RSA: Cyberattack could put customers at risk

"Details about the recent cyber attacks against security firm RSA suggest the assailants may have been taunting the industry giant and the United States while they were stealing secrets from a company whose technology is used to secure many banks and government agencies." :

http://krebsonsecurity.com/2011/03/domains-used-in-rsa-attack-taunted-u-s/

 

RSA's refusal to provide any information about this attack should make anyone who uses their products think twice about it in the future. Their customers apparently aren't important enough to let in on what actually happened and how much risk they face.

 

RSA/EMC: Anatomy of a compromise

 

So a low level employee opening a phishing e-mail leads to a multi-million dollar compromise? What idiots thought up their security policy? These non-critical machines should have *no* access whatsoever to critical infrastructure where trade-secrets are stored. These machines should have been air-gapped so that Jane Doe secretary's crappy XP machine doesn't have access to the keys to the kingdom. There's no excuse for it.

Come on RSA, just come clean: what did the attackers get? The deafening silence is making more and more people feel like SecureID is completely broken and utterly useless. I'm not a SecureID user, but I would be thoroughly ticked off about this if I were.