How OneLogin responded to its breach and regained customer trust
If you are interested in submitting product enhancement requests, you can do so by creating a case with support. When we receive a product enhancement request, the Support Engineer will work to define and clearly document the request. Once documented, the request will be submitted into the enhancement review system, the identification number will be provided to the submitter, and the support case will be closed. The information below represents the most common issues customers are encountering or recent resolutions to help you trouble shoot your Product. Technical Support has reviewed all the support information and has identified the most popular helpful tips and how to videos or articles to ensure you get the most out of your Product.
First-time users:
Once an organization starts to learn exactly what has happened, it’s important to develop a clear action plan around what you are doing and will do, when it is going to be done by, and provide names of who within the executive team is leading these actions. “Giving very specific dates and very specific names within the executive teams gives the customers a sense of not just that you know what happened and that you know how to fix it, but also that sense of accountability and that it’s actually going to get done and there’s actually going to be a change.” Whatever the state of investigation might be, he says it’s important to have an ongoing conversation with customers to give them predictability around timelines for when you think you might know more and share information as it becomes available.
Customizations could inhibit the upgrade itself and may require a level of re-work to continue functioning properly. We strongly encourage you to document and maintain records on any implemented customization work. These records can be useful in isolating problems that may be attributable to the customization or a defect in the core product. Support Policy on Third-Party SoftwareWe are committed to providing products which work on the latest platforms and technologies available in the industry today. We work closely with technology vendors to ensure earliest possible compatibility with our solutions.
- We work closely with technology vendors to ensure earliest possible compatibility with our solutions.
- After an initial analysis, OneLogin found 150 defects in its codebase; within two months they were all removed.
- “Regardless of whatever past practices led to a breach or to the issues that you’re having right now, you’ve got to realize that security decisions need to take priority over all other IT decisions, because you will lose trust with the customer, and I don’t care which business you’re in.”
- These records can be useful in isolating problems that may be attributable to the customization or a defect in the core product.
The Future of Cybersecurity Leadership: AI, Governance & Education Kevin Powers, Boston College
As well as usage rates, including monthly active users, monthly authentication attempts, and top applications used. OneLogin managers help ensure adoption of all key services related to OneLogin. “Security is still thought of in many circles as nice to have, but it’s a must have, and anybody that doesn’t think that way is probably on the road to an issue of their own,” Brooks continues. “Regardless of whatever past practices led to a breach or to the issues that you’re having right now, you’ve got to realize that security decisions need to take priority over all other IT decisions, because you will lose trust with the customer, and I don’t care which business you’re in.” If your issue is determined to be a defect in the product, it is recorded in our defect tracking system, a unique Defect Identifier (ID) will be provided to you and the support case will be closed. Notifications of new product releases will be emailed to you as long as you who have configured your profile to receive product notifications.
Assistance from Support will be limited to helping ensure that the product’s functionality which enables the addition of customizations is functioning as expected. Alternatively, you dyc onelogin may obtain guidance through product specific community sites or the Support Knowledge Base.Advanced AssistanceIf more thorough and detailed assistance is needed to design and develop customizations, we recommend that you engage our Professional Services Organization or fully certified partners to assist. Their expertise in designing customized solutions will ensure customers receive maximum value and product adoption. Our training courses will equip you with the necessary knowledge and ability to design and implement effective changes to our products. For more detail on the training services available, please refer to Training & Certification Services .Maintaining CustomizationsCareful consideration should be given to all customizations during future migration or upgrade exercises to new product and platform versions.
The company took over a month to reveal the breach and the terms of service of the website dedicated to responding to the incident included a waiver for joining any future class action lawsuits. Regional software license agreement applicable to your use of the software is available below (including software preinstalled on hardware or made available to you by download, disk media or otherwise, at no additional cost).Click here to find your regional agreement. Product Management will review the open enhancement requests on a periodic basis and consider them for inclusion in a future product release. Product enhancements will not be considered or implemented in current or prior product releases. There is no guarantee that a specific enhancement request will be implemented in a future version of our product. It is at our discretion if a certain enhancement will be offered for an additional charge or as a chargeable option.
For more information regarding support on your Product, please visit www.software.dell.com/support
Customizations policy for Software and Hardware productsA customization indicates functionality and configurations added to a product that are not provided as part of the core product release and, as such, would be outside the scope of normal support and maintenance. Customizations may take the form of new or modified scripts used within or alongside our products, as well as additional functionality such as custom reports, dashboards, rules, automated actions, etc. developed by you, your partners, or our Professional Services Organization.Support and CustomizationsWe do not perform or maintain customizations. The design and development of customizations to our products is your responsibility.
