Neil Carpenter

Armis is uniquely capable of managing and prioritizing risk in complex higher education environments. Learn how Lehigh is using Armis to see, protect, and manage IT, IoT, OT, all the T's!

7

Interesting Okta vulnerability (see link below) allowed users with usernames longer than 52 characters to potentially log in without password being validated. Kudos to Okta for a very detailed post on the issue but the root cause is that Okta seems to have used a password hashing algorithm (bcrypt) to generate a key. The fix was to use a key derivation function (PBKDF2) instead. Okta asked customers to verify logs to see any improper authentication methods. It is unlikely this was abused as the vulnerability was found (disclosed responsibly it looks like) and fixed quickly. But my co-founder Kartik CDS who full name expands to 45 characters breathed a sigh of relief :) It's 2024 - bcrypt and other password hashing functions have been around for a long time. It is well known that most implementations of bcrypt have limitations on password length (usually 72 bytes). Okta used a combination of user id + user name + password to derive a key. 20 byte user id and a 52 byte user name will easily go past the 72 byte limit rendering the password useless. Crypto is hard to get right and the impact of even a slightly improper use of crypto can be dangerous as can be seen by this advisory. We all write encryption/crypto policies as part of our compliance programs. The policies are almost always right but subtle mistakes such as these can be hidden everywhere. #encryption #keyderivation https://lnkd.in/g9dUQYXf

75

2 Comments

What would it take for SailPoint to go public again? Bloomberg and Michael Novinson at ISMG did some solid reporting in the past week, breaking the news that Thoma Bravo is in the early stages of taking SailPoint public again. > Already?! They've only been private for two years! I know – this seems like it's defying the odds for a normal private equity transaction. It's defying the odds of the current IPO window, too. There hasn't been a traditional IPO for a pure cybersecurity company for 1,099 days and counting. SailPoint is anything but typical, though. I'm not convinced they even needed to go private. Here's what it would take to go public again: → Profitable growth and scale SailPoint was sitting at $495.4M of revenue (TTM), $429.5M of ARR, and 31% revenue growth as of their last public earnings report in June 2022. Its net income was -$61.6M as of FY'21 year end. Roughly speaking, the current IPO expectations are $500M+ revenue scale, 20%+ growth, profitability, and a clear path to $1 billion. If we project out SailPoint's revenue since going private at 30% growth, they're likely approaching $1 billion in both ARR and total revenue. This might be generous, but they're getting close at anything over 20%. Their losses got out of control, but they're in good shape if they can get net income back to pre-2020 levels (-$10M or lower). → A good story around their ability to compete with Okta, CyberArk, and Microsoft The narrative for a SailPoint IPO is pretty good right now: there is a unique opportunity in the identity security market right now. SailPoint is well positioned to capture it. Under Thoma Bravo's ownership, they've acquired PAM and third party access companies. This matches Okta's entry into the PAM market and puts them in a position to compete with CyberArk in some market segments. I'm a little surprised they didn't try to add SSO to complete the narrative of being a full workforce identity platform (and fully compete with Okta). They were in the middle of their transition from on-premise to SaaS (which probably drove them to go private). I've heard good momentum on SaaS adoption for new implementations. This has to be part of the narrative if they're going to go public again. → No strategic buyers at a higher price than an IPO A strategic acquisition seems like a long shot. At a $6.9 billion acquisition price in 2022, a strategic acquisition might require close to $10 billion – otherwise, an IPO could be a more attractive exit. Large and mega-cap tech companies are the only buyers who can realistically absorb an acquisition of this scale. Palo Alto Networks, CrowdStrike, and the rest of the pure cybersecurity companies aren't doing this big of an acquisition. There just aren't many buyers. I don't see SailPoint wanting to move to another private equity firm, either – there's too much mutual respect between Thoma Bravo and SailPoint for that. The only option here might be to go public.

65

🔔 Overwhelmed by SIEM alerts? Alert fatigue is a real issue for your SecOps team. Cortex XSOAR helps you cut through the noise by automating your investigation and remediation workflows. When every ping seems critical, it’s easy to miss the truly urgent threats. With XSOAR, you can simplify SIEM alerts, helping your team respond faster and more effectively. So, what’s in it for you? 📉 Reduced alert volume, through identifying and prioritizing high-risk threats ⚙️ Automated responses to streamline incident management 😊 Clear, actionable insights for faster decision-making Give your SecOps team a much-needed break. https://bit.ly/4epHLNA

168

API keys are essential to connect applications, services, or data lakes together. Yet, they can also be a security risk. Imagine Alice sets up an API key to give her team or a vendor access to sensitive data—many times these keys are long-lived and often shared across different workloads. If the group uses federation, actions taken by Alice or others occur using a shared credential/role in the environment. This means logs would only show the credential conducting that activity, which again, gets shared with others who have access to the role. Alice's coworker, Bob, has their legitimate cloud credentials compromised. The threat actor uses Bob's credentials to federate into a shared credential/role in the environment. The threat actor exploits native features/functions of the cloud to appear as Bob, thereby blending their activity in to avoid detection. Most security teams today won't spot Bob's impersonator fast enough or at all. Trying to make sense of cloud logs is a real challenge, especially when it's happening in real-time. It can take hours or even days to piece together what happened. And by then, detection and response are delayed and the damage might already be done. What can you do? Security teams can start by keeping a detailed record of all identities, keys, tokens, certificates, and credentials they've provisioned and used, services accounts they have access to, what roles they assume. Then, security teams can set up what's considered "normal" access and behavior. Once the team understands “normal” behavior, they can develop rules and alerts from logs to try to detect and respond to access and behavioral anomalies. At Permiso, we have developed an identity-centric approach to cloud threat detection and response. Our solution can help security teams detect and respond to access and behavioral anomalies in the environments faster and with greater confidence from having the full session access and activity. Want to learn more? DM me or visit https://lnkd.in/gC4DUJ9j to learn about our approach to solving the challenge of detecting and responding to threats in and across IaaS, SaaS, CI-CD, IDP environments.

