Behavior of network zone restrictions

Loading

Skip to Navigation Skip to Main Content

Search

Search

Select Language

0D50Z00008G7VC4SANOkta Classic EngineAdministrationAnswered2024-10-24T09:01:38.000Z2017-01-17T22:04:58.000Z2018-11-08T15:21:41.000Z

Admin-MattM.11539 (Customer) asked a question.

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:19 AM

Behavior of network zone restrictions

I have a question regarding how network zone restrictions are implemented. We recently discovered evidence of a brute force attack on our Office 365 tenant originating from China, Singapore, and Hong Kong. Because our Office 365 tenant is federated to Okta, and Okta is federated to our AD, we had multiple users complaining of locked AD accounts.

I've implemented a network zone restriction at the Okta login policy level to not allow any logins from those specific countries (we don't have any users there), but will this prevent user accounts from being locked out? By examining the logs, it looks like the zone restriction is being applied after the authentication request happens (tested with a VPN that has an endpoint in Hong Kong), but I'm not quite sure of that. Is there a better way?

benjamin.l.campbell and 7sb5x like this.

Top Rated Answers

Admin-MattM.11539 (Customer)
8 years ago
We actually just discovered the other day that it is possible to do country level blacklists. This feature doesn't seem to be enabled by default, you need to contact Okta to have it enabled for your org. After it's enabled, you will see the same blacklist checkbox on dynamic network zones.
Expand Post
Selected as Best

All Answers

gabriel.sroka1.4374539321839353E12 (Okta, Inc.)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:27 AM
Hi Matthew
To avoid locked AD account, consider setting the Okta Lock Out lower than the AD Lock Out, so only the Okta account will get locked. Search this document:
https://help.okta.com/en/prev/Content/Topics/Security/Security_Policies.htm?cshid=Security_Policies#Security_Policies1
for "Preventing Active Directory account lockouts" for more info.
Expand Post
Admin-MattM.11539 (Customer)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:27 AM
This is helpful, thanks. I'll check that setting.

However, locking the Okta account is still a significant event for a user since we have many critical services integrated into Okta. I guess the original question still applies, would a brute force attack from a restricted network zone still trigger an Okta lockout?
Expand Post
j5v7c (j5v7c)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:27 AM
The Okta account will become locked yes, but all the applications would still be assigned to the user and not deactivated (if lifecycle management is being used). You could as part of the password policy allow the users account to become unlocked after a set amount of time (shown below in the password policy definition), and you can also enable a self-service user unlock capability.

Expand Post
benjamin.l.campbell (numo LLC)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:27 AM
I'm working on this same issue now. I believe I have a fix and will update once tested.
Expand Post
7sb5x (7sb5x)
8 years ago
We are struggling with the same thing. Authentication attempts are processed before the policies that block locations, so anyone could fairly easily shut down the company by locking out every account. If the policies were evaluated before the authentication attempt, this wouldn't be an issue.
Expand Post
d67vz (d67vz)
8 years ago
Srs,
I am having the same issue here. I already have the # of attempts to lock out on AD higher than Okta, but still. As said, most of today's app are on the cloud, which creates a huge impact when okta is locked. So far the solution I found was blacklisted using the standad BlockedIpZone on Okta > Security > Network. My only concern by blocking specific IPs is a reactive action. It would be good if we could easily blacklist countries instead using other services to give us country ip's range.
Expand Post
Admin-MattM.11539 (Customer)
8 years ago
We actually just discovered the other day that it is possible to do country level blacklists. This feature doesn't seem to be enabled by default, you need to contact Okta to have it enabled for your org. After it's enabled, you will see the same blacklist checkbox on dynamic network zones.
Expand Post
Selected as Best
4iig6 (4iig6)
8 years ago
Hi, getting hit with this same issue as well, where AD accounts are getting locked after being bombarded with malicious attempts from all over the world. How about if MFA is enabled and instead remove the 'lock account after X attempts' setting altogether? Wondering anyone's thoughts on that as a potential workaround to whitelist/blacklist countries which is probably impossible in our scenario unfortunately.
Expand Post
Admin-MattM.11539 (Customer)
8 years ago
I believe that removing the "lock account after X attempts" option will essentially give your attackers unlimited attempts on a dictionary/brute force attack. I think the way this is currently implemented is that the MFA challenge isn't initiated until AFTER the password has been successfully authenticated. So it would prevent user lockouts, but probably isn't a recommended security practice.

There is a feature in Beta called Factor Sequencing that I think would allow you to customize the sequence to put the MFA challenge first, see here for more details: https://support.okta.com/help/s/beta?id=kA00Z000000TMtpSAG
Expand Post

This question is closed.

Recommended content

Forum

Apply Network Zones to only certain Applications rather than entire sign-on policy?

Forum

Blacklist Network Zone

Forum

Limiting Client-Credential Applications with network zones

Forum

System Log reporting "Client.Zone" eq null for all users. Can I get System Log to tag entries with the respective network zone

Loading

Behavior of network zone restrictions