Incident: RSA Security Breach Compromising SecurID Tokens and Defense Contractors

Published Date: 2011-03-17

Postmortem Analysis
Timeline 1. The software failure incident involving RSA's SecurID authentication technology occurred in March 2011 as mentioned in <Article 4616>. 2. The incident was estimated to have occurred in March 2011 based on the article's publication date of March 17, 2011.
System 1. RSA's SecurID two-factor authentication system [8429, 6227, 6197, 4640, 4616, 7254]
Responsible Organization 1. Hackers targeted RSA Security, leading to a security breach affecting its SecurID two-factor authentication products [4616, 7254]. 2. The attackers used phishing emails and an exploit for an unpatched Adobe Flash vulnerability to breach RSA's systems [5445]. 3. The attackers targeted defense contractors like Lockheed Martin and L-3 Communications using information stolen from RSA [6181].
Impacted Organization 1. RSA's SecurID tags, Google, Facebook, Microsoft, Abbot Laboratories, Charles Schwab, Freddie Mac, PriceWaterhouseCoopers, Wells Fargo, Amazon, IBM, Intel, Yahoo, Cisco, European Space Agency, IRS, General Services Administration, Northrop Grumman, MIT, Comcast, Windstream, Verizon, AT&T, Sprint, and McAfee were impacted by the software failure incident [8429]. 2. Lockheed Martin, L-3 Communications, and Northrop Grumman were also impacted by the software failure incident related to the breach at RSA [6227, 6181, 7254].
Software Causes 1. Phishing e-mails containing a zero-day exploit targeting a vulnerability in Adobe Flash were used to drop a backdoor onto recipients' computers, allowing attackers to gain access to the network [Article 7254]. 2. Malware was installed on compromised PCs through an Excel file attached to phishing e-mails, exploiting a hole in Adobe Flash [Article 5445]. 3. A breach at RSA resulted in the theft of information related to the company's SecurID two-factor authentication products, potentially reducing the effectiveness of the authentication system [Article 4616]. 4. Attackers used duplicates of SecurID keys issued by RSA to breach defense contractors like Lockheed Martin and L-3, leading to the decision to replace most security tokens [Article 6181].
Non-software Causes 1. Phishing emails were used to trick employees into opening malicious attachments, leading to the breach [7254]. 2. Zero-day exploit targeting a vulnerability in Adobe Flash was used to drop a backdoor onto the recipient's computer [7254]. 3. Spoofed emails were crafted to appear to come from a legitimate source, such as a job-seeking and recruiting site [7254].
Impacts 1. The software failure incident involving the breach at RSA had significant impacts on various organizations, including defense contractors like Lockheed Martin, L-3 Communications, and Northrop Grumman, as attackers used stolen information related to RSA's SecurID two-factor authentication products to target these companies [6227, 6181]. 2. The breach led to RSA offering to replace or monitor all SecurID tokens for its customers, with major clients like Bank of America and SAP accepting the offer, indicating a loss of trust in the security of the tokens [6197]. 3. The incident raised concerns about the effectiveness of the two-factor authentication system provided by RSA, potentially reducing the security of networks relying on this technology [4616]. 4. The attack demonstrated the vulnerability of even large and reputed security firms like RSA to cyberattacks, highlighting the pervasive threat of advanced persistent threats (APTs) in the cybersecurity landscape [7254]. 5. The breach also showcased the sophistication of the attack, involving phishing emails, zero-day exploits in Adobe Flash, and the deployment of backdoors like Poison Ivy, emphasizing the need for robust cybersecurity measures to combat such threats [7254].
Preventions 1. Implementing stronger email security measures to detect and prevent phishing attacks could have prevented the software failure incident [7254]. 2. Regularly updating and patching software vulnerabilities, such as the zero-day exploit in Adobe Flash, could have mitigated the risk of the attack [7254]. 3. Enhancing employee training on cybersecurity best practices, including avoiding suspicious emails and not opening attachments from unknown sources, could have increased awareness and prevented the attack [7254]. 4. Utilizing more advanced security monitoring technologies, like SIEM products, to detect unusual network behavior and unauthorized access could have helped identify the intrusion earlier [4616]. 5. Implementing stricter access controls and enforcing the principle of least privilege for assigning roles and responsibilities to security administrators could have limited the attackers' ability to move laterally within the network [4616].
