RSA Security Chairman Art Coviello says customers still want to hear details about how the company so quickly detected the data breach that last year compromised its SecurID tokens.
He also says businesses have been slow to pick up on new security models, many touted by RSA, that would help reduce the impact of successful breaches.
Here is a partial transcript of a recent conversation Coviello had with Network World Senior Editor Tim Greene on those topics as well as cloud security, managing risk and the limitations of the press.
BREACH PROTECTION: Cyber insurance offers IT peace of mind -- or maybe not
What’s the fallout been from the data breach?
If there’s a silver lining to the cloud that was over us from April through over the summer it is the fact that we’ve been engaged with customers at a strategic level as never before, and they want to know in detail what happened to us, how we responded, what tools we used, what was effective and what was not.
What are those conversations like?
Again, a silver lining to us being attacked, I’ve heard it time and time again, “If it can happen to you then I guess it can happen to anybody,” or, “My CIO said, ‘Oh my god if it happened to them let’s redouble our efforts, let’s review everything we’re doing.’” It’s kind of gotten to even a CEO level. I was actually brought into a major money center bank in Europe at the CIO’s request to talk to the CEO of the bank and his whole management team about the threats and vulnerabilities that exist today. The reason he brought me in was they were doing an overhaul of their IT infrastructure which included the development of a private cloud. Even though it’s an internally controlled cloud he wanted the management group to understand the security ramifications of the infrastructure change that the bank was about to go through. I’m at a [similar] level with Fortune 10 oil and gas, manufacturing, pharmaceuticals. I’ve always had pretty good entree into financial services as that example illustrates, but I’m getting in at levels that are unprecedented in terms of the contacts and the people I’m talking to. It’s so ironic. I’ve never been in more demand as a speaker or in front of internal audiences. I would usually be at a chief security officer level but not a CIO level or even higher. I think we are turning from awareness of the problem to action. I’m just sad that we didn’t do it two or three years ago before a lot of these celebrated breaches took place.
TEST YOUR RECALL: The data breach quiz
By the way, it’s not going to get any easier. To me it shouldn’t be a shock that we have this level of breach, this level of theft and this level of attack. People are just basically taking advantage of the openings that have been created and yet we’ve reacted too slow to adapt these perimeter defenses to this new reality until now we’ve come full circle back to why you have to have a far more nimble intelligence-driven approach to security. It’s not a question of whether or if you’re going to be attacked or whether or if you’re going to get breached. There’s so much interdependence, there’s so much interactivity from one company to the other that you absolutely have to be able to spot these problems, be able to anticipate who’s going to attack you, what they’re going to go after, and again, be in a position where you’re reacting less after the fact and more responding real-time and minimizing the damage of what could be the inevitability of an attack.
You say you’ve been promoting a security model that calls for automating threat analysis and response for years. Why haven’t more people adopted it?
You would like to think that people would come to these conclusions and act on them more quickly but there’s such competition -- whether it’s budget, whether it’s business initiative, whether it’s overhauling their own infrastructure, whether it’s this crazy economy we’re working with -- it never goes as fast as you think it should or could.
I’m in a position now where as much as I’ve preached for three or four years that we have an opportunity to get it right this time as we virtualize our environments and we go to cloud [by building] security in, it just isn’t happening and we’re making the same mistakes all over again. I don’t fault the infrastructure vendors – it’s just unfortunately the way the world works sometimes that people want to get the benefits of a new technology wave and don’t always think through all the security ramifications.
Why do you think CEOs – people outside of IT – want to speak to you now, and are they driving better responses from the IT people?
What they are aware of is how much they themselves and how much their businesses have changed in having more reliance on the Internet and on Web applications. They’re not oblivious to the impact of technology on their operations. They’re clearly looking to not only take more advantage of technology but also to wring cost out of these ridiculously outdated IT infrastructures where people are spending 60%-70% just to maintain old client-server, old mainframe, old ways of doing things and not getting mileage out of their IT infrastructure dollar.
They’re also seeing younger people within the organizations and people within divisions not wanting to wait for IT to take advantage of technology and the number of SaaS-based applications and opportunities to communicate and work with your customers and do innovative things. Increasingly, the more mature companies get that as never before, and then they see that in the context of all these attacks. I do think there is better and better awareness, so they themselves are less reactive and they’re more proactive in wanting to know not only how technology can benefit their business but also the ramifications of using that technology in terms of the operational risk to business.
You say awareness of the breach problems is high, yet adoption of new defenses remains slow. Do you think that awareness has finally galvanized these CEOs you talk to?
I don’t think there’s any question of that, and as I’ve said, I’ve seen it time and time again in discussions I’ve had with people and the silver lining to our breaches is people literally did say if it could happen to those guys we’ve got to be more aware of it, which is really giving us an entree to having these strategic discussions as never before. When we go into detail about the attack I think people are actually impressed with the speed with which we were able to see the attack in progress. [W]e were still unable to keep [hackers] from getting away with at least something. But we were able to minimize the damage, and more importantly, get to our customers timely enough so they could protect themselves to mitigate risk associated with the damage. We’ve gotten a tremendous amount of credit with our customer base that we certainly haven’t gotten in the press. Customers do understand that we were able to handle that attack and mitigate the damage better than anyone and that’s put us clearly in demand to talk to a lot of customers.
Does being a victim give RSA more credibility in a way with customers?
Yeah. Believe me we are not the only ones. We are one of the few that’s been forthcoming but for us to have handled it any other way would have been kind of a dereliction of duty. We actually got a lot of credibility for going public, helping customers mitigate the loss, helping them to understand in what was absolutely a firestorm of coverage. I don’t blame the press. The press has to cover a story like this but you know yourself that the accuracy of a lot of the press reports is not always that good. So when you got to talk to customers more one-on-one in a way that you just can’t get across in a short article in the press on a real-time basis people have an entirely different view.