Skip to content

RSA and The “New Normal” of Cybersecurity

March 20, 2011

RSA and The “New Normal” of Cybersecurity

MARCH 20, 2011

tags: APT, data correlation, persistent threats, RSA, SecurID, SIEM

by John Linkous

Last week, RSA announced that a successful advanced persistent threat (APT) attack against the company’s infrastructure has resulted in the exfiltration of data that could potentially be used to reduce the effectiveness of RSA’s wildly popular SecurID two-factor authentication products.  While we don’t yet know what was compromised (A token seeding database? Future product design data? We may never know…) or who conducted the attack (China? The Anonymous group?), we do know one thing: the perception of the effectiveness of “secure” authentication and encryption has been deeply shaken.  The fallout from this compromise will likely be swift, and significant.

As a vendor who also develops point security products — some of which tangentially compete with eIQnetworks – it would be easy to stand back and say, “Ha, ha…”  But the reality is that every organization — including global security giants like RSA (a division of EMC) – can be breached if an attack is properly designed.  As we’ve said many times before on this blog, there’s no such thing as 100% secure, and RSA should be commended on the swiftness of its disclosure.

So, what can other organizations do to mitigate these complex, advanced threats?  Well, it appears that RSA was able to identify this attack in-progress (or so it would seem from the wording of Art Coviello’s letter), which is a good start.  However, it appears that it wasn’t detected quickly enough: clearly, some RSA intellectual property was compromised during the attack.  At a broad level, organizations need to be able to gain true situational awareness of what’s going on across their environment.  The concept of situational awareness — on that eIQ has been promoting for years – is, at its most simple, about three things:

Having Access to All Security Data

Knowing How All the Security Data is Related

Near-Real Time Visibility to Make Effective Decisions.

While nothing — including situational awareness – is a 100% guarantee that you won’t be the next victim of an APT, properly implemented situational awareness can drastically increase APT detection rates, and provide organizations with the information they need in near-real-time to help mitigate these complex threats.  As time goes on and situational awareness technologies become more widely adopted, we should hopefully see the number of and voracity of APTs decrease.

Otherwise, what happened to RSA will likely happen to us all.

No comments yet

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: