EMC's Anti-Security Culture: Business First, Security Second

(Updated with additional copy and links - 1920 EST 10 Jun 2011): NetWitness' Chief Security Officer Eddie Schwartz has apparently become the first CSO that EMC's RSA Security division has ever had, which I thought was pretty amazing for a world leader in security technology. In the course of looking into who holds the position at RSA's parent company, EMC, I ran across an EMC Leadership and Innovation article written by former EMC CSO Roland Cloutier that expressed a corporate philosophy which, in my opinion, contributed to the success of the RSA attack earlier this year:

Security must be a business enabler 

Cloutier is adamant that security must be deployed in the service of business goals, enabling the innovation and responsiveness that create competitive advantage. "As security practitioners, our aim is to create an environment for our executives, engineers, and sales folks to build, deliver, and service the absolute best technologies without any impedance or concern about security in our environment," he says. "We want them to understand that security is not a business inhibitor."

One of the recommendations that Cloutier makes in order to keep security from becoming a "business inhibitor" is contained in a special EMC 2009 report "Top Global Security Officers Reveal Strategies for Driving Business Advantage in an Economic Crisis" when he apparently shrunk EMC's security department by 25% in order to create more "efficiency":

"In a tough economy, it's tempting for enterprises to rein in business innovation," said RSA President Art Coviello. "However, strategic initiatives that enable revenue growth and operational transformation are more critical than ever. Security practitioners can help business leaders safely pursue the most lucrative business opportunities by understanding the risk picture and identifying the right trade-offs. At the same time, security teams must find ways to squeeze the most out of every dollar. For example, EMC's Chief Security Officer and council member Roland Cloutier recently freed 25% of EMC's monitoring and response operational resources and achieved a four-fold improvement in alert performance by consolidating device, application and technology monitoring into a centralized SIEM solution."

 EMC's commitment to automation as a "sound" security practice continued right up to February 2011 with the release of their latest RSA security paper "Mobilizing Intelligent Security Operations for Advanced Persistent Threats" (.pdf). No wonder the marketing buzzword "APT" showed up in Art Coviello and Uri Rivner's statements about the March attack. The entire EMC technology and security leadership just finished writing a white paper on it! Here's one of the authors' three recommendations for defending against an APT attack:

3. Focus on developing capabilities that enable the analysis of security information in real time and the automatic adaptation of IT-based defenses. Automation will be essential in minimizing reaction times to attacks: the faster organizations can adapt and stay ahead of the attack, the less time the APT has to cause damage. 

The common theme underscoring all three reports is that in EMC's view automation as an efficiency measure AND a security necessity. It may be a necessity for enabling profitability in a down economy but automated defenses are counter-intuitive for any company that wants to protect its crown jewels from a dedicated and well-funded adversary. Here's why:

An automated solution will never stop a customized attack because the attack was designed to circumvent it!

I'm giving the keynote speech at Basis Technology's Government Users Conference next week on the lack of Cloud security and how Cloud services are becoming sophisticated attackers' preferred targets. Finding economies of scale works for an adversary. It almost never works for the defender. This is a lesson that EMC should have learned by now - the hard way.

Add to Cart View detail

Breach of Trust: 3 Major Problems With RSA's Public Statements

When a high profile attack occurs and becomes public knowledge, such as the one successfully mounted against EMC's RSA Security division, the company's preparation of its public statement(s) is a critical process. The goal is to start rebuilding customer and stock holder confidence in the company. If it's done right, it may work. If not, it can multiply the effect of the breach far beyond whatever harm the original attack caused. The reason why is because when damage control is done right, product replacement is a relatively easy fix. However when a company issues contradictory statements or when essential facts are missing or obfuscated, then customers may feel a breach of trust. And trust, once broken, can almost never be restored.
While I've recently been very critical of the RSA timeline, as soon as I read Art Coviello's second public statement (issued June 6, 2011), I decided to take a closer look at everything that the company has released on the attack and it isn't pretty, especially as it relates to three essential questions:

1. What was taken
2. How much was taken
3. Who was affected

RSA has produced 5 official statements:

• Art Coviello's Open Letter to RSA Customers March 17, 2011 [1]
• Uri Rivner's Anatomy of an Attack blog post April 1, 2011 [2]
• RSA's Required Actions For SecurID Installations (SecurCare Online Note #1) [3]
• RSA SecurCare Online Note #2 [4]
• Art Coviello's Open Letter to RSA SecurID Customers June 6, 2011 [5]

What was taken?
Art Coviello wrote in his June 6 statement that "certain information related to the SecurID product had been extracted." Now compare that wording to what the SecurCare Online Note #2 says: "Our investigation to date has revealed that the attack resulted in certain information being extracted from RSA systems. Some of that information is related to RSA SecurID authentication products", which is a direct quote from Coviello's March 17th letter.

Analysis: Both Coviellos's letter #1 and SecurCare's note #2 specified two product sets from which data was extracted. The primary was termed "RSA systems" as in "certain information being extracted from RSA systems". The second was a subset of RSA systems - RSA SecurID authentication products. Coviello's letter #2 contradicts that statement by removing the primary product set altogether but without any clarification as to why. So which statement of Art Coviello's is true. The one from March 17th or the one from June 6th?

How much was taken?
How RSA defines "certain information" sheds light on how much of RSA's IP was taken. According to Coviello's letter and the SecurCare Online Note, "certain information" is defined as everything except what is in the customer's care. Here's the exact language in the Online note:
"To the best of our knowledge, whoever attacked RSA has certain information related to the RSA SecurID solution, but not enough to complete a successful attack without obtaining additional information that is only held by our customers." FAQ question #7 is particularly telling. It asks "Have my SecurID token records been taken?". Instead of providing a direct answer, the FAQ repeats that additional customer data not held by RSA is required to mount a successful attack.

RSA has defined how much data was extracted from its systems with the phrase "certain information not held by the customer" or, to put it in plain English, RSA's attackers took everything.

Who was affected?
None of the initial reports mentioned what Coviello referred to in letter #2 as "our view of the motive of this attacker" meaning the defense industry, and he only confirmed Lockheed Martin after Lockheed Martin had made the news public. More importantly, no mention was made of the attack on L-3 Communications even though an internal company email reportedly said it involved duplicate SecurID tokens.

Summary
The presence of contradictory information in Coviello's two statements and between his statements and the SecurCare Online Notes paint a picture of a company that's trying unsuccessfully to hide the scale and scope of this breach from the public, from its shareholders, and from its own customers. Art Coviello confirmed in the most obscure language possible that everything it has pertaining to SecurID was breached; that the only parts not breached were the parts owned by the customer.

Furthermore, if the statement in both RSA's SecurCare Online Notes were accurate, other RSA security products were compromised as well although the extent is unknown. To give you an idea of the possible further scope, here is a product list from the RSA website:

The RSA Product Finder

The only other unanswered question at this point is how Coviello's mismanagement of this crisis will impact EMC's sales and stock price. His keynote at February's RSA Conference was "Proof, Not Promises". That's something that RSA's customers including the U.S. government need to be demanding right about now.

Related Posts:


18 Days From 0day to 8K - An RSA Attack Timeline Analysis

An Open Source Analysis Of The Lockheed Martin Network Breach

EMC and Google Lawyers Walked Into A Bar.

Add to Cart View detail

18 Days From 0day to 8K - An RSA Attack Timeline Analysis

There was a lot that bothered me about the official statements surrounding the RSA SecurID breach. For example, they claimed to be victims of an Advanced Persistant Threat that was neither advanced nor persistant.  Then there was news of a related attack against L3 Communications prior to 6 April, less than three weeks after the Coviello letter was made public on 17 Mar 2011. I decided to construct a timeline out of the available facts and see if it supports or conflicts with RSA President Art Coviello [3] and Mr. Uri Rivner's [10] versions of what happened. Either the attack was short-lived, as Mr. Rivner claims, or it was of much longer duration which would put RSA Security division products at greater risk for compromise along with EMC's customers who use them, such as Lockheed Martin [6], L3 Communications [5], and possibly Northrup Grumman [11], among others.


