21/08/2024 | News release | Distributed by Public on 21/08/2024 23:36
In today's increasingly cloud-based world, Identity is the first, and in many cases, only persistent fingerprint enabling a user's access to assets in the organization. As the control plane, Identity spans across the enterprise IT tech stack and intersects the data or access planes of device, network, and application. So it's no wonder Identity is an attractive and common target for attack and compromise.
According to the OWASP Top 10, "Broken Access Control" was the top security risk to web applications, with 94% of applications tested for broken access controls in some form. The attack vector here has evolved over time, with token theft and replay becoming an increasingly common threat vector, especially deployed by Advanced Persistent Threat (APT) actors. Organizations with more sophisticated access verification controls need to be wary of this threat. Some of MITRE's top attack Tactics, Techniques and Procedures (TTPs)for establishing initial access, persistence, executing lateral movement, or privilege escalation in modern environments involve either the compromise of Identity (social engineering, credential brute force, etc.) or targeting the Identity (phishing, business email compromise (BEC)). Attackers rarely employ a single method to achieve their objectives.
Threat actors show increasing proficiency and willingness to launch multi-stage attacks, backed through systematic reconnaissance, that leverage lay-of-the-land techniques and sophisticated tools (a thriving cottage industry of modern SaaS now powered by AI). The stakes are high - Identity Security has a material impact on the bottom line and enduring shareholder value. Last year, the U.S. Securities and Exchange Commission (SEC) adopted the Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosurerule that requires publicly traded companies to disclose material cybersecurity incidents and their cybersecurity risk management, strategy, and governance mechanisms to safeguard investors and markets.
Okta's mission to safelyenable everyone to use any technology has never been more relevant. In the Okta Secure Identity Commitmentreleased earlier this year, we publicly recognized our responsibility to power every Identity use case in a secure framework that safeguards these identities. We believe Identity Threat Protection with Okta AI is an important weapon in the defensive armory that meets many of the security needs of our full spectrum of customers, with a primary focus on continuous protection. We're excited to announce that Identity Threat Protection with Okta AI is now generally available. This is a seminal moment, with many firsts for the industry. Keep reading to learn more.
Identity Threat Detection & Response (ITDR) is often considered the vanguard in Identity Security. First coined in 2022, Gartner defines ITDR as a "discipline,"an IT security operation that organizations fund to safeguard themselves from the expanding landscape of attacks on identities. The goals of ITDR are broadly understood to be:
According to a recent Gartner press release, by 2026 90% of all enterprise organizations will have some embedded product unifying their approach to achieving the goals of ITDR.
While the objectives of ITDR are fairly universal, the activity underpinning these goals has evolved along with the ever-changing IT and security landscape. Thus far, Identity Security has focused on safeguarding the authentication ceremony.
With the cryptographic assurance of Okta Verify FastPass, security at authentication can be considered a technologically solved problem.
Attacker behavior seems to validate this premise: A recent studyby our Data Science team indicated that adopting Okta Verify FastPass directly correlated to a reduced risk of compromised identities.
However, attackers follow the principles of least effort.
If the bar for security at the authentication ceremony is too high, attackers will seek to compromise other facets of the enterprise surface. In a world where compromising identities at authentication becomes an increasingly difficult cryptographic challenge, post-authentication ceremonies become a more attractive area for focussing attack. Recent data indicates that token theft, manipulation, and replay have become increasingly interesting areas for exploitation. Spycloud recently sharedthat they had managed to recapture 1.87 billion session cookie malware records tied to Fortune 1000 employees in 2022. (The total number of session cookie records recaptured was nearly 22 billion.) The nature of token theft as an attack TTP requires compromise of another threat surface (OS, device, browser, etc.) to pivot to the Identity threat surface for compromise. This is a metaphor for the nature of security and the broader attack pattern developing today: Pivoting from less secure threat surfaces in a cloud-based world.
A customer may do everything right and deploy the strongest forms of authentication, yet Identity will only be as strong as the weakest intersecting threat surface among network, device, OS, browser and application. It's this need that Identity Threat Protection seeks to meet. It's an enduring need: We believe that, as the world quickly evolves towards new human-machine planes of interaction and modalities of productivity, financial exchange, and information consumption, identities will always need continuous protection, for instance: at on-ramps, as well as at the intersection of these potential threat surfaces. The enduring focus of Identity Threat Protection will, therefore, be:
While ITDR may always remain a discipline, Identity Threat Protection with Okta AI attempts to unify that discipline with an armory of detection and response tools for customers with every security posture.
