RSA Servers Fall To Hackers
IT security is a thankless job that never ends or gets easier thanks to the consistently aggressive band of hackers and cybercriminals trolling the Internet. And these days not even RSA, the company whose name adorns the “it” IT security conference, is safe.
In an open letter to customers, RSA Executive Chairman Art Coviello discussed the “extremely sophisticated cyber attack” that compromised information related to the company’s SecurID two-factor authentication product designed to protect sensitive networks.
SecurID is based on something you know (a password or PIN) along with something you have (an authenticator token) that generates a random-number password every 60 seconds.
Along with stating that no personally identifiable information was compromised, Coviello said the company believes that the information won’t enable a direct attack on any SecurID customer. But he said the information “could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack.”
I’m sure that makes any organization deploying the solution just a little nervous at this point. RSA also released a detailed note to companies running the solution detailing some of the steps that should to protect network infrastructure.
Ironically, one suggestion is that customers “enforce strong password and PIN policies” -- something SecurID was designed to make obsolete.
Posted by Brent Dirks on Mar 18, 2011