[ad_1]
That afternoon, Coviello posted an open letter to RSA clients on the company’s website. “Recently, our security systems were identifying a very sophisticated cyberattack,” he said in the letter. “At this time we are confident that the information extracted will not allow a successful direct attack on our RSA SecurID customers, this information may reduce the effectiveness of the current two-factor authentication implementation as part of a broader attack,” the letter continued, lessening the crisis.
In Bedford, Castignola was given the conference room and the company the authority to request enough volunteers. A rotating team of nearly 90 employees began the day-and-night process of arranging individual phone calls with all customers. They worked from a script, through some measures to protect customers, such as adding or extending a PIN number in their SecurID logins to make it harder for hackers to repeat. Castignola recalls walking around the halls of the building at 10 p.m., and listening to the phone calls behind loudspeakers behind all the closed doors. In many cases customers were shouting. Castignola, Curry, and Coviello made hundreds of calls; Curry jokingly began by saying that his title was “the main culprit for forgiveness.”
At the same time, paranoia began to take hold in the company. On the first night after the announcement, Castignola recalls that he walked next to a wired closet and saw a senseless number of people coming out of it, much more than he could ever fit. “Who are these people?” he asked another local executive. “That’s the government,” replied the vague executive.
In fact, by the time Castignola landed in Massachusetts, he had called on the NSA and the FBI to support the company’s investigation, as did defense contractor Northrop Grumman and Mandiant’s incident response companies. (Coincidentally, Mandiant employees were there before the offense occurred, installing safety sensor equipment on the RSA network.)
RSA staff began to take drastic measures. Fearing that the phone system might be in jeopardy, the company switched operators, moving from AT&T to Verizon phones. Managers, who didn’t even trust new phones, held meetings in person and shared paper copies of documents. The FBI, fearing an accomplice at the RSA level, apparently began to check the background because of the level of knowledge the intruders had about company systems. “I made sure they researched all the members of the team – I don’t care who they were, what their reputation was – because you have to be sure,” Duan says.
The windows of some directors’ offices and conference rooms were covered in layers of butcher’s paper to prevent the surveillance of the laser microphone — a seemingly long-listening technique that captures conversations from the vibrations of the window panes — imagined in the surrounding forest. The building was moved in search of defects. Multiple executives pointed out that they had found hidden listening devices, although some were so old that the batteries were exhausted. It was never clarified that these errors were related to the offense.
Meanwhile, the RSA security team and those brought in to help the investigators were “as Curry said they were” throwing the house into the sticks. ” We walked around physically, and if there was a box in it, it was cleaned up, “says Curry.
[ad_2]
Source link
