Skip to main content

RSA Security Breach : Lessons from the field

Remember RSA - The name is short for Rivest Shamir Aldeman, the trio that was reputed to have devised the first practical implementation of  Diffie-Helman key exchange protocol, a prime multiplication challenge whose security is based on the difficulty of finding the factors of the product of two large prime numbers (or numbers close enough to prime in implementation) if the adversary knows neither prime number.

The company of Ron Rivest, Adi Shamir, and Leonard Aldeman has gone through several corporate iterations including recent absorption by EMC, but the story of security hubris continues to be told. RSA remains one of the best known cryptographic algorithm despite its increasing weakness in light of mathematical advances as well as computational advances, but the force-de-jure of the company is not the success of its nicknamed cryptographic algorithm but the genius and innovation of its founders to discover clever "security" schemes based on cryptographic techniques. There seem to be consensus in the community of "security vendor" in a myth of "security through technology alone". Indeed, what the RSA breach shows is that no system can ever be secured if any component of people, policy and technology is not secure. The search for an ultimate security technology, including the idea of multi-factor authentication is one that is bound to fail as long as the cornerstone of any security architecture does not include that core element.

It is not clear, at least not from the information made publicly available by EMC , how the latest advertised breach was effected and what the real attack vector was, but RSA customers sold on the idea of a highly secure authentication mechanism; just like many are beng sold on the value of biometric  security, are flailing in the wind right now as they try to hazard some clarity as to what to protect against.

Of course one key failure of the RSA Secure ID technology is the idea of a central key store for authentication-token : A kind of security by obscurity

http://www.nytimes.com/2011/03/19/technology/19secure.html?partner=rss&emc=rss

http://www.rsa.com/rsalabs/node.asp?id=2214

http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

http://www.informationweek.com/news/security/attacks/showArticle.jhtml?articleID=229301301&cid=RSSfeed_IWK_News

Comments

Popular posts from this blog

Excerpts from a Messaging & Collaboration White Paper

Current Trends – Cloud (Hosted) Messaging Solutions Email is only one of a growing portfolio of services in what is routinely referred to as Unified Communication (UC) infrastructure. From the hardware and infrastructure point of view, this often means the integration of network systems for telephone (landlines), internet (data link), video (conferencing, cable etc.) and cellular communication. From the services point of view, the usual term is Unified Messaging (UM) – which encompasses email, voice mail, video mail, instant messaging, and SMS messaging. Other components of UM include social networking sites and tools such as RSS, Facebook, Twitter, Google Voice, Google Wave [1] , document management, project management and a growing catalog of innovative solutions. Messaging platforms are evolving and as vendors make these capabilities available in their free consumer versions, business user expectations are also being shaped by their experiences on thes...

iOS Developer Program License Agreement

LEASE READ THE FOLLOWING LICENSE AGREEMENT TERMS AND CONDITIONS CAREFULLY BEFORE DOWNLOADING OR USING THE APPLE SOFTWARE. THESE TERMS AND CONDITIONS CONSTITUTE A LEGAL AGREEMENT BETWEEN YOU AND APPLE. iOS Developer Program License Agreement Purpose You would like to use the Apple Software (as defined below) to develop one or more Applications (as defined below) for Apple-branded products running the iOS. Apple is willing to grant You a limited license to use the Apple Software to develop and test Your Applications on the terms and conditions set forth in this Agreement. Applications developed under this Agreement can be distributed in two ways: (1) through the App Store, if selected by Apple, and (2) on a limited basis for use on Registered Devices (as defined below). Applications that meet Apple's Documentation and Program Requirements may be submitted for consideration by Apple for distribution via the App Store. If submitted by You and selected by Apple, Your Appli...

Obama : The Country We Believe In

A speech by The President of the United States of America, Barack Obama, on April 13, 2011 at Goerge Washington University... Good afternoon.  It’s great to be back at GW.  I want you to know that one of the reasons I kept the government open was so I could be here today with all of you.  I wanted to make sure you had one more excuse to skip class.  You’re welcome.