Fixes 1. Replacing the security tokens for nearly all of its SecurID customers, as announced by RSA after the breach incident [Article 6181]. 2. Increasing the length of employee PINs or passwords used in conjunction with the SecurID system [Article 6181]. 3. Enforcing strong password and PIN policies, following the rule of least privilege, and re-educating employees on avoiding suspicious emails and not providing credentials without verifying identity [Article 4616]. 4. Hardening, monitoring, and limiting remote and physical access to infrastructure hosting critical security software, as well as updating security products and operating systems with the latest patches [Article 4616]. 5. Examining help desk practices for information leakage, increasing focus on security for social media applications, and enforcing two-factor authentication to control access to active directories [Article 4616].
References 1. Article 8429 gathers information from security analyst Brian Krebs' blog and a list of affected organizations presented to Congress. 2. Article 6227 gathers information from CNET, The New York Times, Wired, and FoxNews.com. 3. Article 6197 gathers information from a letter to customers from RSA, news reports about Lockheed Martin, and FoxNews.com. 4. Article 4640 gathers information from an open letter to customers from RSA's Executive Chairman Art Coviello, CNET, and a blog post by Uri Rivner. 5. Article 5445 gathers information from a blog post by Uri Rivner, a document filed with the SEC, and conversations with security professionals. 6. Article 4616 gathers information from RSA's blog post, a document filed with the SEC, and a spokesman for RSA. 7. Article 7254 gathers information from F-Secure's discovery and analysis of the malware used in the attack on RSA.

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - RSA Security was hacked in March, leading to a breach that compromised the effectiveness of its SecurID two-factor authentication tokens [4616]. - RSA later announced that the breach led to hackers targeting defense contractor Lockheed Martin using duplicates of the SecurID keys issued by RSA [6181]. - The incident involving the breach at RSA was sophisticated and involved phishing emails with a zero-day exploit targeting Adobe Flash [7254]. (b) The software failure incident having happened again at multiple_organization: - The breach at RSA also impacted other defense contractors like L-3, who were targeted in similar attacks using information apparently stolen from RSA [6181]. - The incident at RSA highlighted the pervasiveness of cyberattacks, with various big-named companies like Google, Facebook, Microsoft, and others being victims of a massive cyberattack [8429].
Phase (Design/Operation) design, operation (a) In the software failure incident related to the RSA breach, the failure due to the design phase is evident. The breach involved the theft of information related to RSA's SecurID two-factor authentication products, which are designed to add an extra layer of protection to the login process [Article 4616]. The attackers exploited a vulnerability in Adobe Flash through a phishing email containing a malicious attachment, leading to the installation of a backdoor on the recipient's computer [Article 7254]. This breach highlighted a failure in the design of the system's security measures, allowing attackers to gain unauthorized access to sensitive information. (b) The software failure incident also involved failures related to the operation phase. The breach at RSA was accomplished through phishing emails that targeted employees and tricked them into opening malicious attachments [Article 7254]. The attackers were able to gain access to the systems and data they were after by exploiting human error in the operation of the system. Additionally, the breach led to the compromise of defense contractors like Lockheed Martin, indicating operational failures in maintaining the security of the systems [Article 6181].
Boundary (Internal/External) within_system, outside_system (a) The software failure incident related to the RSA breach and compromise of SecurID tokens can be categorized as within_system. The breach involved sophisticated cyberattacks targeting RSA's systems, leading to the theft of information related to the SecurID two-factor authentication products [Article 4616]. The attackers used phishing emails with malicious attachments that exploited vulnerabilities in Adobe Flash to gain access to the network and steal sensitive information [Article 7254]. This breach originated from within the system, highlighting vulnerabilities in RSA's security measures and the potential compromise of its authentication products. (b) The software failure incident can also be categorized as outside_system due to the external factors that contributed to the breach. The attack was classified as an Advanced Persistent Threat (APT), a type of cyberattack that involves extensive knowledge of the target company's operations, network, and employees [Article 4616]. Additionally, the attackers targeted defense contractors like Lockheed Martin using information obtained from the RSA breach, indicating external threats impacting organizations beyond RSA [Article 6181]. This incident demonstrates how external factors, such as targeted attacks and espionage campaigns, can lead to software failures and security breaches.