Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/14/2014
07:45 PM
50%
50%

RSA Conference Controversy Swirls, Spurs Debate Over Boycotts

Talk of boycotts has circled the RSA conference, but what will the outcome of it all be?

About a month from now, thousands of people are expected to descend on the Moscone Center in San Francisco for the annual RSA Conference.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Missing from this crowd, however, will be a relatively small number of security researchers and others who have publicly declared their intention to opt out due to controversy surrounding the security provider that shares the conference's name. Ever since a Reuters report last year alleged that RSA -- now a part of EMC -- struck a deal with the National Security Agency to use a vulnerable encryption algorithm by default in one of its products, suspicion in the security community has led roughly a dozen of the more than 560 scheduled speakers to declare they are backing out of the event, and caused others to call for keynote speaker Stephen Colbert to do the same. Some have even spoken of a wider boycott of RSA products.

For others, though, the outrage being directed at the conference may be a misplaced overreaction.

"There is certainly some suspicion of potential impropriety, but we are very far from knowing what really happened," says Rich Mogull, CEO of security advisory firm Securosis. "Even [reporter Joseph Menn's] article indicated RSA may have been duped, not sold out."

But the possibility of that type of collaboration -- particularly involving a security vendor -- was more than enough to give those who have pulled out pause.

"When I looked at the allegations, I thought, if these are true, it's just wrong," says Josh Thomas, partner and "chief breaker" at Atredis Partners. "At least in the way my brain works, I look at RSA as they have one job. They advertise that they do one thing, and that is crypto. To me, crypto means security, and it also means trust."

Thomas is among the speakers who pulled out of the conference, as is Jeff Carr, CEO of Taia Global. According to Carr, people should ask themselves two questions: Do you believe RSA Security collaborated to weaken BSAFE, and do you think a boycott of RSA security products is warranted?

"If your answer is yes, then support a boycott of RSA Security," he says.

An EMC spokesperson declined to comment on the controversy surrounding the conference or the prospect of customer ire impacting RSA's place in the market.

However, Gartner analyst Jay Heiser says that concern about the integrity of U.S. technologies could spur on non-U.S. companies.

"If more allegations emerge about NSA attempts to manipulate the shape of security technology, it is only going to further encourage the growth of European, Asian, and South American security products," he says.

"It's more than a bit ironic that after all of the controversy over whether or not Huawei was shipping Chinese-government backdoors in their hardware that these substantive allegations appear about the U.S. tech industry being influenced by the U.S. federal government," he adds. "I don't see any way to spin this into a positive marketing message for U.S. technology providers."

David Monahan, senior analyst with Enterprise Management Associates, says the controversy has already started opening the door for other non-American companies.

"Look at Huawei's advertising campaign around trusting them, despite the fact they stole Cisco's technology. Those companies are capitalizing on the event using FUD [fear, uncertainty, and doubt] to magnify the opportunity. Either way, this is a lose-lose for RSA," he says, adding that the perception of RSA's skill and integrity has taken a hit. "The key is how quickly the people forget and let bygones be bygones. In this case, I think it will be a while, and they will suffer both in reputation and revenue."

"There is some related historical context on this," he adds. "In the mid-'70s, IBM's implementation of the Lucifer encryption algorithm, subsequently named DES [Data Encryption Standard] after acceptance by NIST, was modified by NSA for security reasons prior to acceptance. That event started years of public scrutiny that impacted initial public acceptance and conspiracy theories. Ultimately, DES was exonerated and life went on."

Security expert Rafal Los describes vendor and government collaboration on standards as an issue with multiple sides. Those that are paranoid of government involvement will actively work against it; the pragmatic will continue to work toward industry standards while thinking twice about taking government input for granted.

"The rest will carry on as status quo, either trusting or not knowing any better," he argues. "Standards are a funny thing -- there's this long-running joke about there being too many competing standards, so industry professionals got together to fix the problem and created another one. Jokes aside, I think overall standards will get a [closer] look going forward, for the foreseeable future. I'm just not certain what the lasting effect of something like this is."

Los says he still plans to attend the conference and is going forward with his talk about secure development metrics.

"I can honestly say I don't believe I've seen enough to conclusively prove to me that RSA did anything wrong," he adds. "However, the allegations are toxic. If this turns out to be true, it would be deeply troubling for the industry and the trust that we have in RSA as a trust provider."

Hugh Thompson, program chair for the conference, says the event is meant to be a neutral place for security experts to discuss what is happening in the industry.

"The conference has always been an independent, open forum for people to come together and talk about security," he says.

"I think when you look at it as a security professional, there's never been a more important time to get together with your peers and see what they're doing, see what they're planning, and see how they're reacting to these changes that are happening in the community because they are happening pretty [quickly]."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3738
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
CVE-2019-3739
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVE-2019-3740
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
CVE-2019-3756
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.
CVE-2019-3758
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts.