Customers who are worrying about the RSA data breach need to strengthen their other security defenses by checking for suspicious login activity.
Following RSA's announcement of a data breach, there's
really nothing for SecurID customers to do but to monitor their systems in
hopes of foiling an attack, if it ever comes.
RSA Security, a division of storage giant EMC, announced
late March 17 it had been
breached by attackers and that some information about
its SecurID two-factor authentication technology has been stolen. The company
declined to specify what was stolen, nor did it provide any information on how
the data breach occurred.
At this point, "we're not sure what the impact is," Peter
Schlampp, vice president of marketing and product management at Solera Networks,
told eWEEK.
Considering the number of organizations in both the public
and private sector who use RSA's SecurID tokens to implement two-factor
authentication to their login processes, any potential breach of the
closely guarded technology is a source of concern. However, there's not enough
information available to determine whether this is actually a bad thing, or
something that doesn't really have an impact, Schlampp said. While the
"blueprint" for SecurID has been exposed, that's analogous to having the
blueprint of an airplane exposed, he said. It doesn't mean airplanes will fall
out of the sky tomorrow, according to Schlampp.
In an
open letter to customers on its Website, RSA said the
information would not allow attackers to launch a successful direct attack on existing
SecurID customers. However, the company did acknowledge the information could
be potentially used to "reduce the effectiveness" of an existing SecurID
deployment as part of a broader attack.
Bobby Kuzma, president of
Central Florida Technology
Solutions, a security solutions provider, is not taking any chances. Calling it
"professional paranoia," he's been speaking with his customers who use SecurID
to increase vigilance and to ramp up security in other areas to defend against
a potential attack.
"We must prepare for the worst," Kuzma said, noting that RSA
did not give any information on when the breach occurred, how long the company
had been sitting on the news and what exactly was taken.
He is recommending to his customers that they review all
logins to ensure there's no unusual activity because that would be the first
way to detect if something is happening, Kuzma said. He also said he is
recommending that remote logins be temporarily restricted so that no one is
actually using the token for the time being. His clients are mainly small
medical, legal and financial services companies in the central Florida area
between Tampa and Orlando, he said.
RSA encouraged customers to look for suspicious login
activity and monitor changes in user privileges and access control. Employees
should be reminded to not click on unknown links and to be careful about
entering account information online, RSA said.
Companies should be enforcing the rule of "least privilege"
for users and security administrators, Adam Bosninan, executive
vice president of Americas and corporate development at Cyber-Ark, told eWEEK. Only
the amount of privilege necessary for a given activity should be assigned,
instead of providing "full, unfettered access" to the enterprise, he said.
Since RSA hasn't disclosed exactly what was compromised, Kuzma
is assuming that the attackers stole a portion of, or the entire seed
library RSA maintains of the millions of tokens it has deployed or the actual code
that generates the seeds. This can mean replacing all tokens within the
enterprise, which would likely trigger a customer backlash, he said.
It's "scary," because there aren't actual steps they can
take at this point to do anything about the breach, Kuzma said.
It was important for customers to remember that SecurID is
not, or should not be, the only security within the enterprise, Schlampp said.
"RSA is not the CSO for their customers," he said.
Customers should be boosting their defenses in other areas
and using other security layers to be aggressive in their monitoring efforts, Schlampp
said.
It would be interesting to see what RSA does next in light
of the breach, Schlampp said. If the attackers had stolen the source code, it
is possible RSA could decide to open up the code to let other people see it, to
get more "eyeballs" on the code to find vulnerabilities, Schlampp. Or RSA could
keep it closed and quietly replace chunks of the code so that the attackers no
longer have accurate information, he said.
Email
Print
