MAJOR Identity/security platform HACKED

Okta, a major identity management platform that secures the accounts of thousands of large organizations, has been hacked.
Lapsus$, a group of extortion hackers, published photos of someone in control of an Okta administrative account.

The potential fallout, and number of companies this might affect, could be extreme. We dive into the details.

0:00 Preroll
0:47 Intro
1:46 Okta HACKED
3:26 What Is Okta?
6:39 About The Hack
9:44 'Super-user' admin accounts
12:43 Importance of digital identity
16:36 Hack impact
17:09 3rd party SECURITY HOLE!
27:00 Twitter Poll Results
34:08 Privacybeat Quiz Winner - Nico Silva!
39:19 Show Out and Thanks

Brought to you by NBTV members: Sam Ettaro, Will Sandoval, Naomi Brockwell

(tax-deductible in the US)

Sign up for the free CryptoBeat newsletter here:

Beware of scammers, I will never give you a phone number or reach out to you with investment advice. I do not give investment advice.

Visit the NBTV website:

Watch this video on Odysee!

Here are a bunch of products I like and use. Using these links helps support the channel and future videos!

Recommended Books:

Permanent Record - Edward Snowden

No Place to Hide: Edward Snowden, the NSA, and the U.S. Surveillance State - Glenn Greenwald

What has the government done to our money - Rothbard

Extreme Privacy - Michael Bazzel (The best privacy book I've ever read)

Naomi's Privacy Bag: some of my favorite products to help protect your privacy!

USB-C to ethernet adapter:

Lightening to ethernet adapter:

Faraday bag (signal stopping, to protect your fob, credit card, computer, and phone)

Data Blocker (if you're charging your phone in an unknown port, use this so that no data is transferred)

Computer privacy screen (use your computer in public? Keep your information safe! Choose the size right for your computer)

Phone privacy screen (don't let people in public see your private data, choose the size for your phone)

Camera cover (for computers and phones, so no one can access your camera without you knowing)

Privacy Tip: Turn off your wifi and bluetooth when you're not using them!!! (or don't use them at all)

[richardwoollaston]

Once we have central bank digital currencies, our identities won’t need to be hacked any more. Protest. Use cash. Don’t comply.

[davocc]

Working in an information security division my boss would always say "you can't outsource risk" - yet this is what most firms seem to flog to companies and specific individuals inside these companies. Often they quietly peddle the notion that you can outsource the risk of being held personally liable for a breach and put a few layers between the decision maker and the problem area; not of protective security but of clear blame and responsibility, at least in the short to medium term. Many firms, agencies, government departments, etc. are loathed to go the long route to prosecute this aspect because it's costly financially (and reputation, liability, exposure, etc.). He argued this is why there's quite so much outsourcing and offshoring of the most critical internal elements of the organisation.
The ROAC model may be broken down in the worst way possible but this will start to lose favour the more legislation and legal protections evolve; curiously it's a huge opportunity for 1st world countries to sharply increase their own national security and infrastructure integrity while increasing local economic activity and reputation/assurance levels. Sharply tighten and localise these protection requirements and you end up driving activity and business towards you (with the tax revenue that comes along with this), the UK have been doing this with banking, regulatory and legal frameworks for centuries.
I'd argue that information security and information management (indeed almost all of IT generally) is way behind in this regard; it needs tighter legislative requirements and needs them fast, perhaps not all in one big hit but brought on in a relatively short timeframe, enough to sharply steer strategic and c-suite-level decisions.
Break down the quietly implied parts of service marketing with some clear and strong legislation and bingo, you get much more local control, authority, economic activity, expertise, responsiveness, local responsibility and local ownership of the industry itself. Keep your friends close, your enemies closer and your infrastructure even closer than that as it were.

[middle_pickup]

It's almost like we need federal regulations mandating the only person who can own a user's data is themselves, and protect that data like HIPA does.

[gefginn]

Great post Naomi. Much love, care and blessings to you and your team/ channel. Stay safe, free, happy and healthy my friend. 😇💪🥰🤗💛

[chloefletcher]

Yes, definitely heard of okta. We considered using them for MFA, because I work with some educational institutions and okta has quite a footprint in that vertical, but ended up sticking with Microsoft (Azure AD SSO) + MFA + Duo Security.

[j]

You make a good point Naomi maybe we need a good 4 or 5 digital identies so nobody really knows who we are.

[Jonesybabie]

I'm familiar with Okta. So this is going to hurt a bit, on an enterprise level. Ouch 😬

[esoteric_teachings]

I came for the accent, stayed for the info...grazie!

[IndSovU]

Gosh, a giant central database of secrets. What an extraordinarily bad idea. Maybe someone should fix that. Again. Still.

[RCohle]

If someone broke into your google account you would be in deep shit.

[pitmanncb]

pen and paper to remember passwords ....fork sake..

[smcla]

I would love to hear your opinion on the many companies offering identity protection services that claim to remove your personal information from data broker websites... I'd love to see a video on reclaiming your information and dealing with data brokers. Thanks!

[iangreen]

Selection bias, yes. Naomi's Twitter followers are almost always going to be security aware.

[pineapple-on-pizzas]

We're a global HR company and use Okta at work to SSO 😱

[RCohle]

All the universities in Australia use okta as a single sign on solution.

[razadaza]

I’m not sure you understand the Twitter hack

[RCohle]

Cyber is the real domain of power~ former Israeli primeminister Benjamin Netanyahu.

[TheRobMozza]

I'm certain that I'll get a slagging for this, there is nothing like a good 'ole negative comment for the slagging to begin from the fan boys. I just have to add my two pence worth after watching the entirety of your video.. I feel that I've earnt it 🤭. The first third of your video, you over use of the phrase 'Dive in'. Generally yes Naomi you do cover some good points, but a forty odd minute video could easily be condensed into around 10 minutes. I'm still wondering if your audience is actually listening to what your saying or just having random thoughts about you? 🥰🙄🤫 Ultimately, there can never be total security, it's the triangle of security, usability and functionality. I did however like that you were publicising to your audience about not using certain online sites/services. I'd guess it'll go on deaf ears to the majority but it's still good to hear. Now I'm done, thankyou for taking the time to read this and let the slagging commence! 🤪 EDIT: and I get your point, it's generally about educating the masses.