Slashdot Mirror
RSA Chief: Last Year's Breach Has Silver Lining
alphadogg writes "Last year's industry-shaking RSA Security breach has resulted in customers' CEOs and CIOs engaging much more closely with the vendor to improve their organizations' security, according to the head of RSA. Discussing the details of the attack that compromised its SecurID tokens has made RSA sought after by companies that want to prevent something similar from happening to them, Executive Chairman Art Coviello said in an interview with Network World. 'If there's a silver lining to the cloud that was over us from April through over the summer it is the fact that we've been engaged with customers at a strategic level as never before,' Coviello says, 'and they want to know in detail what happened to us, how we responded, what tools we used, what was effective and what was not.'"
The good news is that you're now engaging more closely with the fire department and your insurance agent.
It's really quite incredible to me how little attention this got and how RSA has emerged unscathed from this disaster.
Tokens were replaced for free...but don't let the facts get in the way of a good story!
Everybody knows that their customers want to know such things because they asked in a quite vocal maner just after the troubles, and werre simply dismissed by RSA. So, now RSA issues a PR stating that their customers want to know if they are secure, and not teling if they gave any answer. Quite funny what some spin can create.
Anyway, why should anybody buy a product from RSA anymore?
Rethinking email
you can get out of a bit of damage control
Really though, as a customer, you don't look favorably at your security vendor waiting until after a serious breach to refine their processes. You pay them the big dollars because they're supposed to already know what they're doing and have good practice already in place the day you shake hands.
This is just their P.R. people clawing for some way to put a little positive spin on their blunder.
I work for the Department of Redundancy Department.
We had our technology stolen, because we can't secure our own network, our customers suffered intrusions as a result... and this is a good thing!
This guy should be the White House Press Secretary!
there are 3 kinds of people:
* those who can count
* those who can't
And since the fire department burned to the ground, more home owners are contacting the fire department to help with their home fire defense.
What the? Does that make any sense to anyone?
Ah, that makes sense now.
Not "dude, u r teh awesome!!! How can I get some of that awesome for myself?"
More like "dude, where were your fire extinguishers? Smoke detectors? What model were they? Did they give ANY alarm? HOW THE HELL DID YOU LET YOUR FIRE DEPARTMENT BURN DOWN? And is there any way to tell if I am in danger?"
'If there's a silver lining to the cloud that was over us from April through over the summer it is the fact that we've been getting phone-raped by customers... as never before,' Coviello says, 'and they want to know in detail what the fuck happened, how we fucked up so badly, how the fuck we're going to fix it, and why the fuck they should still be our 'customers'."
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Is that the worthless corporate scumbags who own the company I work for (and force us to use RSA keyfobs) thought very hard about what to do about this spectacular failure on RSA's part, and came up with this solution: Get new keyfobs from RSA!
RSA's only job was to be trustworthy. None of their technology is a trade secret, and once they produce the fobs there's no need to interact with RSA whatsoever. There IS NO technology to steal on their networks.
And yet they kept the keys. The only purpose served by keeping those keys is allowing someone to decrypt their customers encrypted traffic. The keys are completely unnecessary for any other reason once the fobs have been made. If they're doing their job right, it wouldn't matter if terrorists came in and held a gun to the CEO's head, nevermind if their network was secure. The key fobs do not depend on them in any way to function once they're produced.
Their only job was to be trustworthy, and they have failed spectacularly.
So I'm expecting raises and bonuses all around for the execs, while a couple worker drones (who probably questioned keeping the keys in the first place) get axed. SNAFU.
Maxim: People cannot follow directions.
Increases in truth directly with the length of time spent explaining them
That's BS. We tried on a number of different occasions to speak to them and they weren't having a bar of it. This story is just marketing spin
It said "windows 98 or better" so I installed Linux
And in a unrelated news event, The farmer has started communicating to neighboring farm's about closing the barn doors after the live stock in the barn had left.
Paypal did not replace tokens for free. I'm still running with my old token as they have not responded with my question as to when they will be replacing it.
Do not look at laser with remaining good eye.
well, I still have the same token I had at least 6 month before the breach
This is a load of crap. If anything, I think the entire RSA incident should serve as an impetus to look for open source, community supported solutions. Security through obscurity works only in government, CIA stuff.
Paypal doesn't use RSA tokens. They use ones from Symantec (which they bought from Verisign).
"National Security is the chief cause of national insecurity." - Celine's First Law
I was just thinking something along those lines. The silver lining in being mugged is knowing how to report a mugging. Doesn't really sound particularly helpful and definitely not helpful enough to justify being mugged. And unless you're new to the country you should already know how to report the crime.
Likewise, all those RSA officers ought to be terminated for incompetence. It doesn't take somebody with credentials to realize that it was going to happen eventually. Making somebody physically take a disc or registration data to a machine that creates the certs and a disc back and they would have been in the clear from that attack. It's not that expensive to do that.
While they may have been free, RSA didn't offer to pay for the cost of actually doing the replacement down to the end user level. Distribution, setting PIN, etc. is a major project. I know I still have my same old token. Our company security analysts reviewed the risk with the business and they decided the cost to do the replacement was not justified by the small risk.
Incredibly disgraced security company's chief PR person proudly tells media that Titanic sinking was good for business in an attempt to save company. "More and more passengers are sailing with us because they want to learn how the Titanic sank."
I crapped in my pants. But the good news is I know that there were peas in my burger.
It seems to me that the breach at RSA exposed a back door in their implementation.
...why they should continue doing business with RSA.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
There, fixed that for you.
RSA seeds the tokens. They keep the database of token seeds. You can't seed your tokens yourself.
This means you put your trust in RSA, not only that they won't give you defective tokens, but also that they will never have a security breach that compromises your keys.
This is why I use Yubikey. I still have to trust the manufacturers' QA team and technology, but I also get to run my own authentication servers, and SEED MY OWN DAMN KEYS. Such that WE control our security; There is no single central point of failure, like there was/is in RSA's case.
This shit isn't rocket surgery folks: HERE AT RSA WE MAKE YOU PUT ALL YOUR EGGS IN ONE BASKET WITH EVERYONE ELSE'S. WHAT CAN POSSIBLY GO WRONG!?!
I'm not a paid spokesperson for Yubico, but I am outraged that people refuse to use superior products with better security than that moronically designed clusterfsck of a security model that RSA is selling. It's like no one has even tried to look for something better, even after being burned.
I warned my company of this eventuality, and we stopped using RSA. When the RSA breach happened I made popcorn and watched their "security theater" burn. Since the victims have learned nothing I keenly await the sequel.
The car was in the garage.
Sounds like RSA made a bunch of cash from professional services as a result of their own incompetence.
Some people use a safe deposit box at the bank because they trust that the bank will keep stuff safer than they can. It's a personal decision. Neither is better or worse, smarter or dumber.
Read the blog---Walsh suspects there's more shenanigans lurking in their code.