub-processors.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The matter was investigated and contained by the sub-processor.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January.\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-11T20:52:26.059Z","slug":"/articles/2022/03/protection-without-perimeters","node_locale":"en","date":"2022-03-14T00:47:12+00:00","secAuthor":[{"name":"Brett Winterford","slug":"brett-winterford","jobTitle":"VP, Okta Threat Intelligence","id":"e0099522-136e-5003-b6a5-f4499896bf19","bio":{"bio":"<p>Brett Winterford is Vice President of Okta Threat Intelligence.  Okta Threat Intelligence delivers timely, highly relevant and actionable insights about the threat environment, with a focus on identity-based threats.  Brett was previously the regional Chief Security Officer for Okta in the Asia Pacific and Japan, and advised business and technology leaders in the region on all things identity. </br> Prior to Okta, Brett held a senior security leadership role at Symantec, and helmed security research, awareness and education at Commonwealth Bank.  Brett is also an award-winning journalist, editor-in-chief of iTnews Australia and a contributor to the Risky Business podcast and newsletter, to ZDNet, the Australian Financial Review and the Sydney Morning Herald.</p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#887808","width":58,"height":47}}}],"title":"Protection, without perimeters","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Given the premise that “identity is the new perimeter”, we’re often asked about the role network attributes should play in restricting access to applications, servers and data.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Can we, and should we, for example, deny access requests originating in high-risk countries or countries involved in conflict?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The reality is that network context still matters. We can take into account the identity of the network and location our users are authenticating from. If a customer determines that there are no authorized users in a region or country, a least privilege approach might warrant a decision to not allow networks from that region to connect to its applications and data.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The network source of an access request is one of the many attributes that can be dynamically evaluated prior to or during authentication as part of “Zero Trust” approach to security.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In Okta, the building blocks of this assessment are what we call \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-help.pixtulate.com/en/prod/Content/Topics/Security/Security_Network.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Network Zones\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"1czREiHfXmY6LFeVrvLIZE\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Identity Engine - for illustrative purposes only\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Administrators can configure a network zone by IP (or IP range), which is useful when allowlisting trusted network locations, for example, or denying requests from IPs known to be untrustworthy.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-help.pixtulate.com/en/prod/Content/Topics/Security/network/create-dynamic-zone.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Dynamic Zones\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" go one step further. These zones are based on a dynamic evaluation of IP attributes, such as what country, organization, or Autonomous System Number (ASN) / Internet Service Provider (ISP) is associated with an IP, whether the IP is associated with known proxies such as TOR, or whether those proxies attempt to anonymize the true source of the request.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Network zones can be taken into account prior to authentication, during authentication, or at any other time the security context of a session is re-evaluated.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Pre-authentication\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Network attributes can first be evaluated during pre-authentication: that is, when a user attempts to load an Okta sign-in page in their browser. Administrators can configure a network zone to limit access to their sign-in page to the trusted locations they expect users to sign-in from.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"During authentication\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"An organization might choose to block access requests from anonymizing proxies, or from ASNs with a poor reputation, or from high-risk countries where they don’t expect to have any legitimate users at pre-authentication. But this approach is less ideal when you need to provision access by exception - such as to a handful of legitimate users in a country or from an ASN where you ordinarily wouldn’t conduct business.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"You might, for example, have a small set of known users with a legitimate reason to authenticate from a country that you would otherwise be considered risky. In these circumstances, network zones can be evaluated \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"during\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" authentication.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"An administrator might, for example, require that users authenticating from a specific network zone(s) meet an additional set of security requirements than those authenticating from a trusted network.