Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/14/2014
07:45 PM
50%
50%

RSA Conference Controversy Swirls, Spurs Debate Over Boycotts

Talk of boycotts has circled the RSA conference, but what will the outcome of it all be?

About a month from now, thousands of people are expected to descend on the Moscone Center in San Francisco for the annual RSA Conference.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Missing from this crowd, however, will be a relatively small number of security researchers and others who have publicly declared their intention to opt out due to controversy surrounding the security provider that shares the conference's name. Ever since a Reuters report last year alleged that RSA -- now a part of EMC -- struck a deal with the National Security Agency to use a vulnerable encryption algorithm by default in one of its products, suspicion in the security community has led roughly a dozen of the more than 560 scheduled speakers to declare they are backing out of the event, and caused others to call for keynote speaker Stephen Colbert to do the same. Some have even spoken of a wider boycott of RSA products.

For others, though, the outrage being directed at the conference may be a misplaced overreaction.

"There is certainly some suspicion of potential impropriety, but we are very far from knowing what really happened," says Rich Mogull, CEO of security advisory firm Securosis. "Even [reporter Joseph Menn's] article indicated RSA may have been duped, not sold out."

But the possibility of that type of collaboration -- particularly involving a security vendor -- was more than enough to give those who have pulled out pause.

"When I looked at the allegations, I thought, if these are true, it's just wrong," says Josh Thomas, partner and "chief breaker" at Atredis Partners. "At least in the way my brain works, I look at RSA as they have one job. They advertise that they do one thing, and that is crypto. To me, crypto means security, and it also means trust."

Thomas is among the speakers who pulled out of the conference, as is Jeff Carr, CEO of Taia Global. According to Carr, people should ask themselves two questions: Do you believe RSA Security collaborated to weaken BSAFE, and do you think a boycott of RSA security products is warranted?

"If your answer is yes, then support a boycott of RSA Security," he says.

An EMC spokesperson declined to comment on the controversy surrounding the conference or the prospect of customer ire impacting RSA's place in the market.

However, Gartner analyst Jay Heiser says that concern about the integrity of U.S. technologies could spur on non-U.S. companies.

"If more allegations emerge about NSA attempts to manipulate the shape of security technology, it is only going to further encourage the growth of European, Asian, and South American security products," he says.

"It's more than a bit ironic that after all of the controversy over whether or not Huawei was shipping Chinese-government backdoors in their hardware that these substantive allegations appear about the U.S. tech industry being influenced by the U.S. federal government," he adds. "I don't see any way to spin this into a positive marketing message for U.S. technology providers."

David Monahan, senior analyst with Enterprise Management Associates, says the controversy has already started opening the door for other non-American companies.

"Look at Huawei's advertising campaign around trusting them, despite the fact they stole Cisco's technology. Those companies are capitalizing on the event using FUD [fear, uncertainty, and doubt] to magnify the opportunity. Either way, this is a lose-lose for RSA," he says, adding that the perception of RSA's skill and integrity has taken a hit. "The key is how quickly the people forget and let bygones be bygones. In this case, I think it will be a while, and they will suffer both in reputation and revenue."

"There is some related historical context on this," he adds. "In the mid-'70s, IBM's implementation of the Lucifer encryption algorithm, subsequently named DES [Data Encryption Standard] after acceptance by NIST, was modified by NSA for security reasons prior to acceptance. That event started years of public scrutiny that impacted initial public acceptance and conspiracy theories. Ultimately, DES was exonerated and life went on."

Security expert Rafal Los describes vendor and government collaboration on standards as an issue with multiple sides. Those that are paranoid of government involvement will actively work against it; the pragmatic will continue to work toward industry standards while thinking twice about taking government input for granted.

"The rest will carry on as status quo, either trusting or not knowing any better," he argues. "Standards are a funny thing -- there's this long-running joke about there being too many competing standards, so industry professionals got together to fix the problem and created another one. Jokes aside, I think overall standards will get a [closer] look going forward, for the foreseeable future. I'm just not certain what the lasting effect of something like this is."

Los says he still plans to attend the conference and is going forward with his talk about secure development metrics.

"I can honestly say I don't believe I've seen enough to conclusively prove to me that RSA did anything wrong," he adds. "However, the allegations are toxic. If this turns out to be true, it would be deeply troubling for the industry and the trust that we have in RSA as a trust provider."

Hugh Thompson, program chair for the conference, says the event is meant to be a neutral place for security experts to discuss what is happening in the industry.

"The conference has always been an independent, open forum for people to come together and talk about security," he says.

"I think when you look at it as a security professional, there's never been a more important time to get together with your peers and see what they're doing, see what they're planning, and see how they're reacting to these changes that are happening in the community because they are happening pretty [quickly]."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...