{
  "schemaVersion": "1.0.0",
  "kind": "editorial-inspection-pack",
  "provenance": "editorial-guidance",
  "guideId": "accounts-and-sessions",
  "updatedAt": "2026-11-12",
  "catalogVersion": "0.11.0",
  "sourceRepository": "https://github.com/sakimyto/security-knowledge",
  "sourceLicense": "MIT",
  "catalogHash": "e99906d58134e7e0d33d994548277ae7814000d92c088aa5894c49b62ae60cca",
  "catalogReviewedAt": "2026-11-09",
  "execution": "read-only-by-default",
  "selectedRuleIds": ["SEC-002", "SEC-003"],
  "deferredRuleIds": [
    "SEC-001",
    "SEC-004",
    "SEC-005",
    "SEC-006",
    "SEC-007",
    "SEC-008",
    "SEC-009",
    "SEC-010",
    "SEC-011",
    "SEC-012",
    "SEC-013",
    "SEC-014",
    "SEC-015",
    "SEC-016"
  ],
  "outsideSelectionStatus": "unverified",
  "resultStatuses": ["finding", "no-finding", "not-applicable", "unverified"],
  "reportSchemaUrl": "https://sakimyto.com/security-data/report.schema.json",
  "reportExampleUrl": "https://sakimyto.com/security-data/report.example.json",
  "catalogDiscoveryUrl": "https://sakimyto.com/security-data/discovery.json",
  "distributionIndexUrl": "https://sakimyto.com/security-learning-data/index.json",
  "requiredRuleIndex": [
    {
      "id": "SEC-001",
      "hash": "efec3489e1663249a2aff75cdb7c25e82d9765acb2bdcfa31e8ee934f12ef626"
    },
    {
      "id": "SEC-002",
      "hash": "1398f1a8c28e4441472ef3a0952fde97c4ff19b5010178989f4ddd05b6a193dd"
    },
    {
      "id": "SEC-003",
      "hash": "00aa6c368be21452c79e662728102938d7d3896073e53de74ea5fc913250b808"
    },
    {
      "id": "SEC-004",
      "hash": "4c8742376f6fe13cb33908f282d1a6af6fd73ae0a13007f8013ca7042fd629b4"
    },
    {
      "id": "SEC-005",
      "hash": "695e2e119a1364887732e6ee90c1250d22063f1e6e0ec71746e80b7231ace15f"
    },
    {
      "id": "SEC-006",
      "hash": "a3cc524b847c5ec9223ea64ed01920283062fe3fcd0eaf2595bde44f951eed71"
    },
    {
      "id": "SEC-007",
      "hash": "154186523c183ea0ec0059b951eb9b35f0ac41557c28df13c071663be3aef6ee"
    },
    {
      "id": "SEC-008",
      "hash": "ab2bd7e87128a2ce571578558337ab8577fcda20f841171dba5b45d732ad2f03"
    },
    {
      "id": "SEC-009",
      "hash": "8b9d4f314306ca656f73c115c195d84dd803e8a58a53355ed03516b330b26cb2"
    },
    {
      "id": "SEC-010",
      "hash": "66b39f4eb8a0f334e98e9388e3f9dab27415e726c0862f0b6a4a4dd10e5e81df"
    },
    {
      "id": "SEC-011",
      "hash": "3ae198ddd5fa82a53bcbca648d3a9070b03e3cd5665387e69e50c6bb6d365cb3"
    },
    {
      "id": "SEC-012",
      "hash": "2da99baf28980f61385469445d6c000edb5434471a4a3500f1775ca78467824a"
    },
    {
      "id": "SEC-013",
      "hash": "630183526a6d030807db345f6214176c12ca911fb261bde3abebc1c355a21d98"
    },
    {
      "id": "SEC-014",
      "hash": "d9142da38fbe305f72d506a6d6c3c97f658fa446587dc9b27657622c880c1163"
    },
    {
      "id": "SEC-015",
      "hash": "1dfd83077658a79d47897d199f646eb9f69aa4d92c7646c57f2b82a715fde44c"
    },
    {
      "id": "SEC-016",
      "hash": "cce435bbacb6fef88c9e9d661222b081d8463e4f025448a7796cdcddd7548488"
    }
  ],
  "boundary": {
    "ja": "選択した2ルールだけを、許可された対象で読み取り点検します。残る14ルールは実行せず、既存の結果形式へunverifiedと範囲外の理由を残します。資料を読むだけで合格にせず、秘密の実値・変更・外部送信の権限は増やしません。",
    "en": "Inspect only the two selected rules in authorized scope, read-only. Leave the other fourteen unperformed and report them as unverified with an out-of-scope reason under the existing contract. Reading guidance is not a pass and grants no authority to expose secrets, modify systems, or send data."
