The Impact of the RSS Breach on Critical Infrastructure

RSA is a division of EMC Corporation that offers security products to businesses and government agencies. RSA’s flagship product is SecurID, a combination of two-factor authentication tokens (hardware and software) and the associated server software used in their implementation. This product aims to deliver secure remote access, including access to critical infrastructure. In 2009, it was estimated RSA had “about 40 million tokens and 250 million mobile software versions deployed in over 25,000 organizations”, including banks, government, manufacturing, and pharmaceutical companies (Rashid, 2011). In this paper we will examine the 2011 breach of RSA involving the SecurID product, the incident response and recovery, mitigation strategies, and discuss the ramifications of such private sector breaches on overall incident management and response.

Incident Response

RSA discovered the attack while it was still in progress (Gov InfoSecurity, 2011). Once discovered, RSA’s Computer Incident Response Team began to monitor the attackers to determine the extent of the breach, discovering that data pertaining to their SecurID tokens had been exfiltrated (Rivner, 2011). RSA executive chairman Art Coviello describes the discovery by stating, “We were disappointed when we realized they'd exfiltrated information related to SecurID, and then we totally went into customer-focus mode. [We asked] how are we going to communicate this to customers, how are we going to make sure that we mitigate any potential risk, what exactly is the risk” (Espiner, 2011). RSA began to harden their IT infrastructure to mitigate any further damage. However, there appears to be no public data on what specific hardening steps were taken by RSA.

RSA publicly announce...

... middle of paper ...

...ember 12, 2011, from Gartner: http://blogs.gartner.com/avivah-litan/2011/04/01/rsa-securid-attack-details-unveiled-they-should-have-known-better/

Rashid, F. (2011, March 18). RSA Warns SecurID Customers of Data Breach. IT Security & Network Security News. Retrieved November 14, 2011 from http://www.eweek.com/c/a/Security/RSA-Warns-SecurID-Customers-of-Data-Breach-395221/

Rivner, U. (2011, April 1). Anatomy of an Attack. In RSA. Retrieved November 10, 2011, from http://blogs.rsa.com/rivner/anatomy-of-an-attack/

RSA. (2011). Required Actions for SecurID Installations. Retrieved November 12, 2011, from SEC: http://www.sec.gov/Archives/edgar/data/790070/000119312511070159/dex992

.htm

Schwartz, N., & Drew, C. (2011, June 7). Rsa security faces angry users after breach. Retrieved from http://www.nytimes.com/2011/06/08/business/08security.html?_r=1&pagewanted= all