The Latest with Okta

Please see the below update from our SOC team and Sophos:

// Overview

Since our last update Okta has provided additional information on the timeline of the incident affecting their services. 

In summary, the Okta service confirmed the breach by Lapsus$ group yesterday. As per Okta's latest blog post, they have confirmed 'The Okta service is fully operational, and there are no corrective actions our customers need to take.' 

They have also concluded that a small percentage of customers - approximately 2.5 percent -  have potentially been impacted and whose data may have been viewed or acted upon. Okta has identified those customers and are contacting them directly. If you are an Okta customer and were impacted, you would have received an email directly from Okta.


// What you should do  

Out of precaution, current Okta customers can follow the steps below to gather and analyze logs related to their Okta deployment. Default retention for Okta logs is 90 days, therefore storing these offline will allow for analysis as additional detail becomes available. 

  • Collect and preserve all Okta logs, focus on the Okta System Log as it's the main audit trail for Oktaactivities. Check https://developer.okta.com/docs/reference/api/system-log/ for more information.

  • Check for (privileged) accounts created around the time of the suspected breach - 21 January 2022 (Since as per the Twitter post by the Okta CEO, there is no evidence of ongoing malicious activity beyond the activity detected in January).

  • Search your audit log for suspicious activity focusing on your superuser/admin Okta accounts as they pose the largest risk.

  • If you outsource (parts) of your Okta deployment, check in with your vendor and make sure what 3rd party admin accounts are used and ask them for assistance.

  • Check if you currently have Okta support access enabled, you may consider disabling this feature for the time being. More information here: https://help.okta.com/oie/en-us/Content/Topics/Settings/settings-support-access.htm


https://www.okta.com/blog/2022/03/updated-okta-statement-on-lapsus/

Jason Kemsley