Okta interviews

“For Initial Access, the threat actor has been observed initiating contact with the target company's IT help desk, masquerading as an employee.”

“Document, evangelize and adhere to a standardized process for validating the identity of remote users that contact IT support personnel, and vice versa.”

“We recommend creating custom admin roles for front-line service desk professionals.”

“This custom role should not have the permissions required to modify factors (reset user passwords, set temporary passwords, or reset or enrol factors).”

“Even ‘liveness’ checks that rely on audio or video are vulnerable due to advancing deepfake capabilities.”

“For context, some threat actors take advantage of vulnerable account recovery flows to access protected IT environments, often by phoning an organization’s help desk and pretending to be a legitimate member of the workforce.”