RSA servers hacked as SecurID data stolen

As RSA has its servers hacked, its two-factor authentication customers will no doubt be highly concerned.


RSA - the security arm of EMC - has admitted to having a number of its servers hacked, as data on its two-factor authentication product SecurID was compromised.

The firm warned the data could be used to "reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack," and RSA urged customers to take immediate remedial action.

Advertisement - Article continues below

RSA executive chairman Art Coviello said the firm's security systems had been targeted by an "extremely sophisticated cyber attack."

It is believed the attack was in the Advanced Persistent Threat (APT) category, which may indicate a well-funded group of individuals were responsible.

APTs involve significant intelligence research and the use of numerous techniques to hack targets. They need serious investment to be carried out.

RSA is now in the process of informing customers about the dangers and how to strengthen SecurID implementations.

"We have no evidence that customer security related to other RSA products has been similarly impacted," Coviello said in an open letter to customers.

"We are also confident that no other EMC products were impacted by this attack. It is important to note that we do not believe that either customer or employee personally identifiable information was compromised as a result of this incident."

Advertisement - Article continues below

In an advice note to customers, RSA listed a number of recommendations for customers to follow, with the first point being to increase focus on security for social media applications and the use of them by anyone with access to critical networks.

Advertisement - Article continues below

RSA has a wide range of customers, ranging from high profile private companies to government bodies.

A sad day'

The breach will be damaging for RSA and it could take some time for the EMC division to recover, said SecurEnvoy co-founder Steve Watts.

Watts said it was a "sad day" to see a company with the reputation of RSA being hit by such a significant attack.

"Anyone with an RSA token doesn't know if they're going to be compromised. The industry is a bit concerned," Watts told IT PRO.

"This isn't just a bit of a marketing booboo, this is a major strategic issue. The problem is that it will take quite a long time to get over it."

If RSA has to initiate a recall of a large chunk of its tokens, then this would lump the firm with a costly logistical nightmare, Watts added.

"Is it going to be as extreme as changing every token that is sent out into the marketplace? Is it as far as to send out replacement tokens for every user? That's just beyond measure," Watts added.

Earlier this week, Jim Fulton, vice president at DigitalPersona, told IT PRO many companies were struggling with token deployments as it was.

"I've heard people say that if they could, they'd throw them underneath a lorry and crush them because they hate them so much," Fulton said.

Featured Resources

Successful digital transformations are future ready - now

Research findings identify key ingredients to complete your transformation journey

Download now

Cyber security for accountants

3 ways to protect yourself and your clients online

Download now

The future of database administrators in the era of the autonomous database

Autonomous databases are here. So who needs database administrators anymore?

Download now

The IT expert’s guide to AI and content management

Your guide to the biggest opportunities for IT teams when it comes to AI and content management

Download now



Businesses brace for second 'Fujiwhara effect' of 2020 as Patch Tuesday looms

9 Apr 2020
cyber security

Zoom hires ex-Facebook CSO Alex Stamos to boost platform security

8 Apr 2020

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020
cyber security

Safari bug let hackers access cameras on iPhones and Macs

6 Apr 2020

Most Popular

Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
video conferencing

Taiwan becomes first country to ban Zoom amid security concerns

8 Apr 2020
cyber security

Microsoft gobbles up domain to keep it from hackers

8 Apr 2020