Keeping the above long-term focus in perspective, Identity Threat Protection at GA attempts to offer resolutions to the following issues today:
Let's see how the product achieves these goals.
Identity Threat Protection is an ITDR platform that enables continuous protectionfor all your users. It achieves this by
Six feature areas describe the breadth of Identity Threat Protection:
Let's take a look at these feature areas to understand the functionality and value better.
Risk at Okta is defined as the probability of compromise. It's classified into a tristate risk level: low, medium, or high. In Adaptive multi-factor authentication (MFA), risk is calculated at the point of authentication. This is commonly known as login risk.
With Identity Threat Protection, Okta introduces the concept of session risk. Okta's risk engine evaluates every request post-authentication. It checks for changes in IP (zone) and device context. Okta Verify FastPass enables the device signal collection when a request is sent to Okta and periodically thereafter as well. If change or regression to the security state provided at login is discovered in a device, risk and behavior are re-calculated to achieve concurrency with this context.
Here, we must note that, even before we introduced Identity Threat Protection, Okta Verify depended on native signal collection and integration with two of the top device protection offerings in the industry. Okta Verify can ingest CrowdStrike risk scores and Windows Security Center signals to augment the device posture available for policy. CrowdStrike provides endpoint security and threat intelligence, integrating with Okta to detect and respond to threats targeting endpoints.
This integration helps protect devices from malware, ransomware, and other advanced threats by leveraging real-time threat intelligence and automated response capabilities. Windows Security Center offers virus and threat protection, account protection, firewall and network protection, app and browser control, device performance and health, and more, for Windows devices. With Identity Threat Protection, this is now made available for authentication policy re-evaluation. (We delve more into policy re-evaluation in the section: "Continuous Policy Evaluation with Precision Risk Response."
To reduce inaccuracies in risk assertions and enable the risk engine to evolve faster than the attacker, Identity Threat Protection employs advanced heuristics and patent-pending ML to thwart session compromise. Environmental (IP/device) variables are evaluated against known good behavior and the request is assessed for evidence of indicators of compromise (IOC).
Session risk not only helps identify session hijackingbehavior but also undesired behavior occurring in the organization that was not evident thus far, but can now help resolve policy and assurance inconsistencies, triggering remediation & better security posture and outcomes.
There is a case to be made for attack patterns that have a blast radius beyond the scope of an Okta access session. For instance, attempting persistence or brute forcing access to Okta or an app have ramifications that go beyond a session in time. To scope and remediate such attacks, Okta introduced entity risk. Since the user is the first entity we support risk evaluation for, this is also sometimes termed entity user risk. At GA, Identity Threat Protection supports the following natively curated entity user risk detections:
Identity Threat Protection also supports crowdsourcing attacker activity with options for an admin or an end user to report risk and unknown access behavior into the system.
But the product scope doesn't end there. Entity Risk also scopes the reflection of an attack on other threat surfaces (i.e.: device, network, application) as it pertains to the identity.
The objective of Entity Risk is, therefore, not just to detect attacks beyond the scope of an access session but also ensure that organizations using best-of-breed security providers don't suffer from their security products operating in silos that result from single-dimensional, myopic definitions of threat.
Entity Risk as a concept also differentiates from Session Risk by scope and by being more stateful and multidimensional. Thus, it serves as a closer reflection of the true probability of compromise as it pertains to the user.
Entity Risk's multi-dimensionality aims to hinder sophisticated threat actors from laterally moving (pivoting) off threat surfaces at will. This value is delivered through the Shared Signals Pipeline.
Here, we go a step further. In the Session Risk and IP/device context change paradigm, the risk detection mechanism extends only as far as the user interacts with Okta (either directly with the authentication, token, or other Okta endpoint or indirectly, with Okta Verify) within the scope of a session. But, with current advanced persistent threat attack patterns and the nature of multi-stage attacks, we needed to consistently detect attacks beyond the scope of the session, with Entity Risk detections. Entity Risk detections, powered by a mixture of native detections and a Shared Signals Framework (SSF) Pipeline integration with security vendors protecting other threat surfaces, can weed out Identity-based attacks sourced from intersecting, non-Identity threat surfaces.
Today, a typical SSO environment is replete with long-lived tokens and session cookies. Therefore, interactions with the Identity provider can be few and far between.
The idea behind the SSF) Pipeline was based on the principle that security products protecting any threat surface should be able to make holistic risk determinations based on indicators of compromise seen on all intersecting threat surfaces.
