Known Knowns - RSA SecurID Related Breaches In The News Again - Another Military Contractor Hit

Just days after the Lockheed Martin RSA SecurID related breach, an employee leaked to Wired magazine that L-3, a large military contractor, was also a target of coordinated cyberattacks. As we mentioned in previous blogs, we wonder how many other users of RSA SecurID are compromised and if they have the necessary systems and wherewithal to detect digital intrusion attempts. Donald Rumsfeld, the former Secretary of Defense, definitely did not have cyberattacks and RSA SecurID related breaches in mind when he said:

“

There are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don't know we don't know.

”

But CIOs and CSOs of companies with a reluctance to switch from RSA SecurID to another stronger authentication solution should take that quote to heart. Even adopting one-time passwords (OTP) is a stopgap measure and will be futile with the coming onslaught of more sophisticated attack vectors. Enterprises should consider adopting stronger two-factor authentication solutions above and beyond OTPs and should deploy challenge-response and transaction data signing en masse. Mutual authentication (aka 2 way authentication) should be the bare minimum.

IT departments should maybe adopt the preemptive attack mindset of the former Secretary of Defense when it comes to defending their digital fortress from the hordes of cyber insurgents.