  },
  "guide": {
    "id": "accounts-and-sessions",
    "title": {
      "ja": "ログインの入口と、その後を追う",
      "en": "Follow login and the session after it"
    },
    "lead": {
      "ja": "MFAの適用経路と、ログイン状態を止める仕組みを分けて確かめます。",
      "en": "Review MFA coverage separately from the mechanisms that stop an authenticated session."
    },
    "situation": {
      "ja": "管理者・委託先・復旧用の入口があり、停止の手順も複数に分かれるとき。",
      "en": "Use this when administrative, contractor, and recovery access have different entry and invalidation routes."
    },
    "goal": {
      "ja": "入口の例外と、停止できるログイン状態の範囲を説明できるようにします。",
      "en": "Describe authentication exceptions and the scope of sessions that can be invalidated."
    },
    "ruleIds": ["SEC-002", "SEC-003"],
    "incidentIds": ["askul-2025", "okta-support-2023"],
    "termIds": ["mfa", "session", "revocation"],
    "sourceIds": ["mfa", "session"],
    "steps": [
      {
        "title": {
          "ja": "入口を同じ地図へ並べる",
          "en": "Map all identity routes"
        },
        "action": {
          "ja": "利用者の種類ごとに、通常・緊急・復旧の認証経路を設定資料から洗い出します。",
          "en": "Map normal, emergency, and recovery routes for each identity type from configuration records."
        },
        "evidence": {
          "ja": "経路、対象の利用者、管理者、例外の有無。",
          "en": "Routes, covered identities, owners, and exceptions."
        }
      },
      {
        "title": {
          "ja": "方式と例外を照合する",
          "en": "Compare methods and exceptions"
        },
        "action": {
          "ja": "MFAの方式と適用範囲を読み、例外や旧方式が誰の管理下にあるかを確かめます。",
          "en": "Review MFA methods and coverage, including ownership of exceptions and legacy methods."
        },
        "evidence": {
          "ja": "適用する条件と、例外を認める根拠・管理者。",
          "en": "Enforcement conditions and the rationale and owner for exceptions."
        }
      },
      {
        "title": {
          "ja": "停止する側まで確かめる",
          "en": "Trace invalidation to the receiver"
        },
        "action": {
          "ja": "既存の実装と試験記録から、どのセッションをどの時点で受け付けなくなるかを読みます。",
          "en": "Use existing implementation and test records to trace which sessions are rejected and when."
        },
        "evidence": {
          "ja": "セッション種別、対象環境、拒否を確認した記録。",
          "en": "Session type, environment, and records demonstrating rejection."
        }
      }
    ],
    "limits": [
      {
        "ja": "MFAがあることだけでは、持ち出されたセッションへの対策まで確認できません。",
        "en": "MFA availability alone does not verify controls for an already compromised session."
      },
      {
        "ja": "サービスアカウントの認証や、本番での失効操作は別の範囲として扱います。",
        "en": "Treat service-account authentication and production invalidation actions as separate scopes."
      }
    ],
    "takeaway": {
      "ja": "認証を強くすることと、認証後の利用を止めることを、別々の証拠で確認します。",
      "en": "Use separate evidence for strengthening authentication and stopping continued authenticated use."
