Keep off ofmy cookies!
Widespread adoption of multifactor and passwordlessauthentication is slowly diminishing the value of a stolen
password to an attacker.
So what’s the next best thing to a stolen password?
A stolen session cookie.
Here are 8 ways to prevent account takeovers from stolen
session cookies.

What areSessionCookies?

1

Session cookies are small blocks of data stored
in a user’s browser after they sign-in to a web
application. The cookie includes an identifier
generated by the app that helps keep track of asigned-in user, ensuring they won’t need to signin again until the session expires or the user logs
out. If an attacker steals a session cookie andinjects it into their browser, they can often accessthe same session as the legitimate user.

Endpoint protection
Endpoint protection software can protect user
devices against malware that extracts session
cookies from the user’s browser. Bonus points
if your EDR integrates with Okta to deny signins from vulnerable devices!

Cookie-hungry malware
A number of malware families include modules
that extract cookies from browser sessions
running on an infected machine.

21Strongauthenticators
Phishing for cookies

Authenticators that rely on “shared secret”
factors such as SMS, email, or authenticator apps
can be bypassed by phishing attacks that proxy
legitimate requests via attacker infrastructure.
Our suggestion? Protect access to high value
accounts using strong authenticators such as
WebAuthn, U2F keys and smart cards.

Phishing sites are often configured asreverse proxy servers, relaying requests
between a targeted user and animpersonated web application. If a user
is tricked into signing in to the legitimate
web application via one of these malicious
sites, the attacker can access the user’s
credentials and the session token returnedto the browser.

3
1
Device context
Authentication policies can be used to restrict access to applications todevices based on if they are registered with Okta FastPass, if they are fully
managed, if they are assessed to have a strong security posture. All canplay a role in thwarting cookie thieves!

Go Passwordless!
Okta FastPass uses a device-boundauthenticator to enable sign-in toapplications from any device without apassword.

Define your perimeter

14

Where possible, block or perform step-up authentication on connections
from rarely-used networks. With Okta Network Zones, access can easily becontrolled by network location, ASN (Autonomous System Number), IP, and IPType (which identifies known anonymizing proxies).

Same, sameReverse proxies used in phishing arealso known as:“Transparent HTTP proxies”“In-line phishing proxies”“MITM proxies”“Adversary-in-the-middle proxies”

15Behavior Detection
An attacker’s sign-in behavior will very often differ from a user’s
typical behavior. Okta’s Behavior Detection can be used to act (viastep-up authentication) or alert (via System Log) when a user’s signin behavior deviates from a previous pattern of activity.

61Security awarenessNo matter how advanced the attacker’s infrastructure, most cookie
thieves rely on social engineering. Train users to identify signs of
untrustworthy domains in the browser and the tricks attackers use toprompt user action.
Make it easy for users to report potential issues by configuring EndUser Notifications and Suspicious Activity Reporting.

Colour me unimpressed
Common phishing flags include:
Using domains with misspelled company names
Messages from executives asking you to act with urgency
Unexpected notification of packages or documents

17Sensible sessions
Application session time-outs should, be fine-tuned based on therisk that unauthorized access to the SaaS application poses to theorganization. We recommend expiring Okta sessions within twohours.

Continuous authentication refers to an
ability to check for any changes in user
context after a session is established (postauthentication). Okta is participating inefforts to standardize how risk signals areshared between identity providers and appproviders.

81
Monitoring andResponse
Application Logs often contain the first signs of cookie
theft. Requests to Okta are logged in Okta System Log,
which can be viewed in the admin console, streamed tosecurity analytics tools or programmatically requested
using the System Log API.
For more advice on common avenues for detection, checkout this resource from Okta.

© All rights reserved. Okta 2022