What Okta’s failures say about the way forward for id safety in 2025

2025 must be the 12 months id suppliers go all in on enhancing each side of software program high quality and safety, together with crimson teaming whereas making their apps extra clear and getting goal about outcomes past requirements.

 Anthropic, OpenAI and different main AI corporations have taken crimson teaming to a brand new stage, revolutionizing their launch processes for the higher. Identification suppliers, together with Okta, have to comply with their lead and do the identical.

Whereas Okta is likely one of the first id administration distributors to join CISA’s Safe by Design pledge, they’re nonetheless struggling to get authentication proper. Okta’s current advisory advised clients that person names of 52 characters might be mixed with saved cache keys, bypassing the necessity to present a password to log in. Okta recommends that clients assembly the pre-conditions ought to examine their Okta System Log for surprising authentications from usernames higher than 52 characters between the interval of July 23, 2024, to October 30, 2024.

Okta factors to its best-in-class report for the adoption of multi-factor authentication (MFA) amongst each customers and directors of Workforce Identification Cloud. That’s desk stakes to guard clients right now and a given to compete on this market.

Google Cloud introduced necessary multi-factor authentication (MFA) for all customers by 2025. Microsoft has additionally made MFA required for Azure beginning in October of this 12 months. “Starting in early 2025, gradual enforcement for MFA at sign-in for Azure CLI, Azure PowerShell, Azure cell app, and Infrastructure as Code (IaC) instruments will start,” in accordance with a current weblog submit.

Okta is getting outcomes with CISA’s Safe by Design

It’s commendable that so many id administration distributors have signed the CISA Safe by Design Pledge. Okta signed in Could of this 12 months, committing to the initiative’s seven safety targets. Whereas Okta continues to make progress, challenges persist. 

Pursuing requirements whereas making an attempt to ship new apps and platform elements is difficult. Extra problematic nonetheless is conserving a various, fast-moving collection of DevOps, software program engineering, QA, crimson groups, product administration and entrepreneurs all coordinated and centered on the launch.  

1. Not being demanding sufficient on the subject of MFA: Okta has reported important will increase in MFA utilization, with 91% of directors and 66% of customers utilizing MFA as of Jan. 2024. In the meantime, extra corporations are making MFA necessary with out counting on a regular for it. Google and Microsoft’s necessary MFA insurance policies spotlight the hole between Okta’s voluntary measures and the {industry}’s new safety customary.

• Vulnerability Administration wants to enhance, beginning with a stable dedication to red-teaming. Okta’s bug bounty program and vulnerability disclosure coverage are, for essentially the most half, clear. The problem they’re dealing with is that their method to vulnerability administration continues to be reactive, relying totally on exterior reviews. Okta additionally wants to speculate extra in crimson teaming to simulate real-world assaults and determine vulnerabilities preemptively. With out crimson teaming, Okta dangers leaving particular assault vectors undetected, probably limiting its capability to deal with rising threats early.

• Logging and monitoring enhancements should be fast-tracked. Okta is enhancing logging and monitoring capabilities for higher safety visibility, however as of Oct. 2024, many enhancements stay incomplete. Vital options like real-time session monitoring and sturdy auditing instruments are nonetheless underneath improvement, which hinders Okta’s capability to offer complete, real-time intrusion detection throughout its platform. These capabilities are important to providing clients quick insights and responses to potential safety incidents.

Okta’s safety missteps present the necessity for extra sturdy vulnerability administration   

Whereas each id administration supplier has had its share of assaults, intrusions and breaches to cope with, it’s fascinating to see how Okta is utilizing them as gas to re-invent itself utilizing CISA’s Safe by Design framework.

Okta’s missteps make a powerful case for increasing their vulnerability administration initiatives, taking the crimson teaming classes discovered from Anthropic, OpenAI and different AI suppliers and making use of them to id administration.