According to Rivner's "Anatomy of an Attack" blog post of 1 April 2011 [10], the attacker used a zero day Flash exploit (CVE-2011-0609) [4]. Neither Rivner nor Coviello provided information about the duration of the attack, however it was easy to calculate.  The 0day that was used in the attack was created on 28 Feb 2011 by a Chinese hacker whose Twitter alias is yuange1975 [2].

yuange1975's Twitter page

If you do the math, 28 Feb to 17 March is 18 days. Think about that for a minute. 18 days from 0day to EMC's 8-K filing with the SEC.  If your head isn't already spinning in disbelief, here's a list of what Uri Rivner claims happened interspersed with other key dates.

1. At some point on or after 28 Feb 2011, an Attacker acquired yuange1975's Flash 0day, embedded it into an .xls spreadsheet entitled "2011 Recruitment Plan" along with a Poison Ivy RAT payload, and wrote a spear phishing letter to deliver it (est. #days = ?) [2], [4]
2. Attacker sent two different phishing emails over a 2 day period before one employee opened the attachment. (est. #days = 2) [10]
3. Attacker gained access to RSA network, learned who the privileged users were who had access to sensitive material and stole their credentials, navigated their way across protected levels of access with multiple authentications, intrusion detection systems, and other layers of defense in depth (est. #/days = ?) [10]
4. Attacker "established access to staging servers at key aggregation points; then went into the servers of interest, removed data (some related to SecurID) and moved it to internal staging servers where the data was aggregated, compressed and encrypted for extraction" (est. #/days = ?) [10], [3]
5. Attacker "used FTP to transfer password protected RAR files from the RSA file server to an outside staging server at an external, compromised machine at a hosting provider. The files were subsequently pulled by the attacker and removed from the external compromised host to remove any traces of the attack." (est. #/days = ?) [10]
6. EMC/RSA Security discovered the attack (date unknown), conducted a forensics investigation, and reported their findings to EMC executives
7. RSA notified SecurID customers individually under NDA (est. #/days to contact 25,000 customers = ?) [8], [9]
8. EMC lawyers edited and/or approved Art Coviello's statement which served as both its customer letter and SEC 8-K notification, which was finally published on 17 Mar 2011. (est. #/days = ?) [3], [7]

I invite readers to make their own estimates on the number of days that it might take to accomplish any of these 8 steps; particularly those involving forensic investigators and attorneys. The 18 day figure is impossibly brief, which means that the likely first stage of the Prime defense contractor attacks in April and May were deliberately down-played to save EMC's stock price and reputation. EMC's customers, particularly its Dept of Defense customers, should be demanding answers from Art Coviello and the EMC Board of Directors right about now.

UPDATE: An excellent analysis of the Flash 0day that was used can be read at Villys777's security blog [12]. 

References:

[2] @yuange1975 Twitter post; 28 Feb 2011: https://twitter.com/#!/yuange1975/status/42357318628802560

[3] RSA.com website, Art Coviello's "Open Letter To RSA Customers" (17 Mar 2011) http://www.rsa.com/node.aspx?id=3872

[4] Adobe Security Advisory 14 Mar 2011 "Security Advisory for Adobe Flash Player, Adobe Reader and Acrobat": http://www.adobe.com/support/security/advisories/apsa11-01.html

[5] Wired.com ThreatLevel blog by Kevin Poulsen "Second Defense Contractor L-3 ‘Actively Targeted’ With RSA SecurID Hacks": http://www.wired.com/threatlevel/2011/05/l-3/

[6] NYTimes 29 May 2011: "Lockheed Strengthens Network Security After Hacker Attack"

[7] Securities and Exchange Commission website "Form 8-K filing from EMC Corporation": http://www.sec.gov/Archives/edgar/data/790070/000119312511070159/d8k.htm

[8] Confidential source provided this information to the author via email correspondence

[9] 25,000 RSA SecurID customers source: 18 Mar 2011 Intrepidus Group blog post: http://intrepidusgroup.com/insight/2011/03/risk-posed-by-securid-hack/

[10] The RSA Blog 1 Apr 2011 "Anatomy of an Attack" by Uri Rivner: http://blogs.rsa.com/rivner/anatomy-of-an-attack/

[11] Fox News.com, 1 June 2011 "EXCLUSIVE: Northrop Grumman May Have Been Hit by Cyberattack, Source Says":
http://www.foxnews.com/scitech/2011/05/31/northrop-grumman-hit-cyber-attack-source-says/#ixzz1O6jjeiyE
[12] Blog IX Security Research: http://bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html

Add to Cart View detail