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"4swlqRJD34OqT5GHXmBs2B\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Identity Engine - for illustrative purposes only\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta allows for these use-cases to be managed through group membership or user and device attributes. Policies can then require these users to present higher assurance factors (such as those that are device bound, hardware protected, or otherwise phishing resistant). Or they might be limited to only authenticating from a known, registered or managed device, and/or from a device that exhibits specific device posture.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Administrators may also take an “adaptive” approach - applying a differentiated set of access conditions based on an evaluation of risk. How risk scores are calculated varies by organization: Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-developer.pixtulate.com/docs/reference/api/risk-events/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Risk Events API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" allows admins to factor in risk scores derived from external signals, such as their third-party security partners. “Out of the box” scores are determined by evaluation of both network reputation and any \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-help.pixtulate.com/en/prod/Content/Topics/Security/proc-security-behavior-detection.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"changes in user or device behavior\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" (new device, new location, new IP, impossible travel, or other factors).\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Administrators can use this breadth of policy and authenticator options to develop “zero trust” access policies from a single control plane. A zero trust approach to security requires a “trust, but verify” approach around any single attribute.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"What does that mean in practice?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"unordered-list\",\"data\":{},\"content\":[{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We should anticipate a small number of users will choose common passwords and re-use them. Okta allows admins to deny common passwords and apply strong password policies.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We should anticipate that even strong passwords will be reused and occasionally stolen. Use of rate limiting controls on authentication endpoints and allows admins to protect accounts using multifactor authentication.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"list-item\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"We should anticipate attackers will attempt to anonymize or spoof their location. Okta provides admins a broad mix of complementary attributes to assess in access policies: everything from behavior detection to device context, high assurance factors and integrations with third party security providers.\",\"marks\":[],\"data\":{}}]}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"While typically network zones are configured in the Okta administration console, they can also be programmatically managed using Okta’s \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-developer.pixtulate.com/docs/reference/api/zones/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Zones API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". The API provides the ability to poll, create and update network zones. This comes in handy when updating larger sets of IPs across multiple network zones using intelligence gleaned from outside Okta.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Modern internet infrastructure is highly ephemeral, with many IP addresses being rapidly assigned and reassigned to users and devices. Because of this, determining the reputation of any given IP is relatively dynamic and highly contextual. Okta will only block an IP address globally where malicious intent can be inferred with high confidence. We strongly recommend organizations complement it with their own blocklists.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This shapeshifting environment requires a defensive approach that can rapidly assign reputation to an IP as soon as it is observed in attacks. That’s where Okta’s ThreatInsight – and machine learning more generally – can play a role.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"ThreatInsight\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-help.pixtulate.com/en/prod/Content/Topics/Security/threat-insight/about-threatinsight.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"ThreatInsight\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" is a default security capability available to every Okta customer that is designed to detect and block high-volume credential-based attacks that target Okta endpoints.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"ThreatInsight uses heuristics and machine learning to recognise common password spraying, credential stuffing and similar brute-force attacks. Importantly, it harnesses the network effect of the many millions of authentication requests made to thousands of Okta orgs on any given day to provide currency to the reputation of any given IP.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The capability offers a security baseline for all Okta customers, with minimal configuration required. An Okta admin simply selects enforce mode in the Okta Admin Console to automatically deny requests identified as malicious at pre-authentication, or audit mode to tag the malicious request with a higher risk score during authentication or to generate alerts in your SIEM/SOAR.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Security is a Team Sport\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The Okta Identity Cloud can assess all of this context from one control plane and intuitive administration console. But we also view zero trust security as a “team sport”. Okta deliberately constrains our assessment of IP reputation to behaviors observed across the Okta Identity Cloud and the intelligence we consume from trusted partners.