RSA rival SafeNet blasts handling of broken tokens

RSA rival SafeNet has taken a swipe at the company for only replacing compromised tokens for select customers, and has offered a series of remediation steps for those left out.

The company will replace SecurID tokens compromised in a March attack on its systems for customers with "concentrated user bases typically focused on protecting intellectual property and corporate networks".

It offered risk-based authentication strategies for consumer-focused customers "with a large, dispersed user base, typically focused on protecting web-based financial transactions".

"In other words, if RSA views your data to be valuable enough to secure, then they say they will replace your potentially compromised SecurID tokens," SafeNet Asia Pacific vice president Humphrey Chan said.

"Beyond asking themselves if they are lucky enough to be considered for a replacement, customers should really be asking if replacing old tokens with new ones actually solves the problem."

Chan said companies should ensure they do not have a single point of failure and focus on network hardening.

"If this conversation stays limited to one-time-password authentication and token swaps, then we haven’t learned anything."

The company's director of government security solutions, Chris Ensey, offered security remediation tips for affected companies.

• Update client protections: It is important to require clients to update system software with the latest security patches and access control policies prior to accessing the network. To reduce the opportunity for key logging of passwords and token information, clients need to make sure all clients connecting via SecurID's are scanned for malware and viruses.

• Increase access controls: Introduce additional validation (password or PIN) to access the network. This may include requiring strong passwords for accessing highly sensitive data sets and applications. Administrators should also force a password change for accounts to minimise the threat of compromised account information. Any exchange of credential information must be encrypted in transit.

• Elevate monitoring and audit: IT administrators should look for repeated invalid log in attempts, concurrent log in sessions from different source IPs, and account activity that is anomalous. Other monitoring and audit capabilities should be leveraged to evaluate possible malicious activity.

• Replace tokens: The best way to protect your organisation from risk is to exchange SecurID tokens for either new tokens with an updated seed, or evaluate options from other vendors. Administrators may wish to temporarily block access to remote users if they are especially concerned about a breach.

RSA was contacted for comment.

Copyright © SC Magazine, Australia