The objective, therefore, was to leverage Indicators of Compromise (IoCs) and risk developed on other threat surfaces intersecting with Identity to offer a holistic risk on the entity (user). The security partnership that evolved was one of equals between security events providers and Okta, with each participant benefitting from the ecosystem thus created. Each security events provider, including Okta, can instantiate an SSF transmitter and receiver pair and exchange signals based on an open standard ratified by the Open IDentity Foundation's Shared Signals working group, called Continuous Access Evaluation profile.
CAEP operates within a constrained pub-sub model that enables the continuous publication of (risk/IOC) events as they occur, thus aligning with the goals of truly "continuous protection."
Today, Okta offers integrations using SSF-CAEP that allows signal intelligence sharing with security event providers that are premier names in their practice areas. These include Cloudflare, Jamf, Palo Alto Networks, Rubrik, SGNL, Zimperium, and Zscaler. We've taken care to ensure these partners cover a good balance of threat surfaces (XDR, CASB/ZTNA/SASE, UEM, etc.).
Identity Threat Protection is as much a product as it is an experiment in healthy capitalism. It's proof that security companies can come together successfully and build a product that benefits customers, so the whole is greater than the sum of individual parts. In fact, while Jamf was the first partner to announce integration as a CAEP transmitter with Okta as a CAEP receiver, the idea has built enough momentum for Apple Business Manager to also announce support for this ecosystem. Okta is the first CAEP transmitter partner to announce support for Identity security context exchange with Apple Business Manager via CAEP-SSF. Many of Okta's CAEP transmitter partners have also expressed interest in consuming our CAEP receiver signals. Customers with large Identity footprints have also expressed interest in onboarding in-house curated intelligence signals to SSF so that Entity Risk in their Okta-tenanted organization benefits from this integration. We welcome these developments. An interconnected, best-of-breed world powered by a heterogeneous security stack enables a far more secure landscape, and we're happy to play our humble part in it.
Building out a Shared Signals Framework platform has unleashed incredible synergy. The best part is that customers now have a powerful response to sophisticated threat activity with minimal integration cost.
Shared Signals and Events, with CAEP in Identity Threat Protection with Okta AI, has unleashed hundredsof detectionsacross all enterprise threat surfaces leveraged to protect Identities across diverse IT ecosystems, enabling protection for a variety of use cases. It's so powerful to think that this is just the beginning.
Here are some of those use cases.
Device Management and Compliance:Apple Business Manager integrates with Okta to manage Apple devices across an organization. This helps enforce security policies, manage device configurations, and ensure compliance with organizational standards.
Security Service Edge (SSE):Cloudflare's SSE platform helps organizations secure access, defend against threats, and protect data with Zero Trust principles. By integrating with Okta, organizations can enforce Identity-based access controls for every request across web, private, and SaaS applications, ensuring only authorized users can reach protected resources.
Mobile Device Security:Jamf secures Mac and mobile devices, providing threat detection and response for threats like malware, known vulnerabilities, risky applications, vulnerable OS versions, and more. With Jamf and Okta, only compliant devices can access corporate resources, avoiding unauthorized access.
Cloud Security and Data Protection:Netskope One integrates with Okta to provide insights and control over the core components of an SSE architecture. It helps protect sensitive data by monitoring cloud app usage and enforcing data protection policies. This integration enhances visibility into cloud activities and helps mitigate risks associated with cloud services to extend the Zero Trust perimeter with Okta's Network Zones and the Netskope NewEdge network.
Network and Cloud Security and Threat Detection:Palo Alto Networks' Cortex XSIAM integrates with Okta to provide advanced threat detection and automated response across the network. This helps detect and respond to sophisticated cyberthreats, ensuring comprehensive network security. Furthermore, the Cortex ITDR solution delivers additional value with Okta to identify advanced insider threat capabilities.
Data Security:Rubrik Security Cloud, a data security platform that delivers complete cyber resilience across enterprise, cloud, and SaaS, integrates with Okta to help customers proactively detect changes to users' sensitive data access risk levels and automate remediation.
Access Control and Governance: SGNL provides access control solutions that integrate with Okta to enforce granular access policies and governance rules. This helps ensure that only authorized users have access to sensitive information and systems, reducing the risk of unauthorized access.
Mobile Threat Defense:Mobile Threat Defense (zIPS) monitors and protects mobile devices against advanced threats, including malware and network attacks. This integration ensures mobile devices accessing corporate resources are secure and compliant with security policies.