    }
  },
  "rules": [
    {
      "rule": {
        "id": "SEC-002",
        "version": "1.1.2",
        "updatedAt": "2026-11-09",
        "title": {
          "ja": "MFAの方式と適用漏れを確認する",
          "en": "Inspect MFA methods and coverage"
        },
        "summary": {
          "ja": "人がログインする管理画面・SSO・データ基盤。サービスアカウントは別の認証制御として扱います。",
          "en": "Human access to administration, SSO, and data platforms. Inspect service identities separately."
        },
        "category": "credentials",
        "surfaces": ["identity"],
        "applicability": {
          "ja": "人がログインする管理画面・SSO・データ基盤。サービスアカウントは別の認証制御として扱います。",
          "en": "Human access to administration, SSO, and data platforms. Inspect service identities separately."
        },
        "targets": [
          {
            "ja": "IdP・SaaSの認証ポリシーと委託先アカウント",
            "en": "IdP/SaaS policies and contractor accounts"
          },
          {
            "ja": "回復手段・例外設定・管理者認証",
            "en": "Recovery methods, exceptions, administrator authentication"
          }
        ],
        "checks": [
          {
            "ja": "MFA必須の範囲を管理者・委託先・例外まで確認し、未登録を見落とさない。",
            "en": "Check enforcement for administrators, contractors, exceptions, and unenrolled accounts."
          },
          {
            "ja": "プッシュ承認の連打やフィッシングに対する制御と、回復経路が認証を迂回しないか確認する。",
            "en": "Inspect repeated-prompt and phishing controls, including recovery paths."
          }
        ],
        "remediation": [
          {
            "ja": "対応可能な環境でフィッシング耐性のある認証を採用し、例外には期限と担当者を設定する。",
            "en": "Adopt phishing-resistant authentication where supported; assign an owner and expiry to exceptions."
          }
        ],
        "completionEvidence": [
          {
            "ja": "対象アカウントの適用率と、未認証の管理操作が拒否される検証を残す。",
            "en": "Record coverage and evidence that administrative access without required authentication is rejected."
          }
        ],
        "limitations": [
          {
            "ja": "MFAは端末侵害や認証後のセッション窃取を防ぐ保証ではありません。IdPにアクセスできなければ未確認です。",
            "en": "MFA does not guarantee protection against compromised endpoints or stolen sessions. Missing IdP access means unverified."
          }
        ],
        "incidentIds": [
          "anthropic-cyber-evals-2026",
          "askul-2025",
          "awabank-test-environment-2026",
          "charm-2026",
          "chubu-business-credentials-2026",
          "digital-agency-gss-2026",
          "en-midcareer-credential-stuffing-2026",
          "expo-subcontractor-mail-2026",
          "fancrew-credential-stuffing-2026",
          "forticloud-sso-2026",
          "fuso-cloud-storage-2026",
          "gainsight-oauth-2025",
          "hiho-mypage-2026",
          "ichimasa-mail-2026",
          "ieej-mail-2026",
          "jogmec-directory-2026",
          "jst-mail-2026",
          "kindal-phishing-2026",
          "kodansha-phishing-2026",
          "logicvein-2025",
          "mediaplex-2026",
          "mitsui-fudosan-directory-2026",
          "nice-mail-2026",
          "nikkei-m365-2026",
          "nikkei-workspace-2026",
          "nishiyama-2026",
          "openai-mixpanel-2025",
          "pickleballone-plugin-2026",
          "prontest-cloud-2026",
          "quick-2025",
          "rakuten-drive-2026",
          "scala-iask-2026",
          "snowflake-unc5537-2024",
          "toyobo-email-2026",
          "trunk-mail-2026",
          "uber-2022",
          "visualarts-cloud-credentials-2026",
          "iwai-cosmo-tradeworks-2026",
          "onamae-desktop-cloud-2026",
          "sourcenext-breach-2026"
        ],
        "references": [
          {
            "title": "Cloudflare: phishing attack blocked",
            "url": "https://blog.cloudflare.com/2022-07-sms-phishing-attacks/"
          }
        ],
        "execution": "read-only-by-default",
        "provenance": "editorial-guidance"
      },
      "example": {
        "ruleId": "SEC-002",
        "scenario": {
          "ja": "通常の管理者にはMFAがある一方、復旧用や委託先の入口が別にある環境。",
          "en": "Administrators use MFA, but recovery or contractor access follows separate routes."
