I just read a great article on DarkReading.com called “A Tale Of Two Hacks” by the experienced, seasoned cyber security thought leader and mentor Tom Parker of Securicon. Tom is a good balance to those in the press who form a bit of an echo chamber. He also helps cancel out some of the pseudo experts in the field (the guys who claim to be experts but really have nothing to show for it).
Please read the entire article, but a snippet of important context is below:
As someone who strongly believes that cyber-attribution is possible (today), I’m extremely hesitant to apply a buzzword like APT (and therefore implicating a specific state actor) without some sort of sound evidence — and you should be, too. The media has been instrumental in its coverage of many such incidents over the past two or three years, and we can safely assume that it is no longer (if it ever was) a secret that techniques, such as leveraging client-side vulnerabilities and social engineering, are far more effective for penetrating an Internet perimeter than the infrastructure attacks that have been preferred in years gone by.
While exact details regarding what data was stolen from RSA earlier this year aren’t known, RSA has released a number of blog posts and customer advisories that allow us to get a pretty good idea of the possible impact to customers based on what was stolen. Notably, instructions on monitoring RSA audit logs for signs of compromise attempts were circulated, which specifically advise for the identification of bad authentication PINs (the something you know) with a good token code (the something you have). Lots of these in a log file is a sure-fire sign that someone is trying to brute-force his way in and has possession of both a good username and stolen (or cloned) token. This supports earlier speculation that it was the seed values that were stolen.
That was a good article, one of a string from Tom providing fantastic context on the incredibly serious issues of enterprise cyber security. Another good one was “A Not-So Targeted Targeted Attack” where he detailed another threat vector. The bad guys never quite, they will always be there.
Tom is a good writer/thinker and security expert. You can find him on Twitter at: http://twitter.com/tomwparker