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Your security and threat teams have a much better understanding of your cloud and data usage patterns, including your use of Okta. The \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-developer.pixtulate.com/docs/reference/api/risk-events/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta Risk Events API\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" offers an ability for administrators to ingest signals from other sources of risk data: such as network service providers with broader visibility, partners that assess risk across an entire Content Delivery Network, specialist providers of bot management services, or data collected by customers themselves. These can augment native Okta capabilities and give customers a larger set of data from which to evaluate the risk of any given request.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This open and neutral approach and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-www.pixtulate.com/blog/2021/04/oktane21-introducing-oktas-new-risk-ecosystem-api-a-fraud-fighting-toolset\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"partnerships\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" with other best-of-breed providers offers the best opportunity for you to provide users with frictionless access to applications and data using a least privilege model across both user and network identities.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Chris Niggel contributed to this article\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-11T20:59:00.307Z","slug":"/weneedtotalkaboutrdp","node_locale":"en","date":"2022-03-08T07:48:54+00:00","secAuthor":[{"name":"Brett Winterford","slug":"brett-winterford","jobTitle":"VP, Okta Threat Intelligence","id":"e0099522-136e-5003-b6a5-f4499896bf19","bio":{"bio":"<p>Brett Winterford is Vice President of Okta Threat Intelligence.  Okta Threat Intelligence delivers timely, highly relevant and actionable insights about the threat environment, with a focus on identity-based threats.  Brett was previously the regional Chief Security Officer for Okta in the Asia Pacific and Japan, and advised business and technology leaders in the region on all things identity. </br> Prior to Okta, Brett held a senior security leadership role at Symantec, and helmed security research, awareness and education at Commonwealth Bank.  Brett is also an award-winning journalist, editor-in-chief of iTnews Australia and a contributor to the Risky Business podcast and newsletter, to ZDNet, the Australian Financial Review and the Sydney Morning Herald.</p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#887808","width":58,"height":47}}}],"title":"We (still) need to talk about RDP","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Quarter by quarter, for three years now, abuse of Remote Desktop Protocol (RDP) has been the \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.coveware.com/blog/2022/2/2/law-enforcement-pressure-forces-ransomware-groups-to-refine-tactics-in-q4-2021\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"most common root cause\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" of all ransomware events.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"It’s no surprise why RDP makes for an attractive target: RDP is the primary vehicle for remote access to Windows servers and is used for administrative functions. It’s the most \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://resources.digitalshadows.com/whitepapers-and-reports/initial-access-brokers-report\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"commonly listed method of remote access\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" sold by initial access brokers.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"According to some \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophos-rdp-exposed-the-threats-thats-already-at-your-door-wp.pdf\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"2019 research [pdf]\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" by Sophos, an open RDP port gets its first connection request somewhere between 90 seconds and 15 hours of being exposed on the internet. Brute forcing RDP is so easy, the researchers noted, that “the criminal gangs who conduct targeted ransomware attacks have almost entirely abandoned alternative methods of network entry.”\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"“In recent years, criminals deploying targeted ransomware like BitPaymer, Ryuk, Matrix, and SamSam have almost completely abandoned other methods of network ingress in favor of using RDP. Gangs like these have the choice of cracking passwords themselves using tools like NLBrute, buying passwords cracked by others, or buying accounts on compromised RDP servers.”\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The situation hasn’t improved much since then. According to a \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.cisa.gov/uscert/ncas/alerts/aa22-040a\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"joint statement\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" released by authorities in the US, UK and Australia in February, ransomware actors assumed that organizations rushing to provide remote access during the first COVID lockdowns would misconfigure RDP. And oh boy, \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://securelist.com/remote-spring-the-rise-of-rdp-bruteforce-attacks/96820/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"were they right\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"All that said, I’ve never been 100% sure about whether there were systemic reasons that made RDP so prone to abuse. Surely, by now, after these hundreds of awareness campaigns and news articles, the collective hygiene practiced by systems administrators has improved to make this sort of abuse less effective?