RSA token replacement highest downunder after breach

Token replacement after the breach of RSA's SecurID token in March was highest in Australia.

However, the company remains satisfied with how it handled the incident.

About 10 percent of RSA SecurID customers globally replaced the token system after it was compromised in the high-profile breach.

That figure was higher in Australia, but the company did not name a precise figure.

Customer churn and panic was closely tied to media speculation on the fallout of the breach, according to RSA Australia director Andy Solterbeck.

That speculation was fuelled by a lack of details on the ground, failing to placate customers and the media wanting to know if the SecurID tokens, used in March to attack defence contractor Lockheed Martin, could be trusted.

"The pickle for us came from an active law enforcement investigation in the United States," Solterbeck said of a US government directive to keep tight-lipped on specific details of the breach.

"Every law agency was crawling all over us."

That put the then newly-minted director in a tough spot. Customers wanted answers and they were arguably getting more information from the press than the company.

"Customers were rightly demanding that they have enough information to perform risk assessments. The answer we gave was 'yes you can trust us'."

Some big businesses have. In the months following the breach, ANZ, Westpac and Bank West were just a few of those that announced they would replace SecurID tokens but stay with the company.

Solterbeck contacted some of the largest companies personally, while remaining customers were remediated through RSA's consultants, partners and resellers.

"We did as good a job as we could," Solterbeck said. "They [customers] were satisfied."

The former Telstra security boss pointed to a recent record quarter for SecurID as a measure of continuing trust in the brand.

Eating its own dog food

RSA has attempted to convince customers that SecurID should be implemented as part of a multi-layered defence and not be thought of as a security silver bullet in itself.

Its Australian offices have also revised security architectures to be more attuned to breaches.

It was part way through a more than 900-seat virtual desktop rollout using parent company EMC's virtualisation kit, which will improve security and allow staff to connect using personal devices.

The virtualisation deployment will be finished by January 2013.

RSA had ingrained a mentality of "assume you are breached" and had turned its attention to "sophisticated analytics and forensics" technology.

That technology would help tune RSA's Boston-based Critical Incident Response Centre - its security eyes and ears - to the so-called advanced persistent threats that caused SecurID to be compromised.

Hacker tracking

Solterbeck was resolute that the person or persons behind the attacks were on the payroll of a nation-state.

"What was taken from us was used against specific intellectual property at Lockheed Martin. Organised criminals would rather go after (lower-value) targets."

Investigations are continuing in the United States to track the perpetrators.

Analysis of exploit code used in the RSA attack linked the attacks to China.

Yuange1975, a Twitter account purporting to be a Chinese hacker, had posted snippets of zero-day Adobe exploit code in Feburary, two weeks before Adobe acknowledged the exploit and almost a month before it was later used embedded in an Excel document to compromise SecurID.

Another suspected Chinese attacker, dubbed 'Linxder', was implicated in a separate but similar attack one day before RSA published details of the SecurID breach.

Copyright © SC Magazine, Australia