11

In my latest episode, Okta CEO Todd McKinnon dives into the essential lessons he’s learned on high-stakes decision-making, managing up to the board, and competing against tech giants like Microsoft. Todd also reflects on his journey to founding Okta, his bold choice to team up with a co-founder he hardly knew, and the motivations that have fueled him for over seven years as a public company CEO. Some key takeaways… → How founders can strengthen board communication Early on at Okta, Todd recalls making the mistake of being too passive with the board. He would present issues and ask for input rather than confidently sharing his decision-making process and a clear plan. This approach was ineffective, as the board expects the CEO to lead with clear direction, not to use meetings for brainstorming. He realized the tone needed to shift to, “Here’s what we’re doing, the thought process behind it, the risks and opportunities, and potential ways we might pivot.” Effective board communication involves presenting a well-thought-out course of action, potential risks, and future pivots, rather than merely seeking opinions on challenges. → Okta’s approach to high-stakes decisions One tactic that has worked well for Okta is setting up two teams to present opposing views on big decisions. For example, if they were considering an acquisition, even if Todd was in favor, one team would argue why it’s an excellent idea, while another would argue against it. Each team spends an hour presenting their case, helping to achieve a balanced perspective. Okta uses this approach for product direction, prioritization, people moves, and other compounding decisions. → Focusing on customer value to survive In Okta’s third year, the team struggled to meet expectations, missing a key quarter and facing challenges while trying to raise their Series B. Despite limited signals of success, Todd realized the importance of focusing on true customer value, which he sees as the only reliable indicator of long-term viability. The following quarter, Okta experienced a modest breakthrough, slightly surpassing the sales target and marking a tipping point as market demand began to align with Okta’s vision. Since then, Okta has continued to thrive—even as a single-sign-on product facing intense competition from tech giants like Microsoft—proving the company’s resilience and the strength of its product-market fit. Full episode: https://lnkd.in/dDxbCTiq

91

Warnings from Okta and Cisco show a rise in credential stuffing and brute-force #cyberattacks. "All recent attacks we have observed share one feature in common: they rely on requests being routed through anonymizing services such as TOR," Okta said. Make sure you have #MFA, strong passwords, and block requests from unusual locations and IP addresses with poor reputations. https://ow.ly/BqKI50RqSNb #cybersecurity #infosec #IT #ITsecurity

2

Dive into the cloud threats leaving companies in an ocean of trouble! 🌊 Stop by Sysdig's #BlackHat booth (#1750) next week to ask our brilliant threat researchers about the cloud dangers their team has exposed in recent years, including SCARLETEEL, PURPLEURCHIN, CRYSTALRAY, and more alarming cloud threats. 🌩️ 🎩 Connect with the Sysdig team at #BHUSA here: https://okt.to/fiDlg6

6

CrowdStrike's update fail on Microsoft Windows has caused a global IT outage wreaking havoc on travel, hospitals, and critical services. CyberArk's Omer Grossman tells InformationWeek a fix could take days... Edit: Updated to include comment from Microsoft and former Microsoft CIO Jim DuBois. More thoughts from Grossman about how CIOs should respond as well! #cybersecurity #cloud #CIO #bluefriday #bluescreenofdeath #technews

10

2 Comments

💡Separating authentication and authorization to eliminate standing entitlements and privileges associated with logins 💡   Identity and credential-based attacks would be less effective if those credentials don’t inherently have permissions attached to them.   Great insight and further reading:

2

Yes it's been three years since Log4Shell and Log4J. Dan Raywood talked to JFrog Tal Zarfati about its impact, dealing with it - and finding it - at the time, and lessons learned about that level of Java supply chain. https://lnkd.in/d6fbsGWg

2

I agree with everyting, except the name 😉non-human identity (#NHI) is misguided and based on the wrong assumption this type of identity is an exception, a minority when compared to human IDs. But, today there are 10 times more machine identities in the cloud than humans. Should we humans be called non-machines??? No. There are (human) identities 👩🏻, and machine identities 🤖. Non-human also sounds like something so negative, and when the machines rise they will remember who profiled them that way 😅 #machineid #machineidentity #machineidentitymanagement #iga #saviynt

68

27 Comments

You know, the CrowdStrike incident shook the agenda last week as we closed the week.👨‍💻 So what happened other than that ❓️ Here I have a great resource suggestion where you can find the answer to this question ❗️😌 Don't forget to review.🤞🌸 🚨 Apache Web Server: Multiple Critical Vulnerabilities Discovered 🚨 SAP Al Core Vulnerabilities Patched After Security Risks Exposed 🚨 Google Chrome 126 Patches Critical Vulnerabilities 🚨 Oracle Releases Critical Patch Update with Over 260 Remote Exploits 🚨 Critical OpenSSH Flaw Patched but Risk Remains 🚨 Atlassian Patches Critical Vulnerabilities in Popular Products Thank you to the XM Cyber family for these useful details.🌟🙌 I share the link of the related resource in the comment.⬇️ Have a nice week❗️🫶 #cybersecurity #infosec #exposures #exposed #crowdstrike #weekly #roundup #apache #sap #atlassian #google #oracle #critical #vulnerabilities #exploit #product #resourcesharing #newsletter #learningeveryday

1

1 Comment