After hack, RSA amps up security, but people still the weak link

Last year’s breach of RSA, the security division of EMC, appears to have been the work of a foreign nation, but the source remains unknown, company officials said recently.

The attack in March 2011 was a watershed event that forced the company to reassess its security posture and rethink how it handles authentication of users, they said.

“We redoubled our efforts across the entire spectrum of our infrastructure,” said RSA Executive Chairman Art Coviello. “We have totally revamped manufacturing and distribution processes” for the SecurID authentication token, which was compromised as a result of the breach.

Related story:

RSA confirms its tokens used in Lockheed hack

But no amount of technology can provide a complete defense against a new generation of advanced threats that carefully targets individuals within the enterprise, he said. “It’s not going to stop people from getting in.”

“The human still is the weak link in everything,” said Chief Information Security Officer Eddie Schwartz.

Putting the best face on what they acknowledged was a humbling incident, they said the breach, which exposed information about the tokens used by 35,000 corporate and government customers to generate one-time passcodes for online authentication, forced company officials to become experts on advanced persistent threats. They shared some lessons learned in a series of briefings Jan. 13.

The initial customer response was anger, they said, but within a few months that shifted to asking “How did you find that?” By the end of the year, they were receiving six times more requests for public speaking than before the breach and added more than 1,000 customers for the SecurID product.

“We have been very successful in mitigating the damage to our customers,” Coviello said. There has been only one confirmed attack on a customer using information stolen from RSA, against Lockheed Martin in May, and that reportedly was not successful.

But RSA has released few details about the attack, as the company balances what it says is an obligation to disclose information against the need to protect confidential information that could compromise both RSA and its customers. The breach was part of a multilevel attack that worked its way slowly through several different targets in what is believed to be an attempt to get at defense contractors such as Lockheed Martin.

“The attack was started on a third party we did business with whose environment was compromised to get to us,” Coviello said. The next step was to use information from the third party to launch a spear-phishing attack against RSA employees, one of whom clicked on malicious link in an e-mail. “The e-mail appeared to come from a party known to the employee.”

“We were able to see the attack in progress” and disclose it quickly, but RSA did not stop it in time to prevent the loss of sensitive information, Coviello said.

The source of the attack still is not known, he said.

“The nature of the attack led us to determine it was a nation-state,” Coviello said, but he would not speculate on which nation it was. “This type of attack is extremely difficult to trace in terms of the source and the destination of the exfiltrated information. The trail gets cold very quickly.”

Although APTs do not rely exclusively on previously unknown zero-day vulnerabilities and exploits, their success in using these exploits to penetrate defenses and remain hidden shows the importance of having better protection against zero-day exploits, Schwartz said. This requires less reliance on signature-based scanning and filters and more real-time monitoring and sharing of information.

Although information sharing is improving, it still falls far short of providing the real-time situational awareness needed to protect against previously unknown and rapidly evolving threats, he said.

Defending against the new threats also requires a risk-based approach to security in which information and systems are prioritized, because protecting against advanced threats can be resource-intensive.

Because many advanced attacks use social engineering to target individuals whose credentials can be exploited, authentication must be hardened, Schwartz said.

“Most organizations are mainly flat,” with one level of user authentication required for many kinds of access, he said. RSA is increasing the use of multifactor authentication when a user logs onto a system but is compensating for this increased complexity by minimizing the number of log-ins required by using federated identities.

The company also is implementing more risk-based authentication, in which the level of authentication being required is determined by a number of factors to assess risk. If a user has the right user ID and credentials but is logging in from an unusual place or at a strange time, or is accessing unexpected resources or systems, additional factors including an out-of-band confirmation might be required.