        },
        "firstCheck": {
          "ja": "秘密の値を開かず、利用者の種類とログイン経路を設定資料から整理します。",
          "en": "Use configuration records to map identity types and login routes without opening secret values."
        },
        "lookAt": [
          {
            "ja": "管理者・一般利用者・委託先の適用対象。",
            "en": "Coverage for administrators, regular users, and contractors."
          },
          {
            "ja": "MFAの方式と例外を認める条件。",
            "en": "MFA methods and the conditions allowing exceptions."
          },
          {
            "ja": "復旧・旧方式・緊急用の認証経路。",
            "en": "Recovery, legacy, and emergency authentication routes."
          }
        ],
        "evidence": {
          "ja": "各経路に何の方式を適用し、例外を誰が管理しているかを残します。",
          "en": "Record the method enforced on each route and the owner of any exception."
        },
        "limit": {
          "ja": "人向けのMFAを、サービスアカウントの安全性の証拠にはしません。",
          "en": "Human MFA coverage is not evidence about service-account controls."
        },
        "sourceIds": ["mfa"]
      }
    },
    {
      "rule": {
        "id": "SEC-003",
        "version": "1.1.1",
        "updatedAt": "2026-11-09",
        "title": {
          "ja": "端末とセッションの失効経路を確認する",
          "en": "Inspect endpoints and session revocation"
        },
        "summary": {
          "ja": "従業員端末やサポート添付ファイルから、認証済みセッションが持ち出され得る環境。",
          "en": "Environments where endpoints or support files can expose authenticated sessions."
        },
        "category": "endpoint",
        "surfaces": ["endpoint", "identity", "support"],
        "applicability": {
          "ja": "従業員端末やサポート添付ファイルから、認証済みセッションが持ち出され得る環境。",
          "en": "Environments where endpoints or support files can expose authenticated sessions."
        },
        "targets": [
          {
            "ja": "端末管理・SSOセッション設定",
            "en": "Endpoint management and SSO session policies"
          },
          {
            "ja": "HAR・サポート添付・ログアウト処理",
            "en": "HAR/support attachments and logout handlers"
          }
        ],
        "checks": [
          {
            "ja": "HAR等を送る前にCookie・Authorization・個人情報が除去される手順を確認する。実値は出力しない。",
            "en": "Verify sanitization of cookies, Authorization headers, and personal data before sending HAR files; never output values."
          },
          {
            "ja": "失効・再認証・管理者セッションの制限を確認し、既存セッションで操作が続けられないか検証する。",
            "en": "Inspect revocation, reauthentication, and administrator-session limits; verify old sessions cannot continue acting."
          }
        ],
        "remediation": [
          {
            "ja": "管理端末とセッション制御を整え、漏洩疑いのセッションを担当者の承認範囲で失効する。",
            "en": "Strengthen managed endpoints and session controls; revoke suspected sessions within granted authority."
          }
        ],
        "completionEvidence": [
          {
            "ja": "合成したテストセッションが失効後に拒否される証拠と、添付ファイルの除去検査を残す。",
            "en": "Record rejection of synthetic revoked sessions and attachment sanitization checks."
          }
        ],
        "limitations": [
          {
            "ja": "リポジトリだけでは端末の状態を確認できません。HTTPOnly等のCookie属性だけで端末マルウェアへの耐性を判断しません。",
            "en": "A repository cannot establish endpoint health. Cookie flags alone do not establish resistance to endpoint malware."
