The Context
Okta is an identity and access management company. One of the main use cases for customers is companies using it to manage what their employees and wait they have access to
The Problem
We had no criteria checks in place after the successful log in has happened, which was leaving users vulnerable to security attacks and incidents
The Root Cause
Due to the national health crisis, many companies reported that they were still unable to send out company devices to new hires immediately, and the use of personal devices was often the catalyst for these security incidents, based on reports gathered by customer and sales teams.
Problem Validation
Conducted research in order to validate the problem
- User Interviews
- 5 customers
- 5 non-customers
- Competitive Analysis
- Top competiters
How might we create a way for Okta admins at Small and Medium businesses to accurately detect and prevent security attacks post login?
Ideating
Potential "Happy Path" Employee Log In Experience
.png)
Using internal feedback to go from sketches to higher fidelity
.png)
Defining MVP Experience Requirements
As we started defining the main pain points we wanted to address, we were able to define requirments
- Risk Configurations Policy (Decided to add risk configs in an existing policy)
- The ability to continuously assess security (Create an API for 3rd party security tools)
- Give Okta Admins a place to monitor avoided security threats
Success Metrics
We'll know this product is successful if:
- We're able to detect and prevent security incidents at a rate higher than our competitor; 76% +
- End users are able to understand prevent being mistakenly identified as a security incident
MVP Solution
- An updated authentication policy that includes conditions and outcomes for initial authentication and continuous authentication
- A risk ecosystem dashboard for Okta Admins to be able to monitor security incidents and utilized 3rd party security tools for an added level of security
- A modified end-user experience that reflects the authethentication policy choices made by the admi
Updated Authentication Policy
Risk Ecosystem Dashboard for Okta Admin
Modified End User Experience based on Okta Admin Configuration
Below is a demo of an end user whose account has been flagged as high risk with the risk ecosystem. The okta admin has created requirements that if this user logs in through a low-risk app, they can use a tier 2 authentication method, but when they attempt to open a high-risk area, like the admin console, they will be required to re-authenticate again using a tier 1 authentication method.
The Impact
4 Sprints
Launched MVP by Oktane event deadline
~88%
threat detection and prevention rate
~84%
positive user satisfaction with threat prevention
.png)