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Today there are a larger number of methods for discovering rogue servers and \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-www.pixtulate.com/video/okta-advanced-server-access/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"locking down RDP\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", while the risks of leaving RDP unprotected have only increased. And yet we aren’t seeing a downward trend in the number of exposed endpoints (or compromised networks) stemming from abuse of RDP. I don’t want to give in to the temptation of just putting it down to “lazy admins” and “miserly CIOs”. There has to be more to it.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"1ksAT1R3oFnjWb3u5yAQ7p\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Source: Shodan.io\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"By a “systemic” reason, I mean a set of conditions that lead to poor security outcomes, as opposed to a specific vulnerability. A systemic reason might be insecure defaults, for example, or indecipherable documentation. It might be essential security tasks that require additional “premium” licenses or for settings to be configured in multiple admin consoles. It’s often a combination of those things.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Recently a few observations made it all click for me.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The first came courtesy of a former Microsoft security engineer dropping a truth-bomb on Twitter. RDP is usually abused using \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://twitter.com/gossithedog/status/1490744610469076998?s=21\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"brute force attacks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\", he noted, because there aren’t any out-of-the-box ways to apply rate limiting to RDP.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"“An entire and large part of the ransomware economy is this singular issue.”\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"And just as I was getting my head around how Microsoft would go about applying rate limiting in a server OS (it’s not trivial), my former colleagues at the Risky Business podcast published a \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://risky.biz/HF15/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"groundbreaking interview\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" with Michael Montaya, CISO of Equinix. Montaya rather bravely gave Risky Business a blow-by-blow account of a ransomware incident at the company. The beachhead for the attack was a brute force attack on an unsanctioned server with RDP exposed to the internet.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"“The configurations that come out of the box in the cloud don’t always follow best practices,” Montaya explained.\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If you combine the constrained ability of security teams to discover open RDP ports in unsanctioned infrastructure, and the unconstrained ability for attackers to test stolen credentials against clients with RDP exposed, it starts to take the shape of a systemic problem.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If you \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.shodan.io/search?query=port%3A3389+%22administrator%22\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"glance at where you find the most Windows servers\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" with RDP open to the internet, it doesn’t marry closely with market share. There seems to be disproportionately more vulnerable servers hosted by managed service providers that rent access to Windows VMs as a “cloud service”. The default settings at these service providers is worthy of analysis.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In this context, it’s just a little tiresome to keep chalking up abuse of RDP to “poor user credential hygiene”. That’s the sort of cop out that’s enabled initial access brokers and ransomware affiliates to thrive for the five years. Our services should, at some level, be configured to anticipate and expect that users will practice poor credential hygiene. At the very least, service providers should offer VMs with inbound connections over RDP blocked by default.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"heading-2\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Keep beating that drum\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Given the known conditions that make RDP so vulnerable, we unfortunately need to keep hammering home the message that admins avoid exposing RDP to the internet in the first place - even if a lot of people are sick of hearing about it.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Inbound connections via RDP should be limited to trusted network sources and protected by multifactor authentication. In a true “zero trust” context, that means MFA is applied even when the admin is already on the network. Better yet, the only trusted source should be a jump host/bastion host that admins must authenticate to first. All authentication via RDP should be \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"logged and monitored\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" for large numbers of unsuccessful logins.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If remote access is absolutely required, an admin should first have to authenticate via a gateway. Bonus points if the solution involves “just in time” access - that is, ephemeral credentials for every session.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"These controls aren’t so difficult to implement, but they can be difficult to sell into IT admins that complain loudly about the slightest inconvenience.