2011EspionageSupply chain
RSA SecurID breach
Disclosed 17 March 2011
RSA disclosed in an open letter that it had been the target of an extremely sophisticated cyber attack and that information related to its SecurID two-factor authentication products had been extracted. RSA said the information could potentially reduce the effectiveness of SecurID deployments as part of a broader attack, and advised customers on hardening.
- Victim
- RSA, the security division of EMC
- Sector
- Technology (security vendor)
- Public attribution
- RSA described an advanced persistent threat; this page makes no attribution.
Impact
Customers of a widely used authentication product had to reassess its strength; the case is a reference point for attacks on security vendors.
Root cause
A targeted intrusion into the vendor that reached sensitive data about an authentication product.
Lessons learned: the controls it teaches
- Treat security vendors as part of your supply chain and plan for their compromise.
- Defence in depth: one authentication factor should never be the only control on critical access.
- Protect secrets such as token seeds with strong segmentation and monitoring.