[ISN] SecurID Customers Advised To Prepare For Worst Case

http://www.informationweek.com/news/security/attacks/showArticle.jhtml?articleID=229301337

By Mathew J. Schwartz 
InformationWeek
March 22, 2011 

How serious is the security threat posed by the theft of inside 
information about SecurID, the two-factor authentication system sold by 
EMC division RSA? "It is important enough that it required an official 
note to the stock markets," said Martin Kuppinger, founder and principal 
analyst at KuppingerCole, in a blog post.

But, despite the apparent severity of the breach, RSA's failure to 
detail what was stolen is generating an immense amount of customer 
frustration, because they don't know if their SecurID hardware fobs are 
still secure, or if they might provide attackers with a conduit through 
enterprise defenses.

Here's the worst-case scenario: "The worry is that source code to the 
company's SecurID two-factor authentication product was stolen, which 
would possibly allow hackers to reverse-engineer or otherwise break the 
system," said Bruce Schneier, chief security technology officer of BT, 
in a blog post. In that case, attackers could spoof SecurID to access 
corporate systems.

Until RSA coughs up more information, security experts advocate 
conducting a thorough and immediate SecurID risk assessment. "Our 
recommendation for customers which have RSA SecurID cards implemented is 
to first carefully analyze the situation and their specific risks -- 
[for example] which type of information is at risk if the RSA 
SecurID-based authentication is not only at risk -- like now -- but an 
attack actually takes place?" said Kuppinger.

[...]


___________________________________________________________      
Tegatai Managed Colocation: Four Provider Blended
Tier-1 Bandwidth, Fortinet Universal Threat Management,
Natural Disaster Avoidance, Always-On Power Delivery 
Network, Cisco Switches, SAS 70 Type II Datacenter. 
Find peace of mind, Defend your Critical Infrastructure.
http://www.tegataiphoenix.com/