          }
        ],
        "incidentIds": [
          "askul-2025",
          "axios-npm-2026",
          "circleci-2023",
          "cota-2026",
          "expo-subcontractor-mail-2026",
          "fujita-personal-pc-scam-2026",
          "ichimasa-mail-2026",
          "ieej-mail-2026",
          "jst-mail-2026",
          "kodansha-phishing-2026",
          "kyorin-remote-pc-2026",
          "logicvein-2025",
          "nice-mail-2026",
          "nikkei-m365-2026",
          "nikkei-workspace-2026",
          "okta-support-2023",
          "omic-support-scam-2026",
          "openai-mixpanel-2025",
          "ota-cultural-pc-scam-2026",
          "quick-2025",
          "rakuten-books-pc-2026",
          "rust-arrayref-2026",
          "toyobo-email-2026",
          "trunk-mail-2026",
          "uber-2022",
          "medley-atlink-2026"
        ],
        "references": [],
        "execution": "read-only-by-default",
        "provenance": "editorial-guidance"
      },
      "example": {
        "ruleId": "SEC-003",
        "scenario": {
          "ja": "端末から認証済みの情報が持ち出された疑いがあり、ログイン状態の停止範囲を調べたい環境。",
          "en": "A suspected endpoint compromise requires understanding which authenticated sessions can be stopped."
        },
        "firstCheck": {
          "ja": "認証基盤とアプリで、ログイン状態を管理する場所と失効手順を読みます。",
          "en": "Read where the identity provider and application maintain sessions and how invalidation is designed."
        },
        "lookAt": [
          {
            "ja": "セッションを発行する側と受け付ける側。",
            "en": "The session issuer and each accepting component."
          },
          {
            "ja": "ログアウト・有効期限・管理者失効の実装。",
            "en": "Logout, expiration, and administrative invalidation logic."
          },
          {
            "ja": "許可済みの失効試験や過去の対応記録。",
            "en": "Existing authorized invalidation tests or response records."
          }
        ],
        "evidence": {
          "ja": "対象のセッション種別と、利用を拒否した範囲・時点の記録が必要です。",
          "en": "Evidence needs the session type and the scope and time at which reuse was rejected."
        },
        "limit": {
          "ja": "パスワードの交換だけで全セッションが無効になったとは判断しません。点検中に本番の失効は実行しません。",
          "en": "Do not infer session invalidation from password replacement or revoke production sessions during this review."
        },
        "sourceIds": ["session"]
      }
    }
  ],
  "referenceIncidents": [
    {
      "id": "askul-2025",
      "organization": "ASKUL",
      "title": {
        "ja": "アスクル：MFAの例外アカウントから侵入",
        "en": "ASKUL: access through an MFA exception"
      },
      "summary": {
        "ja": "委託先用の管理者アカウントの認証情報が悪用され、ランサムウェア被害が発生しました。このアカウントにはMFAが適用されていませんでした。",
        "en": "Stolen credentials for a contractor administrator account without MFA enabled a ransomware intrusion."
      },
      "occurredAt": null,
      "disclosedAt": "2025-10-19",
      "reviewedAt": "2026-10-10",
      "outcome": "confirmed-breach",
      "categories": ["credentials"],
      "cves": [],
      "claims": [
        {
          "topic": "entry",
          "text": {
            "ja": "委託先用アカウントのID・パスワードが悪用されました。認証情報が漏れた経路は特定されていません。",
            "en": "A contractor account was misused; the original credential leak remains unresolved."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "p.4 §6(1) 不正アクセス"
        },
        {
          "topic": "impact",
          "text": {
            "ja": "一部のサーバーにはEDRと常時監視がなく、バックアップの暗号化・削除が復旧を妨げました。",
            "en": "Some servers lacked EDR and continuous monitoring; encrypted or deleted backups impeded recovery."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "p.3 §4-2 / p.4 §6(2)・(3)"
        },
        {
          "topic": "investigation-limit",
          "text": {
            "ja": "委託先PCのOS更新で侵入時点のログが失われ、取得経路の調査に限界があると公表しました。",
            "en": "ASKUL reported that an OS update erased relevant contractor-PC logs, limiting the origin investigation."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "p.4 §6(1) 調査により判明した事項"
        }
      ],
      "timeline": [
        {
          "date": "2025-10-19",
          "text": {
            "ja": "この事案を公表。",
            "en": "Incident disclosed."