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In infosec we expend a lot of time and investment in mitigating numerous “theoretical” risks. It’s disappointing that something as commonplace as the abuse of RDP isn’t flashy enough to warrant more energy.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"So “once more unto the breach”, my infosec friends, there are better ways to secure remote access.\",\"marks\":[],\"data\":{}}]}]}"}},{"updatedAt":"2024-06-11T20:59:41.448Z","slug":"/legacyauthrisk","node_locale":"en","date":"2022-01-27T06:19:29+00:00","secAuthor":[{"name":"Brett Winterford","slug":"brett-winterford","jobTitle":"VP, Okta Threat Intelligence","id":"e0099522-136e-5003-b6a5-f4499896bf19","bio":{"bio":"<p>Brett Winterford is Vice President of Okta Threat Intelligence.  Okta Threat Intelligence delivers timely, highly relevant and actionable insights about the threat environment, with a focus on identity-based threats.  Brett was previously the regional Chief Security Officer for Okta in the Asia Pacific and Japan, and advised business and technology leaders in the region on all things identity. </br> Prior to Okta, Brett held a senior security leadership role at Symantec, and helmed security research, awareness and education at Commonwealth Bank.  Brett is also an award-winning journalist, editor-in-chief of iTnews Australia and a contributor to the Risky Business podcast and newsletter, to ZDNet, the Australian Financial Review and the Sydney Morning Herald.</p>"},"image":{"gatsbyImageData":{"images":{"sources":[{"srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&q=50&fm=webp 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&q=50&fm=webp 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&q=50&fm=webp 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&q=50&fm=webp 116w","sizes":"(min-width: 58px) 58px, 100vw","type":"image/webp"}],"fallback":{"src":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg","srcSet":"https://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=15&h=12&fl=progressive&q=50&fm=jpg 15w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=29&h=24&fl=progressive&q=50&fm=jpg 29w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=58&h=47&fl=progressive&q=50&fm=jpg 58w,\nhttps://images.ctfassets.net/kbkgmx9upatd/5cVIStynit3itWxHA4pv8S/8e8e647b20b34abcaff72ee837cb797c/Brett_20Resized.jpg?w=116&h=94&fl=progressive&q=50&fm=jpg 116w","sizes":"(min-width: 58px) 58px, 100vw"}},"layout":"constrained","backgroundColor":"#887808","width":58,"height":47}}}],"title":"Just How Risky is Legacy Authentication?","sys":{"contentType":{"sys":{"id":"secBlogpost","linkType":"ContentType","type":"Link"}},"type":"Entry"},"summary":null,"body":{"raw":"{\"nodeType\":\"document\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Does your organization still allow users to authenticate to Office 365 or other Microsoft services using only a username and password?\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"If you do, you’re \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-www.pixtulate.com/businesses-at-work/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"53x more likely to be targeted in credential-based attacks\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\". (No, not 53% more likely. It’s 53 times more likely).\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Many organizations (at least one in ten Microsoft customers, \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"as of October 2021\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\") still allow access to the M365 cloud using what Microsoft calls “Legacy Authentication”. In these requests, the client forwards the username and password with the request to the cloud service provider during sign-in. There’s no OAuth2 compatibility, which means no opportunity to apply multi-factor authentication or the rich variety of access policies designed to protect users from common credential-based attacks.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Accounts using legacy authentication are easy pickings for attackers. Billions of stolen usernames and passwords from previous breaches are freely available on online forums (and routinely refreshed for a fee). The “point and shoot” tools to re-purpose them in credential stuffing attacks are cheap and easy to source.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Credential stuffing is a reliable form of attack because the best of us - even when \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://haveibeenpwned.com/Passwords\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"we know\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" we shouldn’t - reuse passwords across different services.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The tools used in credential stuffing and password spray attacks are in the armoury of every category of attacker, and it isn't limited to \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://ag.ny.gov/press-release/2020/attorney-general-james-gets-dunkin-fill-holes-security-reimburse-hacked-customers\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"those motivated by profit\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\".\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In April 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.cisa.gov/uscert/ncas/alerts/aa21-116a\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"warned\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that SVR, an agency of Russia’s Foreign Intelligence Services, has been targeting M365 accounts with legacy authentication enabled using “low and slow” password spray attacks since at least 2018.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"Compromised victims had:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"“enabled logins using legacy single-factor authentication on devices which did not support multi-factor authentication.