Okta interviews

“The unauthorized access to Okta’s customer support system leveraged a service account stored in the system itself.”

“Okta Security revokes the Okta session tokens embedded in the HAR files.”

“For a period of 14 days, while actively investigating, Okta did not identify suspicious downloads in our logs.”

“If a user instead navigates directly to the Files tab in the customer support system, as the threat actor did in this attack, they will instead generate an entirely different log event with a different record ID.”

“Okta Security identified a gap in the logs from the customer support system, missing the final hours that the threat actor had access.”