          },
          "sourceIds": ["s1"]
        }
      ],
      "reportedActions": [
        {
          "topic": "response",
          "text": {
            "ja": "認証情報の更新、MFA適用、環境の再構築を実施したと公表しました。",
            "en": "ASKUL reported credential resets, MFA rollout, and environment rebuilding."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "p.4 §5-2 / p.4–5 §7-1・7-2"
        }
      ],
      "prevention": {
        "classification": "operational-control",
        "assessment": {
          "ja": "MFAの例外と委託先の管理権限を確認します。侵害された権限から削除できないバックアップと復元試験も必要です。",
          "en": "Inspect MFA exceptions and contractor privileges, plus protected backups and restoration tests."
        },
        "sourceIds": ["s1"]
      },
      "ai": {
        "status": "unknown",
        "assessment": {
          "ja": "参照した情報では、攻撃者によるAI利用は確認できません。AI不使用を意味しません。",
          "en": "The cited sources do not establish attacker use of AI; absence of evidence is not evidence of absence."
        }
      },
      "unknowns": [
        {
          "ja": "認証情報の流出元は不明です。VPNの脆弱性を悪用した痕跡は確認されていません。",
          "en": "Credential theft origin is unresolved; the report found no evidence that the VPN vulnerability was exploited."
        }
      ],
      "sources": [
        {
          "id": "s1",
          "reviewedAt": "2026-10-10",
          "title": "ランサムウェア攻撃の影響調査結果および安全性強化に向けた取り組みのご報告（第13報）",
          "url": "https://www.askullogist.co.jp/pdf/20251212.pdf",
          "publisher": "ASKUL",
          "publishedAt": "2025-12-12",
          "kind": "organization"
        }
      ],
      "ruleIds": ["SEC-002", "SEC-003", "SEC-005", "SEC-008", "SEC-009", "SEC-013"],
      "hypotheses": [
        {
          "id": "contractor-endpoint-origin",
          "kind": "cause",
          "status": "hypothesis",
          "provenance": "editorial-analysis",
          "statement": {
            "ja": "委託先端末から管理者の資格情報が取得された可能性を、調査候補として残します。",
            "en": "Acquisition of administrator credentials from the contractor endpoint remains a candidate origin."
          },
          "basis": {
            "ja": "委託先アカウントの悪用は確認されていますが、同PCの侵入時ログは失われています。",
            "en": "Account misuse was confirmed, but relevant contractor-PC logs are unavailable."
          },
          "sourceIds": ["s1"],
          "locator": "p.4 §6(1)",
          "assumptions": [
            {
              "ja": "該当する資格情報が、侵入前に委託先端末で使用・保存されていた場合。",
              "en": "The credentials were used or stored on the contractor endpoint before entry."
            }
          ],
          "supportingObservations": [
            {
              "ja": "保全済みの端末・EDR記録で、初回ログイン前の資格情報読み取りや持ち出しを確認できる。",
              "en": "Preserved endpoint or EDR records show credential access or transfer before the first login."
            }
          ],
          "contradictingObservations": [
            {
              "ja": "別の保管先から同じ資格情報が流出した記録があり、端末由来という説明と時系列が合わない。",
              "en": "A documented leak elsewhere and its timing contradict the endpoint-origin explanation."
            }
          ],
          "limitations": [
            {
              "ja": "ログ欠落は侵害の証拠ではありません。フィッシングや別の保管先からの流出も排除できません。",
              "en": "Missing logs are not proof of compromise; phishing and other storage origins remain possible."
            }
          ],
          "ruleIds": ["SEC-003", "SEC-009"]
        },
        {
          "id": "mfa-exception-closure",
          "kind": "mitigation",
          "status": "hypothesis",
          "provenance": "editorial-analysis",
          "statement": {
            "ja": "委託先も含めてリモート管理のMFA例外をなくすと、ID・パスワードだけを使う侵入を減らせる可能性があります。",
            "en": "Removing contractor MFA exceptions could reduce remote entry using passwords alone."
