SecurityPreview
Open in TheBrain

RSA token

RSA SecurID Overview

Created by RSA Data Security, RSA SecurID is an MFA technology designed to increase security for network resources and help organizations maintain compliance. It combines password or PIN authentication with hardware authentication in the form of a physical token.

Is RSA secure? Many feel so because RSA SecurID offers more than just MFA. It has a whole suite of IAM features, including user access and role management, centralized control, and user monitoring.

Are RSA and SecurID the Same?

What used to be two products are now married into one suite of solutions. Formerly, RSA—or RSA Authentication Manager—handled authentication requests and policy administration. SecurID used three components to protect network resources: tokens, agents, and a virtual or physical server. RSA SecurID now offers all of this protection under one roof.

How Does RSA SecurID Work?

RSA SecurID is technically two-factor authentication, but it uses three layers of security:

  1. Something known by the user: This is a PIN or password only known by the user. A user is first prompted for their PIN or password when they access network resources.
  2. Something held by the user: This is a physical token, badge, or one-time password (OTP). The token provides a code that is combined with the PIN or password. The RSA authentication agent intercepts these for validation.
  3. Something unique to the user: You can add an extra layer of security by using biometrics, facial recognition, or fingerprint readers.

RSA SecurID offers a broad range of MFA options, including biometrics (fingerprint and eye print), email codes, Fast IDentity Online (FIDO)-based authentication, hardware tokens, mobile push authentication, proximity-based authentication, risk-based authentication, SMS codes, soft tokens, and voice-activated authentication. As an IAM technology, RSA SecurID does more than just grant access; it also determines the level of access to data and applications granted to each user.

Common RSA SecurID Vulnerabilities

No technology is 100% secure, so often, layered security that combines multiple techniques is best. Although few, RSA SecurID has certain vulnerabilities, and knowing what they are can help your security team minimize risk.

  1. Stolen hardware tokens: If a perpetrator successfully steals a token, card, or badge, they will have access to one of the two steps for authentication.
  2. Stolen software tokens: Just like passwords and PINs, codes can be hacked. If a hacker accesses the code and the password or PIN, 2FA becomes useless as a security measure. An example was the attack on MeetMindful.com in 2021 that compromised Facebook authentication tokens. This is why many professionals recommend biometrics as a third security layer.
  3. Stolen credentials: Reusing stolen credentials makes up about 80% of all hacking incidents. An example is the massive compromise of eBay credentials in 2014. A big part of risk monitoring and mitigation is ensuring password security, and an important feature of RSA SecurID is password management.
  4. Man-in-the-middle (MITM) attacks: RSA SecurID cannot repel all MITM attacks, but it protects against password replay attacks. Password replay occurs when a malicious actor intercepts a session that they then resend or delay to get the recipient to do their bidding. Other types of MITM attacks—like Internet Protocol (IP) spoofing, Hypertext Transfer Protocol Secure (HTTPS) spoofing, Domain Name System (DNS) spoofing, and so forth—are not always repelled. If a malicious party intercepts communication between a user and the network, they can gather enough information to impersonate a user and gain authorized access. An example is the breach of Equifax in 2017.