Data Security updates in RSA Web Threat Detection
Originally Published: 2016-10-07
Last Modified: 2023-10-06
Article Number
Applies To
RSA Product/Service Type: Mitigator
RSA Version/Condition: 4.6, 5.x, 6.0
Issue
Example of a customer requirement --
Based on the security document provided by RSA**, it appears Silvertail/WTD uses RSA for encryption, which is an acceptable algorithm, however, RC4 is no longer accepted based on the current Payment Card Industry (PCI) standards.
An approved encryption algorithm that RSA Silvertail/WTD can use would be AES 128 bit is acceptable, but 256 bit would be much better.
** Last Data Access and Security document was published for Version 3.1 in 2012
Resolution
After investigating the issue, Engineering has determined the current state of WTD(version 6.0 and affecting all versions)
- AES-128 demonstrates a better security vs. performance ratio.
- Currently WTD uses a combination of RSA+RC4 key to encrypt logs.
- While PCI 3.1 recommended migrating from RC4 ciphers, PCI 3.2 (April 2016) obliges disabling weak ciphers such as RC4, MD5 etc.
To add support for stronger encryption, the client should have a choice what to use
- Our major concern is about data retention, which will have to include handling of both "old" and "new" ciphers.
- Current option on the table involves developing a tool to migrate(convert) encrypted logs from RC4 to the new AES cipher suite.
Project Management believes that this commitment to a fix should provide PCI compliance going forward.
Related Articles
How to handle a request for information on Access Control and Data Security in RSA Web Threat Detection Number of Views Red Hat Enterprise Linux (RHEL) debug options for RSA Authentication Agent 7.1 for PAM Number of Views Applying two-factor authentication with the RSA Authentication Agent for PAM to the GNOME screensaver found in the GNOME d… Number of Views Questions on the security of offline authentication data in the RSA SecurID Authentication Agent for Microsoft Windows Number of Views ID Plus Subscription Plans Number of Views
Trending Articles
How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device Reporting on RSA Authentication Manager 8.x users with On-Demand Token, a fixed passcode or a hardware/software token assi… How to Download OTP Token Seed Files from myRSA Anomalix idGenius - SAML Relying Party Configuration - RSA Ready Implementation Guide RSA MFA Agent 2.5 for Microsoft Windows Installation and Administration Guide
Don't see what you're looking for?
