Perimeter
1/14/2014
07:45 PM
Connect Directly
RSS
E-Mail
50%
50%

RSA Conference Controversy Swirls, Spurs Debate Over Boycotts

Talk of boycotts has circled the RSA conference, but what will the outcome of it all be?

About a month from now, thousands of people are expected to descend on the Moscone Center in San Francisco for the annual RSA Conference.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Missing from this crowd, however, will be a relatively small number of security researchers and others who have publicly declared their intention to opt out due to controversy surrounding the security provider that shares the conference's name. Ever since a Reuters report last year alleged that RSA -- now a part of EMC -- struck a deal with the National Security Agency to use a vulnerable encryption algorithm by default in one of its products, suspicion in the security community has led roughly a dozen of the more than 560 scheduled speakers to declare they are backing out of the event, and caused others to call for keynote speaker Stephen Colbert to do the same. Some have even spoken of a wider boycott of RSA products.

For others, though, the outrage being directed at the conference may be a misplaced overreaction.

"There is certainly some suspicion of potential impropriety, but we are very far from knowing what really happened," says Rich Mogull, CEO of security advisory firm Securosis. "Even [reporter Joseph Menn's] article indicated RSA may have been duped, not sold out."

But the possibility of that type of collaboration -- particularly involving a security vendor -- was more than enough to give those who have pulled out pause.

"When I looked at the allegations, I thought, if these are true, it's just wrong," says Josh Thomas, partner and "chief breaker" at Atredis Partners. "At least in the way my brain works, I look at RSA as they have one job. They advertise that they do one thing, and that is crypto. To me, crypto means security, and it also means trust."

Thomas is among the speakers who pulled out of the conference, as is Jeff Carr, CEO of Taia Global. According to Carr, people should ask themselves two questions: Do you believe RSA Security collaborated to weaken BSAFE, and do you think a boycott of RSA security products is warranted?

"If your answer is yes, then support a boycott of RSA Security," he says.

An EMC spokesperson declined to comment on the controversy surrounding the conference or the prospect of customer ire impacting RSA's place in the market.

However, Gartner analyst Jay Heiser says that concern about the integrity of U.S. technologies could spur on non-U.S. companies.

"If more allegations emerge about NSA attempts to manipulate the shape of security technology, it is only going to further encourage the growth of European, Asian, and South American security products," he says.

"It's more than a bit ironic that after all of the controversy over whether or not Huawei was shipping Chinese-government backdoors in their hardware that these substantive allegations appear about the U.S. tech industry being influenced by the U.S. federal government," he adds. "I don't see any way to spin this into a positive marketing message for U.S. technology providers."

David Monahan, senior analyst with Enterprise Management Associates, says the controversy has already started opening the door for other non-American companies.

"Look at Huawei's advertising campaign around trusting them, despite the fact they stole Cisco's technology. Those companies are capitalizing on the event using FUD [fear, uncertainty, and doubt] to magnify the opportunity. Either way, this is a lose-lose for RSA," he says, adding that the perception of RSA's skill and integrity has taken a hit. "The key is how quickly the people forget and let bygones be bygones. In this case, I think it will be a while, and they will suffer both in reputation and revenue."

"There is some related historical context on this," he adds. "In the mid-'70s, IBM's implementation of the Lucifer encryption algorithm, subsequently named DES [Data Encryption Standard] after acceptance by NIST, was modified by NSA for security reasons prior to acceptance. That event started years of public scrutiny that impacted initial public acceptance and conspiracy theories. Ultimately, DES was exonerated and life went on."

Security expert Rafal Los describes vendor and government collaboration on standards as an issue with multiple sides. Those that are paranoid of government involvement will actively work against it; the pragmatic will continue to work toward industry standards while thinking twice about taking government input for granted.

"The rest will carry on as status quo, either trusting or not knowing any better," he argues. "Standards are a funny thing -- there's this long-running joke about there being too many competing standards, so industry professionals got together to fix the problem and created another one. Jokes aside, I think overall standards will get a [closer] look going forward, for the foreseeable future. I'm just not certain what the lasting effect of something like this is."

Los says he still plans to attend the conference and is going forward with his talk about secure development metrics.

"I can honestly say I don't believe I've seen enough to conclusively prove to me that RSA did anything wrong," he adds. "However, the allegations are toxic. If this turns out to be true, it would be deeply troubling for the industry and the trust that we have in RSA as a trust provider."

Hugh Thompson, program chair for the conference, says the event is meant to be a neutral place for security experts to discuss what is happening in the industry.

"The conference has always been an independent, open forum for people to come together and talk about security," he says.

"I think when you look at it as a security professional, there's never been a more important time to get together with your peers and see what they're doing, see what they're planning, and see how they're reacting to these changes that are happening in the community because they are happening pretty [quickly]."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-4620
Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

CVE-2014-4623
Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

CVE-2014-4624
Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

CVE-2014-6151
Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.