In what has become an annual mecca for the data security industry, thousands visit San Francisco each February to attend “RSA” — a conference named after the network security company purchased by data storage firm EMC five years ago. This mega-conference caters to the security cognoscenti — as well as those who only profess to be.
Well, a few days ago, RSA announced it was the latest high-profile victim of an APT exploit. As recognized by RSA’s Executive Chairman, Art Coviello,”APT threats are becoming a significant challenge for all large corporations.” These exploits are the same sort of attacks that the press were quick to blame the Chinese on last year. In fact, the Wall Street Journal reported last year that these attacks impacted over 2,400 businesses. How exactly can a company avoid an APT or “advanced persistent attack” when a firm like RSA also gets hit by such criminal activity?
By way of background, APTs are social engineering techniques — once upon a time simply known as confidence or con games — applied with a healthy dose of hacking and malware. RSA’s attack is a bit more troublesome than most APTs given the possible repercussions to customers as per a recent alert:
We have determined that a recent attack on RSA’s systems has resulted in certain information being extracted from RSA’s systems that relates to RSA’s SecurID two-factor authentication products. While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack. RSA urges immediate action.
The reason that this breach is significant has to do with the fact RSA customers all over the world use RSA SecurID to protect outside access to sensitive data. In order to access a computer protected by SecurID, users enter a traditional password as well as the number displayed on their RSA SecurID hardware token. The numeric value displayed on the token changes once every few minutes to provide added protection.
Although the security community gave RSA high marks for its quick disclosure, there are obvious concerns — not the least of which is the mere fact that a firm such as RSA was able to be compromised in the first place. A leading security consultant voiced a complaint that the lack of information emanating from firm makes it hard for customers to know what exactly to do other than be really diligent regarding password usage.
Although exactly how RSA was compromised will likely never make it to the kitchen table, there are many vectors that can be compromised during a successful APT threat. The key factor to a successful APT exploit is the level of trusted connection breached — whether that is an executive friend on FaceBook or a next door neighbor’s email address. Another important success factor is the willingness to be patient and wait for the right time to retrieve the sought-after information. This is where there is a significant disconnect from the typical financial data hacker. Such hackers may wait before using card data to commit a fraudulent purchase but will not likely wait to steal the compromised data. That is why most APTs are blamed on governmental entities — who are notoriously patient when moving on a target. Those committing APTs may get very valuable data along the way but would never risk getting caught with such data until the final target is achieved. In other words, the APT criminal may spend months lurking in a network before any information is even compromised. That is one of the reasons why detecting APT activity is so difficult.
For now, the way to address this very real corporate threat is not necessarily to change a firm’s security posture. The threat is more derived from employee policy lapses, i.e., use of social media at a workstation and use of infected thumb drives, than it is from brute force hacking. Accordingly, employee training and testing that is tied to discipline and compensation is a step in the right direction.
Thinking like an intelligence agency can’t hurt. If a senior executive does not need to know all aspects of a project, there is no need to provide her with constant email reports. In other words, the old adage “on a need to know basis” becomes more and more important as APTs become more and more familiar to corporations.
Finally, the basic tenets of risk management should play a role in the defense of APTs — if there is even such as a thing as a viable defense. Knowing the relative value of your assets and the costs to mitigate a loss in advance of a loss are the bread and butter of risk managers. Applying such insight in the proper measure will remove from the equation some ego-driven security initiatives to be replaced by focused efforts aimed at the most sensitive data of an organization. Risk managers are routinely given the task of protecting the personal assets of the chairman of the board — by, among other things, a D&O insurance placement — as well as coordinating large scale enterprise risk management initiatives. Providing some guidance on this front should not be that much of a stretch.