Okta confirms code breach, but says no customer data was harmed

Authentication giant Okta has now confirmed recent reports of a data breach affecting its internal code

In a press release, the company repeated the points given in a confidential email shared with its security contacts - namely, that someone managed to gain access to the company’s GitHub repository, a breach of which Okta was notified in early December this year. 

After investigating the matter, Okta concluded that someone copied the source code parked in the repository, and moved to secure its premises by placing temporary restrictions and suspending all GitHub integrations with third-party applications.

Okta Workforce Identity Cloud affected

Further investigation uncovered that Okta’s customers were not affected by the incident, including HIPAA, FedRAMP, and DoD customers, therefore, are not required to do anything. “Okta does not rely on the confidentiality of its source code for the security of its services,” the announcement reads. “The Okta service remains fully operational and secure.”

The breach pertains to Okta Workforce Identity Cloud (WIC) code repositories, the company confirmed, adding that it does not pertain to any Auth0 (Customer Identity Cloud) products. 

Law enforcement agencies have been notified, the announcement concludes.

Commenting on the news, Raj Samani, SVP Chief Scientist at Rapid7, said a company's source code is quite valuable, and as such, important to cybercriminals.

"From our own research, we know that intellectual property is a popular target for threat actors with 12% of data disclosures between April 2020 and February 2022 containing it," Samani said. "Stolen source code can be used to find hidden security vulnerabilities and launch further attacks on a business; therefore, it is crucial that such sensitive information is protected.”

This is not Okta’s first rodeo. In March, notorious extortion group Lapsus$ announced it had breached Okta’s administrative consoles and stolen customer data. 

And in September, Auth0 (owned by Okta) reported a similar incident, when a “third-party individual” managed to steal old source code. The method was never established, so it isn't known if any malware was involved.



from TechRadar - All the latest technology news https://ift.tt/W5yKAzS
Share:

No comments:

Post a Comment

Categories

Rove Reviews Youtube Channel

  1. Subscribe to our youtube channel
  2. Like our videos and share them too.
  3. Our youtube channel name Rove reviews.

WITNUX

This website is made by Witnux LLC. This website provides you with all the news feeds related to technology from large tech media industries like GSM Arena, NDTV, Gadgets 360, Firstpost and many other such ates altogether at technical depicts so that you need not go to several sites to view their post provide you advantantage of time.

From the developer
Tanzeel Sarwar

OUR OTHER NETWORKS

OUR YOUTUBE CHANNEL

ROVE REVIEWS PLEASE SUBSCRIBE

OUR FACEBOOK PAGE

The Rove Reviews

Support

Trying our best to provide you the best DONATE or SUPPORTour site Contact me with details how are you gonna help us