Current incidents Okta has skilled embody:

• March 2021 – Verkada Digital camera Breach: Attackers gained entry to over 150,000 safety cameras, exposing important community safety vulnerabilities.
• January 2022 – LAPSUS$ Group Compromise: The LAPSUS$ cybercriminal group exploited third-party entry to breach Okta’s atmosphere.
• December 2022 – Supply Code Theft: Attackers stole Okta’s supply code, pointing to inside gaps in entry controls and code safety practices. This breach highlighted the necessity for extra stringent inside controls and monitoring mechanisms to safeguard mental property.
• October 2023 – Buyer Assist Breach: Attackers gained unauthorized entry to buyer knowledge of roughly 134 clients by way of Okta’s help channels and was acknowledged by the corporate on October 20, starting with stolen credentials used to achieve entry to its help administration system. From there, attackers gained entry to HTTP Archive (.HAR) information that comprise lively session cookies and commenced breaching Okta’s clients, making an attempt to penetrate their networks and exfiltrate knowledge. 
• October 2024 – Username Authentication Bypass: A safety flaw allowed unauthorized entry by bypassing username-based authentication. The bypass highlighted weaknesses in product testing, because the vulnerability might have been recognized and remediated via extra thorough testing and red-teaming practices.

Purple-teaming methods for future-proofing id safety

Okta and different id administration suppliers want to contemplate how they will enhance crimson teaming impartial of any customary. An enterprise software program firm shouldn’t want a regular to excel at crimson teaming, vulnerability administration or integrating safety throughout its system improvement lifecycles (SDLCs).

Okta and different id administration distributors can enhance their safety posture by taking the crimson teaming classes discovered from Anthropic and OpenAI under and strengthening their safety posture within the course of:   

Intentionally create extra steady, human-machine collaboration on the subject of testing: Anthropic’s mix of human experience with AI-driven crimson teaming uncovers hidden dangers. By simulating assorted assault eventualities in real-time, Okta can proactively determine and handle vulnerabilities earlier within the product lifecycle.

Decide to excel at adaptive id testing: OpenAI’s use of subtle id verification strategies like voice authentication and multimodal cross-validation for detecting deepfakes might encourage Okta to undertake related testing mechanisms. Including an adaptive id testing methodology might additionally assist Okta defend itself towards more and more superior id spoofing threats.

Prioritizing particular domains for crimson teaming retains testing extra centered: Anthropic’s focused testing in specialised areas demonstrates the worth of domain-specific crimson teaming. Okta may gain advantage from assigning devoted groups to high-risk areas, comparable to third-party integrations and buyer help, the place nuanced safety gaps might in any other case go undetected.

Extra automated assault simulations are wanted to stress-test id administration platforms. OpenAI’s GPT-4o mannequin makes use of automated adversarial assaults to continually pressure-test its defenses. Okta might implement related automated eventualities, enabling fast detection and response to new vulnerabilities, particularly in its IPSIE framework.

Decide to extra real-time menace intelligence integration: Anthropic’s real-time information sharing inside crimson groups strengthens their responsiveness. Okta can embed real-time intelligence suggestions loops into its red-teaming processes, guaranteeing that evolving menace knowledge instantly informs defenses and accelerates response to rising dangers.

Why 2025 will problem id safety like by no means earlier than

Adversaries are relentless of their efforts so as to add new, automated weapons to their arsenals, and each enterprise is struggling to maintain up.

With identities being the first goal of nearly all of breaches, id administration suppliers should face the challenges head-on and step up safety throughout each side of their merchandise. That should embody integrating safety into their SDLC and serving to DevOps groups turn out to be conversant in safety so it’s not an afterthought that’s rushed via instantly earlier than launch.

CISA’s Safe by Design initiative is invaluable for each cybersecurity supplier, and that’s particularly the case for id administration distributors. Okta’s experiences with Safe by Design helped them discover gaps in vulnerability administration, logging and monitoring. However Okta shouldn’t cease there. They should go all in on a renewed, extra intense deal with crimson teaming, taking the teachings discovered from Anthropic and OpenAI.

Bettering the accuracy, latency and high quality of information via crimson teaming is the gas any software program firm must create a tradition of steady enchancment. CISA’s Safe by Design is simply the place to begin, not the vacation spot. Identification administration distributors going into 2025 have to see requirements for what they’re: precious frameworks for guiding steady enchancment. Having an skilled, stable crimson group operate that may catch errors earlier than they ship and simulate aggressive assaults from more and more expert and well-funded adversaries is among the many most potent weapons in an id administration supplier’s arsenal. Purple teaming is core to staying aggressive whereas having a combating probability to remain at parity with adversaries.

Author’s word: Particular because of Taryn Plumb for her collaboration and contributions to gathering insights and knowledge.