RSA rival SafeNet blasts handling of broken tokens

Powered by SC Magazine

Customers affected by the RSA hack should review access controls and log management.

RSA rival SafeNet has taken a swipe at the company for only replacing compromised tokens for select customers, and has offered a series of remediation steps for those left out.

The company will replace SecurID tokens compromised in a March attack on its systems for customers with "concentrated user bases typically focused on protecting intellectual property and corporate networks".

It offered risk-based authentication strategies for consumer-focused customers "with a large, dispersed user base, typically focused on protecting web-based financial transactions".

"In other words, if RSA views your data to be valuable enough to secure, then they say they will replace your potentially compromised SecurID tokens," SafeNet Asia Pacific vice president Humphrey Chan said.

"Beyond asking themselves if they are lucky enough to be considered for a replacement, customers should really be asking if replacing old tokens with new ones actually solves the problem."

Chan said companies should ensure they do not have a single point of failure and focus on network hardening.

"If this conversation stays limited to one-time-password authentication and token swaps, then we haven’t learned anything."

The company's director of government security solutions, Chris Ensey, offered security remediation tips for affected companies.

  • Update client protections: It is important to require clients to update system software with the latest security patches and access control policies prior to accessing the network. To reduce the opportunity for key logging of passwords and token information, clients need to make sure all clients connecting via SecurID's are scanned for malware and viruses.
  • Increase access controls: Introduce additional validation (password or PIN) to access the network. This may include requiring strong passwords for accessing highly sensitive data sets and applications. Administrators should also force a password change for accounts to minimise the threat of compromised account information. Any exchange of credential information must be encrypted in transit.
  • Elevate monitoring and audit: IT administrators should look for repeated invalid log in attempts, concurrent log in sessions from different source IPs, and account activity that is anomalous. Other monitoring and audit capabilities should be leveraged to evaluate possible malicious activity.
  • Replace tokens: The best way to protect your organisation from risk is to exchange SecurID tokens for either new tokens with an updated seed, or evaluate options from other vendors. Administrators may wish to temporarily block access to remote users if they are especially concerned about a breach.

RSA was contacted for comment.

Copyright © SC Magazine, Australia

RSA rival SafeNet blasts handling of broken tokens
Top Stories
Empty terminals and mountains of data
Qantas CIO Luc Hennekens says no-one is safe from digital disruption.
BoQ takes $10m hit on Salesforce CRM
Regulatory hurdles end cloud pilot.
Toll Group to go Google
Poaches Woolworths project manager.
Sign up to receive iTnews email bulletins
Latest Comments
Who do you trust most to protect your private data?

   |   View results
Your bank
Your insurance company
A technology company (Google, Facebook et al)
Your telco, ISP or utility
A retailer (Coles, Woolworths et al)
A Federal Government agency (ATO, Centrelink etc)
An Australian law enforcement agency (AFP, ASIO et al)
A State Government agency (Health dept, etc)

Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
I DON'T support shutting the OAIC.