Thoughts on the recent alleged breach of Oracle Cloud’s login servers? What are your initial reactions to Oracle’s denial of the breach now that some customers have validated the leaked data?

Threat Intelligence & Incident Response Threat & Vulnerability Management

2.3k views1 Upvote3 Comments

Sort by:

CIO in Government4 months ago

Shameful! As the saying goes, it's not the crime, it's the cover up.
Oracle knew for months of the breach but kept on denying it rather than notifying their customers.

CISO and Head of Digital Channels in Healthcare and Biotech4 months ago

To mitigate risks, we assumed breach, adhering to IR playbooks and pressuring the vendor for accountability.

CIO in Banking4 months ago

Take identity and access management very seriously , require single sign on through Office365 Azure AD , think of rehearsing circuit breaking , and utilize conditional access to your cloud tenants , consult with Oracle team to help apply CIS benchmarks and security best practices

Content you might like

How are companies doing Unified Vulnerability Management? The idea is bringing all inputs (AppSec, DevSecOps, VM scanning, asset discovery etc) into one platform. Instead of creating a homegrown solution, are there vendors that do this well?

What’s your organization doing to protect against risks related to disinformation? How are you approaching this & which business unit leaders are currently involved?

Does your organization have a strategy to address disinformation risks?

Yes

Not yet – we’re working on it75%

No25%

Unsure

View Results

Disesdi Susanna Cox outlines 3 critical threats:
1. Non-deterministic decisions – same prompt, different actions (e.g., unintended transfers).
2. Cascading failures – multi-step tasks = more attack surface.
3. Emergent behavior – guardrails can’t cover infinite edge cases; focus on blast radius and recovery.

3 Controls to Implement Now:
• Map agent workflows to attack tactics (MITRE ATLAS)
• Weekly prompt-injection tests (OWASP + CSA)
• Least-privilege, expiring agent tokens (NIST AI RMF + CSA MAESTRO)

Which control or framework gives you the biggest headache, and how are you tackling it?

Full analysis: https://disesdi.substack.com/p/openai-just-dropped-their-agentic

Which of the following vulnerability management services, if any, do you use at your organization?

HackerOne16%

Bugcrowd41%

Synack13%

Intigriti4%

We're not using a bug bounty platform right now.20%

Other (please comment below!)3%