Yesterday RSA informed about a security breach which they assume to be an "advanced persistent threat", e.g. a long-running attack. In that case it was apparently against the seeds, e.g. the base material for keys which are used to generate OTPs. With other words: The first and (until now) stronger part of the two-factor authentication used with RSA SecurID cards isn't secure anymore. In fact it shows that every approach which relies on a central database of such seeds has its inherent security weaknesses.
The importance of this breach becomes obvious when looking at the SEC 8-K filing - it is important enough that it required an official note to the stock markets.
The bad thing in that case is that its not a single RSA SecurID card which is compromised, which always would be the case with stolen or lost cards - it are potentially all RSA SecurID cards, because currently it is neither known which seeds are compromised nor by whom. RSA has (under the link above) provided hints for its customers on what to do now. They claim that there is no immediate impact for existing customers. But when looking at the actions recommended by RSA it becomes obvious that customers can't do much - besides fundamental changes, e.g. RSA SecurID implementations based on new seeds (with all the consequences of such a change) or changes to other/additional authentication mechanisms.
Our recommendation for customers which have RSA SecurID cards implemented is to first carefully analyze the situation and their specific risks - e.g. which type of information is at risk if the RSA SecurID based authentication is not only at risk (like now) but an attack actually takes place? Based on that it is about to decide whether immediate actions have to take place (besides informing the users to be even more careful regarding phishing mails and so on, because the authentication strength no relies mainly on the PIN). These actions might range from increased threat analysis and forensics to adding other authentication technologies.
Beyond that, customers should take the opportunity and rethink their authentication strategies in general. How could they implement a flexible, versatile approach for all types of users and different security requirements of interactions and transactions? Versatility definitely helps - having a versatile approach for authentication in place allows to add additional factors and means or replace some factors quickly - which isn't the case when only one specific mechanism (like RSA SecurID) is used.
What does it mean for RSA? In fact, the "trusted name in security" definitely will suffer - trust takes a long time to build and a very short time to loose. However, RSA isn't that heavily depending on the success of RSA SecurID anymore. The company has broadend its portfolio. RSA SecurID is sort of a "cash cow", but there are other approaches including versatile authentication solutions available. And, honestly: If you use RSA SecurID tokens as one element within a versatile authentication strategy, there is a value in that approach - especially given that RSA will do everything to ensure that such a breach never happens again (but there is always some risk of things happening which are unlikely). But it is only one approach of many, and the best thing customers can do is to become more flexible, more versatile.
Interestingly this fits well to research we are currently working on. One part of this will be a research note comparing the strength and usability of different authentication mechanisms, the other has a working title of "why hardware-based OTP is dead" - the latter not mainly because of the potential security risks, but because of the limited usability and the cost of logistics. Thus, have a look at our upcoming research. The topic will as well be discussed at the EIC 2011 (European Identity Conference), May 10th to 13th. Munich.