\\\"\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The FBI noted that this was:\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"blockquote\",\"data\":{},\"content\":[{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"“achieved by spoofing user agent strings to appear to be older versions of mail clients, including Apple’s mail client and old versions of Microsoft Outlook.”\",\"marks\":[],\"data\":{}}]}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"In July 2021, Microsoft \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.microsoft.com/security/blog/2021/10/11/iran-linked-dev-0343-targeting-defense-gis-and-maritime-sectors/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"warned its customers\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" that attackers linked to the Islamic Republic of Iran compromised ~20 organizations in credential stuffing attacks, again by targeting Office365 tenants that allow legacy authentication. Alarmingly, these attackers appeared to have hit a success rate close to 15% (cybercrime groups are known to profit at success rates far lower than 1%).\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"So this year, when I was asked to provide some observations about the threat landscape for Okta’s annual \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-www.pixtulate.com/businesses-at-work\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Businesses At Work\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" report, I recommended they focus on this well-known risk that continues to go unaddressed in too many places.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"My colleague Matt Shancer calculated how often \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-help.pixtulate.com/en/prod/Content/Topics/Security/threat-insight/ti-index.htm\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Okta ThreatInsight\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" flagged legacy authentication requests as suspicious, and compared that to requests made using modern authentication.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"ThreatInsight, for those unfamiliar, is Okta’s native capability for detecting high-volume credential-based attacks. Customers can configure ThreatInsight to block these requests before the attacker gets the chance to authenticate.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"embedded-asset-block\",\"data\":{\"target\":{\"sys\":{\"id\":\"7f11xiJ0UZysW6djYyhNag\",\"type\":\"Link\",\"linkType\":\"Asset\"}}},\"content\":[]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"The results were emphatic. ThreatInsight detections fire far more often on requests made to M365 using legacy authentication. Adversaries specializing in high volume, credential-based attacks (“account checking” services, so to speak) are targeting these services.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This is only one \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"measure of how often these services are targeted\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\". We can confidently say that there is a material reduction in risk available to organizations that disable legacy authentication: while the numbers vary by industry, we found that the average reduction in the ratio of detected threats to legitimate authentications exceeds 99%.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This reduction in risk is amplified when you add the protection multifactor authentication and risk-based access policies offer your users. \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://research.google/pubs/pub48119/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Academic studies\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\" have demonstrated that risk-aware MFA blocks 99.9% of automated, credential-based attacks.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"So if you’re looking to prioritise security projects proven to reduce the risk of compromise, this is an obvious one. Microsoft has (\",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://redmondmag.com/articles/2021/02/04/microsoft-rethinks-plans-to-block-basic-auth.aspx\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"again\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\") set a new date for when it intends to \",\"marks\":[],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://www.bleepingcomputer.com/news/microsoft/microsoft-will-disable-basic-auth-in-exchange-online-in-october-2022/\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"disable legacy authentication to Office 365\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\": October 1, 2022. Every customer of Microsoft cloud services should be assessing their exposure to legacy authentication over the weeks ahead. This requires making sure modern authentication is enabled \",\"marks\":[],\"data\":{}},{\"nodeType\":\"text\",\"value\":\"AND\",\"marks\":[{\"type\":\"bold\"},{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"text\",\"value\":\" that legacy authentication is disabled.\",\"marks\":[],\"data\":{}}]},{\"nodeType\":\"paragraph\",\"data\":{},\"content\":[{\"nodeType\":\"text\",\"value\":\"This post is the second in a three-part series. See our first post, \\\"\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}},{\"nodeType\":\"hyperlink\",\"data\":{\"uri\":\"https://okta-sec.pixtulate.com/articles/2021/09/auditing-your-okta-org-legacy-authentication\"},\"content\":[{\"nodeType\":\"text\",\"value\":\"Auditing your Org for Legacy Authentication\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]},{\"nodeType\":\"text\",\"value\":\"\\\"\",\"marks\":[{\"type\":\"italic\"}],\"data\":{}}]}]}"}}]}},"pageContext":{"limit":10,"skip":80,"numBlogPages":9,"currentPage":9}},
    "staticQueryHashes": []}