Keep Using SecurID, Despite The RSA Breach

Wayne Rash,

Thieves have stolen information from RSA relating to SecurID. Don’t panic, says Wayne Rash, keep other security strong

Two-factor authentication has been considered by many to be the gold standard for secure IT access. The idea is that you must have two things, something you have (such as a token) and something you know (such as a password).

Many companies, for example, require a smart card with an embedded identity chip to be inserted into a card reader before users can access corporate IT systems. Once the smart card is inserted, you’re then prompted for your password.

The SecurID security device, from RSA, was a token that you didn’t have to insert. It would present a number to the user that changed every 30 seconds. By typing in the number to a SecurID prompt, it demonstrated evidence that you had the token and would then let you enter a password. Exactly how RSA knew what number was the correct number at any given time was part of its strength – you didn’t need to equip your computers with card readers to have two-factor authentication.

Did hackers get the SecurID algorithm?

The algorithm that lets RSA know what number is the correct number may be part of what was stolen in a security breach of RSA’s data systems. Right now, RSA is frantically telling customers that their data is still safe. RSA is probably right. The simple possession of the algorithm isn’t enough to allow someone to break into an existing secure system.

The algorithm may tell how the process is accomplished, but in itself it isn’t going to reveal those numbers that change every 30 seconds. Even stealing a company’s key from RSA probably won’t help because it won’t reveal the correct number for the token at any given moment.

What’s more likely is that someone really wanted to know how the RSA SecurID worked, either so they could make their own competing product or so they could reverse engineer a device that eventually might be able to help gain access to protected information. But in reality, we don’t know for sure – because all that RSA has revealed is that information related to SecurID was taken, but they aren’t saying what that information was.