This is one of those things that crosses your desk and immediately sends shivers up your spine:
RSA security firm hit by ‘sophisticated’ hackers
So if RSA, which is a company focused on technology security, is vulnerable to hackers, what hope do the rest of us have of repelling a determined intruder?
And having said that, what of RSA’s main product line–the “SecurID” VPN tokens?
For those that are unfamiliar, RSA’s VPN tokens are used by an estimated 40 million employees of large corporations and organizations. They generate a seemingly random six-digit number every 30 or 60 seconds, which the employees type in to log into virtual private networks or other sensitive systems.
This allows employees (or customers) to access sensitive systems in (what previously was considered) relative safety.
Secure no longer….
The issue here is that the hackers broke into RSA’s servers and stole data related to SecurID authentication tokens, and the RSA cryptography algorithm. This algorithm uses a 128-bit “seed” unique to each token to generate the numbers, which in and of itself is virtually impossible to crack. However, by accessing the RSA servers, the hackers may have bypassed this security, and may now have access to any RSA protected system.
What’s it all mean?
Unfortunately it means that (once again) the “bad guys” seem to have the upper hand, and that despite our best efforts our “impenetrable” security has proved vulnerable. We’ll need to continue to watch this one closely, to keep an eye on the severity of the impact of this breach.
But what of Health Information? How will this impact hospital systems (many of which use RSA SecurID tokens)?
And can any of us be confident that our systems are indeed secure? After all, if a security firm has had its systems compromised, with all the staff and resources they have available to protect against just such an attack, what happens to the rest of us, with budgets limited by real-world considerations?
It’s not a pleasant thought….