RSA rival SafeNet blasts handling of broken tokens

Powered by SC Magazine
 

Customers affected by the RSA hack should review access controls and log management.

RSA rival SafeNet has taken a swipe at the company for only replacing compromised tokens for select customers, and has offered a series of remediation steps for those left out.

The company will replace SecurID tokens compromised in a March attack on its systems for customers with "concentrated user bases typically focused on protecting intellectual property and corporate networks".

It offered risk-based authentication strategies for consumer-focused customers "with a large, dispersed user base, typically focused on protecting web-based financial transactions".

"In other words, if RSA views your data to be valuable enough to secure, then they say they will replace your potentially compromised SecurID tokens," SafeNet Asia Pacific vice president Humphrey Chan said.

"Beyond asking themselves if they are lucky enough to be considered for a replacement, customers should really be asking if replacing old tokens with new ones actually solves the problem."

Chan said companies should ensure they do not have a single point of failure and focus on network hardening.

"If this conversation stays limited to one-time-password authentication and token swaps, then we haven’t learned anything."

The company's director of government security solutions, Chris Ensey, offered security remediation tips for affected companies.

  • Update client protections: It is important to require clients to update system software with the latest security patches and access control policies prior to accessing the network. To reduce the opportunity for key logging of passwords and token information, clients need to make sure all clients connecting via SecurID's are scanned for malware and viruses.
  • Increase access controls: Introduce additional validation (password or PIN) to access the network. This may include requiring strong passwords for accessing highly sensitive data sets and applications. Administrators should also force a password change for accounts to minimise the threat of compromised account information. Any exchange of credential information must be encrypted in transit.
  • Elevate monitoring and audit: IT administrators should look for repeated invalid log in attempts, concurrent log in sessions from different source IPs, and account activity that is anomalous. Other monitoring and audit capabilities should be leveraged to evaluate possible malicious activity.
  • Replace tokens: The best way to protect your organisation from risk is to exchange SecurID tokens for either new tokens with an updated seed, or evaluate options from other vendors. Administrators may wish to temporarily block access to remote users if they are especially concerned about a breach.

RSA was contacted for comment.

Copyright © SC Magazine, Australia


RSA rival SafeNet blasts handling of broken tokens
 
 
 
Top Stories
Matching databases to Linux distros
Reviewed: OS-repository DBMSs, MariaDB vs MySQL.
 
Coalition's NBN cost-benefit study finds in favour of MTM
FTTP costs too much, would take too long.
 
Who'd have picked a BlackBerry for the Internet of Things?
[Blog] BlackBerry has a more secure future in the physical world.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  70%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  12%
 
Denial of service attacks
  6%
 
Insider threats
  10%
TOTAL VOTES: 702

Vote