Hackers step up attacks

The recent increase in attacks on security firms raises some important questions when it comes to protection of intellectual property.

The Internet‘s security infrastructure is under attack. Two major incidents against Comodo and RSA have raised the question of not just whether the enterprise can withstand hacker attacks but if the security firms we all count on to guard the infrastructure can protect themselves.

Earlier this week, Internet security firm Comodo revealed it had been tricked into minting nine high-value digital certificates that could allow the attackers to create fraudulent sites that fool users into thinking they are visiting Google, Yahoo, Skype or Microsoft’s Live service. The sting on Comodo follows a more serious attack on RSA, which netted the infiltrators unspecified information that could compromise the security of the company’s one-time password product SecurID.

These breaches follow other recent high-profile security events, including Anonymous’s campaign to compromise HBGary Federal and Stuxnet‘s use of stolen code-signing certificates against Iran‘s nuclear capability. Altogether, it’s undeniable that attackers now see the value in focusing on those companies and products that provide defense.

Be sure to go to  the source to see what needs to change.

Related articles

• Comodo hacker outs himself, claims “no relation to Iranian Cyber Army” (nakedsecurity.sophos.com)
• Hackers target Google, Skype with rogue SSL certificates (infoworld.com)
• Is SecureID broken? (kbtcomputers.wordpress.com)

 

Is SecureID broken?

Considering the lack of information coming from the RSA is it a fair assumption?

It’s been a week since RSA dropped a vaguely worded bombshell on 30,000 customers that the soundness of the SecurID system they used to secure their corporate and governmental networks was compromised after hackers stole confidential information concerning the two-factor authentication product.

For seven days, reporters, researchers, and customers have called on RSA, and its parent corporation EMC, to specify what data was lifted – or at the very least to say if it included details that could allow government or corporate spies to predict the one-time passwords that SecurID tokens generate every 60 seconds. And for seven days, the company has resolutely refused to answer. Instead, RSA has parroted Security 101 how-tos about strong passwords, support-desk best practices, and the dangers of clicking on email attachments.

It comes down to two simple questions.

Were the individual seed values used to generate a new pseudo-random number exposed and, similarly, was the mechanism that maps a token’s serial number to its seed leaked?

Without the answers to those two basic questions, RSA customers can’t make educated decisions about whether to continue relying on SecurID to prevent unauthorized logins to their sensitive networks. After all, if the breach on RSA’s servers exposed the seeds and the mapping mechanism, SecurID customers have lost one of the factors offered by the two-factor authentication product.

Go to the source to read more on this important issue regarding network security.

Related articles

• RSA SecurID – What’s the Risk? (itsecurityexpert.co.uk)
• Should You Stop Using RSA SecurID Tokens? (pcworld.com)

 

 

Organizations ignoring security …

as they move to cloud services.

Companies are under increased pressure to cut costs and are turning to a variety of Web-based services, from online collaboration tools to social networking platforms, without considering the increased risks they pose and in some cases failing to inform IT security.

Two studies released today from EMC‘s RSA security division address the increased risks posed by cloud-based services and social networking. The 2009 IDG Research Services survey, commissioned by RSA, surveyed 100 security executives at companies with revenues of $1 billion or more. It found that many organizations lack a security strategy to address the risks associated with cloud-based services.

Nearly half of those surveyed either have enterprise applications or business processes running in the cloud or are beginning migration in the next 12 months. Yet, two-thirds do not have a security strategy in place for cloud computing, the survey found.

“The rapid adoption of nascent Web, social and mobile technologies combined with the rising use of outsourcing is quickly dissolving what remains of the traditional boundaries around our organizations and information assets,” Art Coviello, executive vice president at EMC and president at RSA said in a statement.

It is the third study in recent months that address the risks associated with the growing use of Web-based services. (Source: RSA council addresses growing security risks in the cloud – Search Security)

Very troubling.  Read the whole thing.

Related articles by Zemanta

• If In Doubt, Choose an Emotive Headline (cloudave.com)
• Cloud Computing Security Framework May Nudge The Enterprises Towards Clouds (cloudave.com)
• Be careful putting your trust in the clouds (guardian.co.uk)
• Introducing the Cloud Security Alliance (not by ruv) (elasticvapor.com)