eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Two-factor authentication has been considered by many to be the gold standard for secure IT access. The idea is that you must have two things, something you have such as a token and something you know, such as a password. Many companies, for example, require a smart card with an embedded identity chip to be inserted into a card reader. Once the smart card is inserted, you’re then prompted for your password.
The SecurID security device was a token that you didn’t have to insert. It would present a number to the user that changed every 30 seconds. By typing in the number to a SecurID prompt, it demonstrated evidence that you had the token and would then let you enter a password. Exactly how RSA knew what number was the correct number at any given time was part of its strength-you didn’t need to equip your computers with card readers to have two-factor authentication.
The algorithm that lets RSA know what number is the correct number may be part of what was stolen in a security breach of RSA’s data systems. Right now, RSA is frantically telling customers that their data is still safe. RSA is probably right. The simple possession of the algorithm isn’t enough to allow someone to break into an existing secure system.
The algorithm may tell how the process is accomplished, but in itself it isn’t going to reveal those numbers that change every 30 seconds. Even stealing a company’s key from RSA probably won’t help because it won’t reveal the correct number for the token at any given moment.
What’s more likely is that someone really wanted to know how the RSA SecurID worked, either so they could make their own competing product or so they could reverse engineer a device that eventually might be able to help gain access to protected information. But in reality, we don’t know for sure because all that RSA has revealed is that information related to SecurID was taken, but they aren’t saying what that information was.
What this means to you is there’s not an immediate threat, even if whoever stole the information from RSA figures out how to hack the SecurID code. What it means is you need to make sure you practice and enforce good password discipline in addition to using the SecurID token.
What We Should Really Worry About
After all, most of the people trying to break into your data system probably aren’t the same people who broke into RSA. But even if they are, you still have a password to prevent entry. Now’s the time to make sure that you confirm that you really are requiring strong passwords, that they’re changed as necessary and that people don’t write them down on Post-It notes and stick them to their monitors.
The RSA breach also means you have to make sure that employees are practicing safe computing, which they should have been doing anyway. They may need to be reminded that they shouldn’t open attachments on strange e-mails and they shouldn’t share their passwords. In addition, security managers should monitor access attempts, and they should monitor any changes to privilege levels and access rights, all things that should be done anyway.
While two-factor authentication is very secure, it’s not able to overcome bad security practices. In other words, SecurID isn’t a silver bullet, it’s just a very convenient token. But it’s still a token. Even without the theft from RSA, it’s a token that can be misused. It’s also subject to social engineering or just plain larceny. The problem with a very effective security solution such as SecurID is it’s easy to become complacent, and as a result fail to protect your security against access that shouldn’t take place with or without SecurID.
So for now, you’re probably safe. What should be worrying you is learning exactly who took the information from RSA and why. Clearly this was a highly sophisticated attack, and whoever went to the effort to do it clearly had a reason. Were they trying to steal RSA’s trade secrets to build a competing device? Was it the Russians, Chinese, terrorists, criminal gangs or some other group trying to find out government secrets? Once we know what was taken, who took the information and why, it’ll be easier to protect against such an attack.
But for now, continue to use your SecurID card, but otherwise go back to those standard security practices that you should have been doing anyway. You might think about adding a second type of two-factor authentication just in case, even though there’s no evidence right now that existing implementations are actually compromised. It is, after all, a good idea to have a backup system just in case one fails.