          },
          "basis": {
            "ja": "悪用された委託先用管理者アカウントには、例外としてMFAが適用されていませんでした。",
            "en": "The misused contractor administrator account had an MFA exception."
          },
          "sourceIds": ["s1"],
          "locator": "p.4 §6(1)",
          "assumptions": [
            {
              "ja": "対象の侵入がID・パスワード認証に依存し、セッション窃取や別経路ではない場合。",
              "en": "Entry depends on password authentication rather than stolen sessions or another path."
            }
          ],
          "supportingObservations": [
            {
              "ja": "自分の環境のIdP設定と認証ログで委託先・緊急用の例外がなく、隔離環境の架空アカウントでパスワードのみの接続が拒否される。",
              "en": "IdP policies and logs show no contractor or emergency exception; a synthetic isolated test rejects password-only access."
            }
          ],
          "contradictingObservations": [
            {
              "ja": "旧方式の認証や例外アカウントで追加要素なしに接続できる、または窃取されたセッションで接続できる。",
              "en": "Legacy or exempt access bypasses the extra factor, or a stolen session still grants access."
            }
          ],
          "limitations": [
            {
              "ja": "MFAだけで資格情報の流出、端末侵害、バックアップ破壊を防ぐことはできません。",
              "en": "MFA alone does not prevent credential leaks, endpoint compromise, or backup destruction."
            }
          ],
          "ruleIds": ["SEC-002", "SEC-005"]
        }
      ]
    },
    {
      "id": "okta-support-2023",
      "title": {
        "ja": "Okta：サポート添付ファイルのセッション情報を悪用",
        "en": "Okta: support attachments enabled session hijacking"
      },
      "organization": "Okta",
      "summary": {
        "ja": "盗まれたサービスアカウントでサポートシステム内のファイルへアクセスされました。HARファイル内のセッショントークンが、一部顧客への侵入に使われました。",
        "en": "A compromised service account accessed support files. Session tokens in HAR attachments enabled hijacking of some customer sessions."
      },
      "occurredAt": "2023-09-28",
      "disclosedAt": "2023-10-20",
      "reviewedAt": "2026-10-02",
      "outcome": "confirmed-breach",
      "categories": ["credentials", "endpoint"],
      "cves": [],
      "claims": [
        {
          "topic": "entry",
          "text": {
            "ja": "サポート用サービスアカウントが悪用され、HAR等の添付ファイルにアクセスされました。",
            "en": "A support service account was abused to access attachments, including HAR files."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "Executive Summary"
        },
        {
          "topic": "origin",
          "text": {
            "ja": "個人Googleアカウントへの認証情報の保存が確認され、個人アカウントか端末の侵害が有力な流出経路と説明されました。",
            "en": "Credentials were saved in a personal Google account; compromise of that account or device was assessed as the most likely leak path."
          },
          "status": "inferred",
          "sourceIds": ["s1"],
          "locator": "Executive Summary"
        },
        {
          "topic": "impact",
          "text": {
            "ja": "盗まれたセッショントークンで5顧客のセッションが乗っ取られたと公表しました。",
            "en": "Okta reported session hijacking affecting five customers."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "Executive Summary"
        }
      ],
      "timeline": [
        {
          "date": "2023-09-28",
          "text": {
            "ja": "公表された不正アクセス期間の開始。",
            "en": "Start of the disclosed unauthorized access period."
          },
          "sourceIds": ["s1"]
        },
        {
          "date": "2023-10-17",
          "text": {
            "ja": "サービスアカウント停止と関連セッション失効。",
            "en": "Service account disabled and associated sessions terminated."
          },
          "sourceIds": ["s1"]
        },
        {
          "date": "2023-10-20",
          "text": {
            "ja": "事故を公表。",
            "en": "Incident disclosed."
          },
          "sourceIds": ["s1"]
        }
      ],
      "reportedActions": [
        {
          "topic": "response",
          "text": {
            "ja": "個人Chromeプロファイルへのログイン制限と監視強化を実施しました。",
            "en": "Personal Chrome profile sign-in was restricted and monitoring strengthened."