Workforce Identity
Please note that while we do not directly or officially support third-party software, we work closely with many other providers to ensure our customers receive the best possible service at all times. “Companies like DISYS need to be able to manage the security risks inherent in BYOD while giving their employees the flexibility to work remotely and fast access to the cloud apps they need to do their jobs,” said Thomas Pedersen, co-founder and CEO of OneLogin. “OneLogin takes a user-centric approach to identity management, focusing on protecting enterprise data by securing access, rather than dictating the devices and hardware that are allowed. When it comes to cloud apps, our objective is to help enterprises provision software and users easily and securely, at the speed of business.” Review and strategize customer goals related to Identity and Access Management in in depth strategy sessions.
- With OneLogin, we rolled out Office 365 to 4600-plus users across 35 offices in half an hour.
- Once an organization starts to learn exactly what has happened, it’s important to develop a clear action plan around what you are doing and will do, when it is going to be done by, and provide names of who within the executive team is leading these actions.
- Learn how they can be utilized to meet Customer’s IAM goals and initiatives.Be the first to try out new OneLogin releases and provide actionable feedback for the OneLogin Product Team
- Sample The Product Support Lifecycle describes the phases during which our products are eligible for patches (fixes), support and downloads from the Support Portal.
“You’ve got to be extremely transparent with your customers and be honest about the fact that in most cases, you don’t know really what’s happened within the first 48 to 36 hours,” says Brooks. “Your first information is probably wrong, and being clear with the customers about what you do know and what you don’t know is important.” This was the second incident, occurring less than a year after the company suffered a separate breach in which an attacker was able see information stored in its Secure Notes service in cleartext. By creating multiple instances of the company’s infrastructure to perform reconnaissance, the attacker gained access to database tables that contained information about users, apps, and various types of keys. OneLogin staff shut down affected instances and affected AWS keys within minutes of detection, but the attack had been active for around seven hours up to that point. On the other hand, Equifax’s response to its 2017 breach was labelled a “haphazard and ill-conceived dumpster fire” by Brian Krebs.
Financial Services & Investing
Despite that setback, the company has recovered and recently secured a new round of funding, thanks in part to learning from its mistakes and showing customers how it has changed its security posture since then. Support Policy on VirtualizationVirtualization is a technique for hiding the physical characteristics of computing resources from the way in which other systems, applications or end users interact with those resources. It is able to make a single physical resource, such as a server, operating system, application or storage device, appear to function as multiple logical devices. It can also make multiple physical resources such as storage devices or servers appear as a single logical resource. As a result virtualization enables IT departments to increase the utilization of resources, increase high availability, and simplify back-up, systems administration and recovery procedures.
Brooks explains that accountability has become one of the key principles within the company, and so for the few customers that did want to change IAM providers as a result of the breach, OneLogin made that transition to new a new vendor as easy as possible. “We hope eventually that they’ll come back to us, but we also have the sense of accountability that they were our customer. Brooks says the most tangible outcome of the breach was that the company stopped growing for two quarters as some customers jumped ship and those in the pipeline cooled their interest to see how things played out.
Release Notes for new releases of products will contain the list of Defect Identifiers that were addressed in the release. You can review the release notes or search the Knowledge Base on the Support Portal using your Defect Identifier to see if the issue has been addressed. We do not guarantee that all defects identified will be fixed in a future release of the product. If you are unable to upgrade or migrate your product prior to its end-of-life, we offer a Continuing Support service to provide you with one year of limited support beyond your software’s end-of-life or end-of-support date.
“This saves a huge amount of time and resources, and eliminates the need for additional servers and maintenance. With OneLogin, we rolled out Office 365 to 4600-plus users across 35 offices in half an hour. DISYS selected OneLogin because of the solution’s ability to streamline and simplify the integration of new cloud apps into the company’s complex Active Directory environment while providing secure SSO and real-time provisioning for users, regardless of location or device.
We provide full details of all systems requirements, together with platform and third-party product versions supported with our products, in the Release Notes published for each product. These include operating system versions, service pack levels, mail clients or server versions, database versions, browsers and other related technology supported and at which particular version level our products have been formally tested and certified to run against. The support of future platform versions, new service packs and other related technologies would be taken into consideration and addressed during the regular product maintenance and release cycles of our products. This provides ongoing upward compatibility of our products as used in customer environments. It should be noted therefore that there could be a delay between the availability of the latest platform technology release or service patch, and the product version certified to operate against this.