Financial Cryptography

RSA Pawned - Black Queen runs amoc behind US lines of defence

What to learn from the RSA SecureID breach?

RSA has finally admitted publicly that the March breach into its systems has resulted in the compromise of their SecurID two-factor authentication tokens.

Which points to:

In a letter to customers Monday, the EMC Corp. unit openly acknowledged for the first time that intruders had breached its security systems at defense contractor Lockheed Martin Corp. using data stolen from RSA.

It's a targetted attack across multiple avenues. This is a big shift in the attack profile, and it is perhaps the first serious evidence of the concept of Advanced Persistent Threats (APTs).

What went wrong at the institutional level? Perhaps something like this:

• A low-threat environment in the 1990s
• led to success of low-threat SecureId token
• (based on non-diversified model that sourced back to a single company),
• which peace in our time translated to lack of desire to evolve in 2000s,
• and the industry grew to love "best practices with a vengeance" as everyone from finance to defence relied on the same approach.
• and domination in secure tokens by one brand-name supplier.
• Meanwhile, we watched the evolution of attack scenarios, rolling on through the phishing and breaches pincer movement of the early 200s up to APTs to now,
• while any thought & leadership in the security industry withered and died.

So, with a breach in the single-point-of-failure, we are looking at an industry-wide replacement of all 40 million SecureId tokens.

Which presumably will be a fascinating exercise, and one from which we should be able to learn a lot. It isn't often that we see a SPOF event, and it's a chance to learn just what impact a single point of failure has:

The admission comes in the wake of cyber intrusions into the networks of three US military contractors: Lockheed Martin, L-3 Communications and Northrop Grumman - one of them confirmed by the company, others hinted at by internal warnings and an unusual domain name and password reset process

But one would also be somewhat irresponsible to not ask what happens next? Simply replacing the SecureID fobs and resetting the secret sauce at RSA does not seem to satisfy as *a solution*, although we can understand that a short term hack might be needed.

Chief (Information) Security Officers everywhere will probably be thinking that we need a little more re-thinking of the old 1990s models. Good luck, guys! You'll probably need a few more breaches to wake up the CEOs, so you can get the backing you need to go beyond "best practices" and start doing the job seriously.

---

In contrast, the very next post discusses where we're at when we fail to meet "best practices!"

Posted by iang at June 7, 2011 11:45 AM | TrackBack