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident involving RSA's SecurID tokens being compromised was due to a cyberattack that led to a vulnerability in the tokens. The attack involved phishing emails with a zero-day exploit targeting a vulnerability in Adobe Flash, which allowed the attackers to drop a backdoor onto the recipient's computer, giving them access to the network [Article 7254]. - The breach at RSA was categorized as an Advanced Persistent Threat (APT), which is known for targeting source code and intellectual property. APT attacks involve extensive work to map a company's infrastructure and often go undetected by traditional security measures [Article 4616]. (b) The software failure incident occurring due to human actions: - The attack on RSA involved targeted phishing emails sent to employees, tricking one of them to open an attachment that contained a zero-day exploit. The email was crafted to appear to come from a "web master" at Beyond.com, a job-seeking site, and contained a simple message prompting the recipient to open the attached file [Article 7254]. - The attack on RSA involved social engineering tactics to trick employees into opening malicious attachments, highlighting the role of human actions in introducing the contributing factors that led to the breach [Article 7254].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The incident involving RSA's SecurID breach was not directly attributed to hardware failure but rather to a cyberattack that compromised the security of the SecurID tokens [4616]. - The breach involved a phishing email with a malicious attachment that exploited a zero-day vulnerability in Adobe Flash to drop a backdoor onto the recipient's computer, giving attackers access to the network [7254]. (b) The software failure incident occurring due to software: - The software failure incident involving RSA's SecurID breach was primarily due to software vulnerabilities exploited by attackers [4616]. - The breach involved the theft of information related to RSA's SecurID two-factor authentication products, indicating a failure in the software security measures [4616]. - The attackers used a backdoor known as Poison Ivy RAT to gain remote access to compromised systems, highlighting a software vulnerability exploited in the attack [5445].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident related to the RSA breach was malicious in nature. The breach involved a sophisticated cyberattack that targeted RSA's SecurID two-factor authentication products, with the attackers stealing information that could potentially be used to reduce the effectiveness of the authentication system [Article 4640]. The attack was categorized as an Advanced Persistent Threat (APT), which is known for targeting source code and intellectual property, involving extensive knowledge of the company's operations, network, and employees [Article 4616]. The attackers used phishing emails and an exploit for an unpatched Adobe Flash vulnerability to gain access to RSA's systems and extract sensitive information [Article 5445]. Additionally, the attackers were able to use the stolen information to target defense contractors like Lockheed Martin and L-3 Communications [Article 6181]. (b) The software failure incident was non-malicious in the sense that it was not caused by unintentional factors. The breach was a result of a deliberate cyberattack orchestrated by threat actors with the intent to compromise RSA's systems and potentially harm the security of its customers [Article 7254]. The attack involved social engineering tactics, zero-day exploits, and the deployment of malware to infiltrate the network and extract valuable information related to the SecurID products [Article 7254]. The incident highlighted the importance of cybersecurity measures and the need for organizations to strengthen their defenses against such targeted attacks.
Intent (Poor/Accidental Decisions) poor_decisions (a) poor_decisions: The software failure incident related to the RSA breach was due to poor decisions made by the attackers who sent targeted phishing emails to RSA employees. These emails contained malicious attachments that exploited a zero-day vulnerability in Adobe Flash, leading to the installation of a backdoor on the recipient's computer, providing the attackers access to RSA's network [Article 7254]. (b) accidental_decisions: The software failure incident was not due to accidental decisions but rather a deliberate and sophisticated attack orchestrated by hackers who targeted RSA's SecurID two-factor authentication products. The attackers used phishing emails with malicious attachments to breach RSA's systems and steal information related to the SecurID products [Article 4616].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The incident involving RSA's SecurID breach was a result of an "extremely sophisticated cyberattack" that led to the theft of information related to the company's SecurID two-factor authentication products [Article 4616]. - The attackers used phishing emails with a zero-day exploit targeting a vulnerability in Adobe Flash to drop a backdoor onto the recipient's computer, allowing them to gain access to the network [Article 7254]. (b) The software failure incident occurring accidentally: - The incident involving RSA's SecurID breach was not accidental but rather a targeted cyberattack involving sophisticated methods like phishing emails and zero-day exploits [Article 4616]. - The attackers behind the breach were able to gain access to RSA's systems and steal information related to the SecurID products through a well-crafted phishing email that tricked an employee into opening a malicious attachment [Article 7254].
Duration temporary (a) The software failure incident in the articles was temporary. The incident involved a breach at RSA that compromised the effectiveness of its SecurID two-factor authentication tokens. The breach occurred in March, and RSA took steps to address the issue by offering to replace or monitor all SecurIDs for its customers [Article 6197]. Additionally, the attack involved phishing emails and an exploit for an unpatched Adobe Flash vulnerability, allowing the attackers to remotely take control of computers and gain access to sensitive information [Article 5445]. (b) The software failure incident was not permanent as it was a result of specific circumstances such as the breach at RSA and the exploitation of vulnerabilities. The incident was not a result of inherent flaws in the software itself but rather external factors that led to the compromise of security measures.
