RSA Breach: Reactions from the Security Community
Linked by HAL2001 on Sun 20th Mar 2011 08:57 UTC
Privacy, Security, Encryption RSA suffered a breach and data loss following an "extremely sophisticated cyber attack." Their investigation revealed that the information extracted from the company systems is related to its SecurID two-factor authentication products. The news of the incident spread through the community like wildfire and information security professionals are offering their take on this incident. We still don't know the technical details, but it's certain that RSA's brand has taken a big hit.
E-mail Print r 0   16 Comment(s) http://osne.ws/ixs
Thread beginning with comment 467075
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE: Levelling the playing field
by Soulbender on Mon 21st Mar 2011 04:54 UTC in reply to "Levelling the playing field"
Soulbender
Member since:
2005-08-18

Worst case, whatever had been "stolen" from RSA as a result of the breach can't be any worse than if one had used an Open Source solution in the first place.


The worst case is that the entire SecurID system is compromised and rendered useless. Much worse than using an OSS solution in the first place, not to mention that it would probably be the end of RSA. Maybe that's why they're trying to tone it down.

Reply Parent Score: 2

umccullough Member since:
2006-01-26

"Worst case, whatever had been "stolen" from RSA as a result of the breach can't be any worse than if one had used an Open Source solution in the first place.


The worst case is that the entire SecurID system is compromised and rendered useless. Much worse than using an OSS solution in the first place, not to mention that it would probably be the end of RSA. Maybe that's why they're trying to tone it down. "

Yeah, that was a poor choice of words on my part ;)

Per your previous reply, that's scary. I would have thought, like RSA encryption itself, that methods used in SecurID was understood by the security community in general.

As for the "pre-determined random number" - I know what they're trying to suggest - but you're right, totally non-random. Sounds like pseudo-random with a specific key on every token, combined with a timestamp to seed with - at least that's my best-guess of the basic premise after seeing how they work.

Reply Parent Score: 2