Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/14/2014
07:45 PM
50%
50%

RSA Conference Controversy Swirls, Spurs Debate Over Boycotts

Talk of boycotts has circled the RSA conference, but what will the outcome of it all be?

About a month from now, thousands of people are expected to descend on the Moscone Center in San Francisco for the annual RSA Conference.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Missing from this crowd, however, will be a relatively small number of security researchers and others who have publicly declared their intention to opt out due to controversy surrounding the security provider that shares the conference's name. Ever since a Reuters report last year alleged that RSA -- now a part of EMC -- struck a deal with the National Security Agency to use a vulnerable encryption algorithm by default in one of its products, suspicion in the security community has led roughly a dozen of the more than 560 scheduled speakers to declare they are backing out of the event, and caused others to call for keynote speaker Stephen Colbert to do the same. Some have even spoken of a wider boycott of RSA products.

For others, though, the outrage being directed at the conference may be a misplaced overreaction.

"There is certainly some suspicion of potential impropriety, but we are very far from knowing what really happened," says Rich Mogull, CEO of security advisory firm Securosis. "Even [reporter Joseph Menn's] article indicated RSA may have been duped, not sold out."

But the possibility of that type of collaboration -- particularly involving a security vendor -- was more than enough to give those who have pulled out pause.

"When I looked at the allegations, I thought, if these are true, it's just wrong," says Josh Thomas, partner and "chief breaker" at Atredis Partners. "At least in the way my brain works, I look at RSA as they have one job. They advertise that they do one thing, and that is crypto. To me, crypto means security, and it also means trust."

Thomas is among the speakers who pulled out of the conference, as is Jeff Carr, CEO of Taia Global. According to Carr, people should ask themselves two questions: Do you believe RSA Security collaborated to weaken BSAFE, and do you think a boycott of RSA security products is warranted?

"If your answer is yes, then support a boycott of RSA Security," he says.

An EMC spokesperson declined to comment on the controversy surrounding the conference or the prospect of customer ire impacting RSA's place in the market.

However, Gartner analyst Jay Heiser says that concern about the integrity of U.S. technologies could spur on non-U.S. companies.

"If more allegations emerge about NSA attempts to manipulate the shape of security technology, it is only going to further encourage the growth of European, Asian, and South American security products," he says.

"It's more than a bit ironic that after all of the controversy over whether or not Huawei was shipping Chinese-government backdoors in their hardware that these substantive allegations appear about the U.S. tech industry being influenced by the U.S. federal government," he adds. "I don't see any way to spin this into a positive marketing message for U.S. technology providers."

David Monahan, senior analyst with Enterprise Management Associates, says the controversy has already started opening the door for other non-American companies.

"Look at Huawei's advertising campaign around trusting them, despite the fact they stole Cisco's technology. Those companies are capitalizing on the event using FUD [fear, uncertainty, and doubt] to magnify the opportunity. Either way, this is a lose-lose for RSA," he says, adding that the perception of RSA's skill and integrity has taken a hit. "The key is how quickly the people forget and let bygones be bygones. In this case, I think it will be a while, and they will suffer both in reputation and revenue."

"There is some related historical context on this," he adds. "In the mid-'70s, IBM's implementation of the Lucifer encryption algorithm, subsequently named DES [Data Encryption Standard] after acceptance by NIST, was modified by NSA for security reasons prior to acceptance. That event started years of public scrutiny that impacted initial public acceptance and conspiracy theories. Ultimately, DES was exonerated and life went on."

Security expert Rafal Los describes vendor and government collaboration on standards as an issue with multiple sides. Those that are paranoid of government involvement will actively work against it; the pragmatic will continue to work toward industry standards while thinking twice about taking government input for granted.

"The rest will carry on as status quo, either trusting or not knowing any better," he argues. "Standards are a funny thing -- there's this long-running joke about there being too many competing standards, so industry professionals got together to fix the problem and created another one. Jokes aside, I think overall standards will get a [closer] look going forward, for the foreseeable future. I'm just not certain what the lasting effect of something like this is."

Los says he still plans to attend the conference and is going forward with his talk about secure development metrics.

"I can honestly say I don't believe I've seen enough to conclusively prove to me that RSA did anything wrong," he adds. "However, the allegations are toxic. If this turns out to be true, it would be deeply troubling for the industry and the trust that we have in RSA as a trust provider."

Hugh Thompson, program chair for the conference, says the event is meant to be a neutral place for security experts to discuss what is happening in the industry.

"The conference has always been an independent, open forum for people to come together and talk about security," he says.

"I think when you look at it as a security professional, there's never been a more important time to get together with your peers and see what they're doing, see what they're planning, and see how they're reacting to these changes that are happening in the community because they are happening pretty [quickly]."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30480
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
CVE-2021-21194
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21195
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21196
PUBLISHED: 2021-04-09
Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21197
PUBLISHED: 2021-04-09
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.