John Markoff’s article “SecurID Company Suffers a Breach of Data Security” in The New York times reveals an embarrassing data security breach for information security industry giant RSA Security. The security breach involved the theft of some unspecified information related to RSA’s SecurID product.

The security breach is hugely significant as by RSA’s own admission, 250 million people globally use a SecurID “token” (see photo) to authenticate their identity to their information systems. The SecurID token essentially provides a second password for use during login, an information security technique called “strong authentication.” Strong authentication is more complicated (and expensive) to implement than traditional password-only authentication (also known as “weak authentication”). Therefore, strong authentication is typically only used to protect valuable, sensitive information assets, or assets that are perceived to be more vulnerable to attack. For example, many corporations and government sites require the use of SecurID tokens for remote access via the Internet.

So, to summarize, the security product used to help control access to some of the most sensitive information systems in the world has been compromised. Oops.

What is the precise nature of the compromise? RSA isn’t precisely saying. RSA behaved responsibly by notifying their customers of the problem.

An open letter from company chairman Art Coviello was prominently posted on the RSA website, giving a high-level explanation of the security breach. Unfortunately, aside from using the new “Advanced Persistent Threat” buzz-phrase, nothing of substance about the security breach was revealed.

If your site uses SecurID tokens as part of their information security infrastructure, I suspect that you’ll be paying close attention to this story for the foreseeable future. More information will be forthcoming in the coming weeks and months as the many SecurID users around the world demand to know if their strong authentication systems are still strong. Only with additional information will it be possible for organizations to make an accurate and credible assessment.

—Jim Herbeck

RSA SecurID product photo and website fragment are ©Copyright EMC Corporation.