          },
          "status": "confirmed",
          "sourceIds": ["s1"],
          "locator": "Remediation Tasks"
        }
      ],
      "prevention": {
        "classification": "operational-control",
        "assessment": {
          "ja": "サポート用ファイルも秘密情報の持ち出し経路です。添付前の除去と、漏洩したセッションの失効を点検します。",
          "en": "Support attachments are a credential exposure path. Inspect sanitization and revocation of exposed sessions."
        },
        "sourceIds": ["s1"]
      },
      "ai": {
        "status": "unknown",
        "assessment": {
          "ja": "参照した一次情報に、攻撃でAIを利用したことを裏付ける記述はありません。AI不使用を意味しません。",
          "en": "The cited primary sources do not establish AI involvement. This does not establish that AI was absent."
        }
      },
      "unknowns": [
        {
          "ja": "サービスアカウントの資格情報が流出した具体的な経路は、参照した原因報告でも推定です。",
          "en": "The precise credential leak path remains an assessment in the cited root-cause report."
        }
      ],
      "sources": [
        {
          "id": "s1",
          "title": "Unauthorized Access to Okta Support: Root Cause and Remediation",
          "url": "https://sec.okta.com/articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/",
          "publisher": "Okta",
          "kind": "organization",
          "publishedAt": "2023-11-03",
          "reviewedAt": "2026-10-02"
        }
      ],
      "ruleIds": ["SEC-003", "SEC-004", "SEC-005", "SEC-009"]
    }
  ],
  "terms": [
    {
      "id": "mfa",
      "name": {
        "ja": "多要素認証",
        "en": "Multifactor authentication"
      },
      "meaning": {
        "ja": "知識・所持・生体など、異なる種類の要素を組み合わせる認証。方式と適用する経路も確認します。",
        "en": "Authentication combining different factor types, such as knowledge and possession. Review the method and the routes where it is enforced."
      },
      "question": {
        "ja": "管理者と復旧用の入口にも同じ条件が適用されますか。",
        "en": "Are administrative and recovery routes covered by the intended policy?"
      },
      "ruleId": "SEC-002",
      "sourceId": "mfa"
    },
    {
      "id": "session",
      "name": {
        "ja": "ログイン状態",
        "en": "Session"
      },
      "meaning": {
        "ja": "ログイン後の利用者を識別し、操作を続けられるようにする仕組み。停止できる場所はサービスごとに異なります。",
        "en": "The mechanism maintaining identity after login. Where and how it can be invalidated depends on the service."
      },
      "question": {
        "ja": "ログアウトや侵害対応の後、どこで利用を止めますか。",
        "en": "Where is continued use stopped after logout or a compromise response?"
      },
      "ruleId": "SEC-003",
      "sourceId": "session"
    },
    {
      "id": "revocation",
      "name": {
        "ja": "失効",
        "en": "Revocation"
      },
      "meaning": {
        "ja": "以前の鍵やログイン状態を、受け付ける側で使えなくすること。新しい鍵の発行と分けて確認します。",
        "en": "Making an old credential or session unusable at the accepting system. Verify this separately from issuing a replacement."
      },
      "question": {
        "ja": "交換した後、古いものを受け付けない証拠はありますか。",
        "en": "What evidence shows that the old credential is rejected after replacement?"
      },
      "ruleId": "SEC-005",
      "sourceId": "secrets"
    }
  ],
  "sources": [
    {
      "id": "mfa",
      "title": "Multifactor Authentication Cheat Sheet",
      "publisher": "OWASP",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html",
      "locator": "Passkeys; MFA Attack Patterns and Mitigations",
      "reviewedAt": "2026-11-12"
    },
    {
      "id": "session",
      "title": "Session Management Cheat Sheet",
      "publisher": "OWASP",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html",
      "locator": "Session Expiration; Automatic Session Expiration",
      "reviewedAt": "2026-11-12"
    }
  ]
}