Perimeter
1/14/2014
07:45 PM
Connect Directly
RSS
E-Mail
50%
50%

RSA Conference Controversy Swirls, Spurs Debate Over Boycotts

Talk of boycotts has circled the RSA conference, but what will the outcome of it all be?

About a month from now, thousands of people are expected to descend on the Moscone Center in San Francisco for the annual RSA Conference.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Missing from this crowd, however, will be a relatively small number of security researchers and others who have publicly declared their intention to opt out due to controversy surrounding the security provider that shares the conference's name. Ever since a Reuters report last year alleged that RSA -- now a part of EMC -- struck a deal with the National Security Agency to use a vulnerable encryption algorithm by default in one of its products, suspicion in the security community has led roughly a dozen of the more than 560 scheduled speakers to declare they are backing out of the event, and caused others to call for keynote speaker Stephen Colbert to do the same. Some have even spoken of a wider boycott of RSA products.

For others, though, the outrage being directed at the conference may be a misplaced overreaction.

"There is certainly some suspicion of potential impropriety, but we are very far from knowing what really happened," says Rich Mogull, CEO of security advisory firm Securosis. "Even [reporter Joseph Menn's] article indicated RSA may have been duped, not sold out."

But the possibility of that type of collaboration -- particularly involving a security vendor -- was more than enough to give those who have pulled out pause.

"When I looked at the allegations, I thought, if these are true, it's just wrong," says Josh Thomas, partner and "chief breaker" at Atredis Partners. "At least in the way my brain works, I look at RSA as they have one job. They advertise that they do one thing, and that is crypto. To me, crypto means security, and it also means trust."

Thomas is among the speakers who pulled out of the conference, as is Jeff Carr, CEO of Taia Global. According to Carr, people should ask themselves two questions: Do you believe RSA Security collaborated to weaken BSAFE, and do you think a boycott of RSA security products is warranted?

"If your answer is yes, then support a boycott of RSA Security," he says.

An EMC spokesperson declined to comment on the controversy surrounding the conference or the prospect of customer ire impacting RSA's place in the market.

However, Gartner analyst Jay Heiser says that concern about the integrity of U.S. technologies could spur on non-U.S. companies.

"If more allegations emerge about NSA attempts to manipulate the shape of security technology, it is only going to further encourage the growth of European, Asian, and South American security products," he says.

"It's more than a bit ironic that after all of the controversy over whether or not Huawei was shipping Chinese-government backdoors in their hardware that these substantive allegations appear about the U.S. tech industry being influenced by the U.S. federal government," he adds. "I don't see any way to spin this into a positive marketing message for U.S. technology providers."

David Monahan, senior analyst with Enterprise Management Associates, says the controversy has already started opening the door for other non-American companies.

"Look at Huawei's advertising campaign around trusting them, despite the fact they stole Cisco's technology. Those companies are capitalizing on the event using FUD [fear, uncertainty, and doubt] to magnify the opportunity. Either way, this is a lose-lose for RSA," he says, adding that the perception of RSA's skill and integrity has taken a hit. "The key is how quickly the people forget and let bygones be bygones. In this case, I think it will be a while, and they will suffer both in reputation and revenue."

"There is some related historical context on this," he adds. "In the mid-'70s, IBM's implementation of the Lucifer encryption algorithm, subsequently named DES [Data Encryption Standard] after acceptance by NIST, was modified by NSA for security reasons prior to acceptance. That event started years of public scrutiny that impacted initial public acceptance and conspiracy theories. Ultimately, DES was exonerated and life went on."

Security expert Rafal Los describes vendor and government collaboration on standards as an issue with multiple sides. Those that are paranoid of government involvement will actively work against it; the pragmatic will continue to work toward industry standards while thinking twice about taking government input for granted.

"The rest will carry on as status quo, either trusting or not knowing any better," he argues. "Standards are a funny thing -- there's this long-running joke about there being too many competing standards, so industry professionals got together to fix the problem and created another one. Jokes aside, I think overall standards will get a [closer] look going forward, for the foreseeable future. I'm just not certain what the lasting effect of something like this is."

Los says he still plans to attend the conference and is going forward with his talk about secure development metrics.

"I can honestly say I don't believe I've seen enough to conclusively prove to me that RSA did anything wrong," he adds. "However, the allegations are toxic. If this turns out to be true, it would be deeply troubling for the industry and the trust that we have in RSA as a trust provider."

Hugh Thompson, program chair for the conference, says the event is meant to be a neutral place for security experts to discuss what is happening in the industry.

"The conference has always been an independent, open forum for people to come together and talk about security," he says.

"I think when you look at it as a security professional, there's never been a more important time to get together with your peers and see what they're doing, see what they're planning, and see how they're reacting to these changes that are happening in the community because they are happening pretty [quickly]."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4262
Published: 2014-07-28
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-...

CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2013-7393
Published: 2014-07-28
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions...

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.