I've blogged last week about the RSA SecurID case. In the meantime there were several other posts and advices on that and I'd like to put together some thoughts from my side about that, looking at what customers should do now.
What should existing customers do short-term?
In most cases, RSA SecurID will be a standard mechanism for strong authentication which can't be replaced immediately. If customers don't use a solution for versatile authentication they usually aren't able to opt for another (stronger) authentication mechanisms on the fly. Not using RSA SecurID however will make things even worse, because that would mean to step back to one factor with one or two means for authentication. Thus it is about staying with RSA SecurID and deciding about which additional actions to take - "compensatory controls", e.g. increased auditing, additional fraud detection technologies, and so on.
Customers who have a versatile authentication approach in place might evaluate whether they can replace RSA SecurID with another factor - which then would be, for time and logistics reasons, an approach not depending on hardware. However doing that will be somewhat complex (helpdesk calls, technical aspects,...). Thus customers should first check whether the increased risk of using RSA SecurID is acceptable or not. Instead of replacing the option of adding another factor/means for interactions and transactions with high risk appears to be most appropriate. Besides this, the actions mentioned abovr in auditing have to be implemented.
What should existing customers do mid-term?
Replacing a technology like RSA SecurID is quite expensive. Given that RSA will harden its own systems and seeds can be changed over time, the threat will decrease. However, as mentioned in my last post, RSA SecurID never will be the same again. The mid-term answer, from my perspective, is versatility. Having more options for quickly changing to other and additional factors and means for authentication is the most promising approach. Thus, RSA SecurID is just one of multiple approaches.
For high risk environments, biometrics might come into play again (if not used yet). In addition there are some approaches of two-factor authentication which don't rely on seeds and secrete algorithms. However they aren't necessarily absolutely secure (if anything could be absolutely secure), thus customers should carefully evaluate whether other approaches provide real advantages above the established RSA SecurID approach. The same level of mistrust should be used for all types of authentication.
What should potential buyers do?
It is about re-evaluating the strategy for authentication. Versatility is key - and the strategies need to be re-thought if they are not focused on a versatile approach allowing different types of authentication mechanisms to be used and exchanged flexibly. Regarding RSA SecurID, the risk has to be rated again and decisions about whether the approach is sufficient for the interactions and transactions which have to protected have to be reviewed. From my perspective it is not that much about not using RSA SecurID (depending on what RSA does to increase security again, for sure - but I assume they will do a lot) but to carefully analyze the level of protection provided and weigh this against the risks of authentication fraud for what has to be protected. When deciding to use RSA SecurID appropriate controls have to be implemented - but that is true for any other authentication mechanism as well.
By the way: Regardless of the RSA SecurID approach, any authentication strategy which doesn't focus on versatility, risk-based authentication/authorization and context-based authentícation/authorization should be re-thought.
Some general thoughts:
RSA has had a very strong image for their RSA SecurID approach - and it worked for many years. However there are two fundamental issues:
- Centralized seeds
- Confidential algorithm
Again, like mentioned in my last post, we will discuss things like versatile authentication and the RSA SecurID incident at the EIC 2011. You shouldn't miss that event.