Internet Security, Threat Prevention, and Lateral Movement:Zscaler Deception uses decoy systems and data to provide high-fidelity early detection of targeted attacks and insider threats. It integrates seamlessly with Okta, sharing detailed attack signals with Okta. This integration enables real-time adaptive access controls, effectively mitigating the risks of lateral movement within the network.
Continuous Risk Evaluation represents only half the value of continuous protection. Continuous Risk Evaluation is coupled with Continuous Policy Evaluation to deliver the multifold benefit of continuous protection. Policy evaluated thus stands to accrue benefits at multiple tiers.
The scale execution of this multi-stage policy evaluation architecture is truly breathtaking and unique to Identity Threat Protection and Okta. This is a true first for the industry. While the magnitude of policy evaluation is, indeed, dictated by the events (entity risk, change in IP, device context, session risk, and behavior) triggering their evaluation, they can only be as effective as the actions configured in them.
Identity Threat Protection offers class-leading and extensible options for Post auth sessions to GSP and Authentication Policy re-evaluation and Entity Risk Policy evaluation.
Okta was one of the first to announce in-line protection for token theft, and now goes one step further, wherein an MFA intercepting session hijacking, when determined as abandoned, results in the revocation of the Okta SSO session cookie, thus forcing reauthentication of all access in token theft scenarios.
The ability to take inline, realtime action constraining access through out-of-band signals is an important product differentiator for Identity Threat Protection.
About a decade or so ago, Okta became the first cloud Identity provider in the industry to offer SSO or "Universal Login." With Identity Threat Protection, Okta is the first to offer Universal Logout across all devices and supported apps.
A first step towards adopting this concept was to get top apps to adopt the Universal Logout charter. Since announcing Early Access, we have expanded our coverage considerably, along with the development of the standard. With Identity Threat Protection now Generally Available, we're happy to announce Universal Logout support for Box, Dropbox for Business, Microsoft Azure, Microsoft Defender for Cloud, Microsoft Defender for Endpoint, Microsoft Defender for O365, Microsoft Dynamics 365, Microsoft O365, Microsoft Power BI, Microsoft Power Platform and Visual Studio, Microsoft Sentinel, Microsoft SQL Server Mgmt Studio, Google Cloud Platform, Google Workspace, Pagerduty, Salesforce, Slack, Zendesk, Zoom, and Surf Security (All Microsoft apps support partial logout. They do not yet support invalidation of app. session cookies. Surf Security support rolls out on August 14th, 2024.)
To achieve outcomes across over 50 applications leveraging over 100 actions, Workflows with Identity Threat Protection offers comprehensive options towards the promise of Identity Threat Response.
Another aspect of response is supporting day-to-day IT-security operations. Identity Threat Protection couples rich reporting dashboards and admin dashboard widgets that advise product deployment and ensure security admins have
The admin journey starts with widgets in the dashboard offering a bird's eye view of session violations, entity user risk, and policy performance.
From there, customers can drill down into any particular area of interest via three reports.
Identity Threat Protection also allows the Identity admin to drill down on the risk developed. The Directory → People → User → {User} page will now show an additional "Risk" tab dedicated to covering risk accrued by the user. Here, an admin can
And there you have it. It's hardly a wrap, though, because we're just getting started. We're immensely proud of this product and excited about the unique value it delivers.
We hope using this product helps you
We'll talk in more detail about how this value is created. This blog also kickstarts a blog series. Watch out for the following blogs that will roll out in the future.
The launch of Identity Threat Protection with Okta AI marks a significant milestone in the hitherto asymmetric fight against cyberthreats. We invite you today to join us on this journey towards a safer online enterprise future. Identity Threat Protectionis a SKU now live for all Workforce Identity Cloud customers in the public cloud. Please note: We are working towards making Identity Threat Protection FedRAMP and DoD Impact Level 4 (IL4) compliant to include this service in our Okta for Government Moderate, Okta for Government High, and Okta for U.S. Military cloud offerings, but Identity Threat Protection has not yet achieved the applicable compliance levels or been audited for inclusion in those regulated environments.
Identity Threat Protection requires you to run Okta Identity Engine, Universal Directory, Single Sign-On, and Adaptive MFA. Identity Threat Protection leverages aspects of Workflows that are met through the complimentary workflows offering available for all Workforce Identity Cloud customers (although you might need to purchase additional Workflows licenses based on your usage). This product is offered to workforce customers only. Mixed orgs will be supported. Education customers will be supported. List pricing is $4 per user per month. Please reach out to your local Okta representative to get more details or to prepare a quote customized to your needs. For a free trial, please reach out to support.
We look forward to delivering Identity Threat Protection to your enterprise.