Behaviour crash, omission, value, other (a) crash: - Article 4616 reports a security breach at RSA where the attackers succeeded in stealing information related to the company's SecurID two-factor authentication products. RSA assured customers that the information extracted does not enable a successful direct attack on any of their RSA SecurID customers, but it could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack. This incident can be categorized as a crash where the system lost its state and was compromised by the attackers [4616]. (b) omission: - Article 7254 describes how RSA was hacked through targeted phishing emails that contained a malicious attachment. When one of the recipients clicked on the attachment, a backdoor was dropped onto the recipient's computer, giving the attackers a foothold to burrow farther into the network and gain the access they needed. This failure can be categorized as an omission where the system omitted to perform its intended functions by allowing unauthorized access through a phishing attack [7254]. (c) timing: - There is no specific instance in the provided articles where the failure can be categorized as a timing issue. (d) value: - Article 6181 mentions that the attackers used duplicates of the SecurID keys issued by RSA to breach defense contractors like Lockheed Martin. This incident can be categorized as a value failure where the system performed its intended functions incorrectly by allowing the compromised keys to be used for unauthorized access [6181]. (e) byzantine: - There is no specific instance in the provided articles where the failure can be categorized as a byzantine behavior. (f) other: - The failure incident reported in the articles can also be categorized as a sophisticated cyberattack that led to vulnerabilities in RSA's SecurID tags, affecting various organizations and potentially compromising the security of their systems. This can be considered as a form of a security breach or hack, where the system behaved erroneously with inconsistent responses and interactions, leading to unauthorized access and potential data breaches [8429, 6227, 6197, 4640].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: People lost their lives due to the software failure - There is no mention of any deaths resulting from the software failure incident reported in the articles [8429, 6227, 6197, 4640, 5445, 6181, 7254]. (b) harm: People were physically harmed due to the software failure - There is no mention of any physical harm to individuals resulting from the software failure incident reported in the articles [8429, 6227, 6197, 4640, 5445, 6181, 7254]. (c) basic: People's access to food or shelter was impacted because of the software failure - There is no mention of people's access to food or shelter being impacted due to the software failure incident reported in the articles [8429, 6227, 6197, 4640, 5445, 6181, 7254]. (d) property: People's material goods, money, or data was impacted due to the software failure - The software failure incident led to the compromise of information related to RSA's SecurID two-factor authentication products, potentially reducing the effectiveness of two-factor authentication implementations [4640]. - The breach resulted in the theft of information related to RSA's SecurID products, which could be used to reduce the effectiveness of two-factor authentication implementations [4616]. - The breach at RSA led to the theft of information related to the company's SecurID two-factor authentication products, impacting the security of customer systems [7254]. (e) delay: People had to postpone an activity due to the software failure - There is no mention of people having to postpone activities due to the software failure incident reported in the articles [8429, 6227, 6197, 4640, 5445, 6181, 7254]. (f) non-human: Non-human entities were impacted due to the software failure - The software failure incident impacted the security of RSA's SecurID two-factor authentication products, potentially affecting the security of customer systems [7254]. (g) no_consequence: There were no real observed consequences of the software failure - The software failure incident had significant consequences, including the compromise of information related to RSA's SecurID products and potential impacts on customer systems [4640, 4616, 7254]. (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur - The breach at RSA potentially could have led to reduced effectiveness of two-factor authentication implementations [4640, 4616]. (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? - There are no other consequences mentioned in the articles beyond those related to compromised information and potential impacts on security systems.
Domain information, utilities, finance, government (a) The failed system was intended to support the information industry. RSA's SecurID two-factor authentication products were compromised in a cyberattack, affecting the security of information systems used by various organizations, including government agencies, defense contractors, and financial institutions [Article 4616]. (h) The failed system was also intended to support the finance industry. The compromised SecurID tokens were used by financial institutions like Bank of America and were part of the security measures for financial transactions and network access [Article 4616]. (l) The failed system was related to the government industry as well. The compromised SecurID tokens were used by government agencies and defense contractors, making the breach a concern for national security and sensitive government operations [Article 4616]. (m) Additionally, the incident was related to the utilities industry. While not explicitly mentioned in the articles, the compromised security system could potentially impact utilities that rely on secure authentication for their operations and services.

Sources

Back to List