@apth@infosec.exchange @Sempf@infosec.exchange @zackwhittaker@mastodon.social seems like the DHS okta admin panel could have used a "what the application firewall" or two. I wonder how they got at least read access to the panel. I expect DHS added some read only/limited access roles for a service desk team somewhere and they had an account breached. Generally okta requires MFA to login, but maybe they exploited a weak password and prompt fatigue to spearfish their way in. That would also imply that DHS didnt have Okta's "escalate prompt complexity if the login looks like it comes from a new IP for that user or from an unusal time/place" on. Some orgs turn this off because it does occasionly hit a false positive and makes you do number matching needlessly. A post mortum would be great, but there is basically zero chance we will get one from this DHS.