In an advisory note just published by KuppingerCole, the analyst group warns against panic and hasty decisions. There are measures organizations can adopt, both short and long term that can keep sensitive systems and information safe without going to radical extremes such as throwing out SecurID altogether and replacing it with some other strong authentication systems, a course which is simply not an option in most cases, both for logistical and cost reasons.
This is clearly the most serious security breach in the history of information technology, and customers are right to be extremely worried, says Martin Kuppinger, Lead Analyst and Co-Founder of KuppingerCole, a group of identity and security analysts based in Duesseldorf and Boston. However, there are measures, both organizational and technical, that must be swiftly taken because one thing is eminently clear: We are dealing with some very, very sophisticated hackers here, he believes.
On the organizational side, Kuppinger recommends raise user awareness to the dangers of revealing passwords to anyone, anytime! Hackers today use so-called social attacks such as spear phishing to target individual employees within an organization by disguising themselves as system administrators or members of the IT department and coaxing them into handling them their authentication data. This, together with the stolen Token IDs from RSA, would give the hacker potentially unlimited access to an organizations IT systems. Additionally, users should be ordered (or persuaded, if enforcement is impossible) to switch to stronger passwords. Kuppinger also recommends Intensify logging and auditing of user activity whenever SecurID tokens are involved. Of course, you should be doing this anyway, Martin Kuppinger believes, but at least there is now a good excuse in case the bean counters object to the extra expense.
On the technical side, KuppingerCole recommends replace existing SecurID tokens as soon as possible. RSA has already started offering token replacement to its customers. The new token IDs may be assumed to be secure since their token IDs werent on the servers at RSA when they were compromised. Adding additional passwords or other types of secrets as additional means for authentication may be an option in some cases.
Where this is not feasible, KuppingerCole suggests shutting down RSA SecurID and blocking off the access paths that these tokens secure. Admittedly, this is a radical step and one that might not work everywhere in practice. In some cases such as remote desktop access, replacing SecurID with (secure) web-based interfaces using username and strong password for authentication could be an option, at least for the interim. Another idea might be to switch to certificate-based protection of laptop access in cases where this can be rolled out quickly or is available anyway.
In the long term, organizations must rethink their basic strategies regarding strong authentication, Martin Kuppinger maintains. Versatility should be the cornerstone of any new authentication strategy, he says. This means the ability to switch flexibly between authentication mechanisms as need arises. Too often today, authentication technology is built into each and every application by hard-coding the interface to that mechanism. Versatile authentication, by contrast, is based on the concept of intermediation. It should be a standard feature today.
By de-coupling authentication from the applications themselves, KuppingerCole believes, it becomes much simpler to exchange authentication mechanisms, enabling organizations can react faster if a mechanism becomes too expensive or security problems such as those arising from the RSA hack are detected.