RSA rival SafeNet blasts handling of broken tokens

Powered by SC Magazine
 

Customers affected by the RSA hack should review access controls and log management.

RSA rival SafeNet has taken a swipe at the company for only replacing compromised tokens for select customers, and has offered a series of remediation steps for those left out.

The company will replace SecurID tokens compromised in a March attack on its systems for customers with "concentrated user bases typically focused on protecting intellectual property and corporate networks".

It offered risk-based authentication strategies for consumer-focused customers "with a large, dispersed user base, typically focused on protecting web-based financial transactions".

"In other words, if RSA views your data to be valuable enough to secure, then they say they will replace your potentially compromised SecurID tokens," SafeNet Asia Pacific vice president Humphrey Chan said.

"Beyond asking themselves if they are lucky enough to be considered for a replacement, customers should really be asking if replacing old tokens with new ones actually solves the problem."

Chan said companies should ensure they do not have a single point of failure and focus on network hardening.

"If this conversation stays limited to one-time-password authentication and token swaps, then we haven’t learned anything."

The company's director of government security solutions, Chris Ensey, offered security remediation tips for affected companies.

  • Update client protections: It is important to require clients to update system software with the latest security patches and access control policies prior to accessing the network. To reduce the opportunity for key logging of passwords and token information, clients need to make sure all clients connecting via SecurID's are scanned for malware and viruses.
  • Increase access controls: Introduce additional validation (password or PIN) to access the network. This may include requiring strong passwords for accessing highly sensitive data sets and applications. Administrators should also force a password change for accounts to minimise the threat of compromised account information. Any exchange of credential information must be encrypted in transit.
  • Elevate monitoring and audit: IT administrators should look for repeated invalid log in attempts, concurrent log in sessions from different source IPs, and account activity that is anomalous. Other monitoring and audit capabilities should be leveraged to evaluate possible malicious activity.
  • Replace tokens: The best way to protect your organisation from risk is to exchange SecurID tokens for either new tokens with an updated seed, or evaluate options from other vendors. Administrators may wish to temporarily block access to remote users if they are especially concerned about a breach.

RSA was contacted for comment.

Copyright © SC Magazine, Australia


RSA rival SafeNet blasts handling of broken tokens
 
 
 
Top Stories
Qld Transport to replace core registration system
State's biggest citizen info repository set for overhaul.
 
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
Defence spends $50m to upgrade RAAF's air traffic systems
First step in long-running modernisation.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  21%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 906

Vote