2016 Day 2 Keynote speaker: Bill Duane, RSA What breaches teach, and education the hard way!

## Overview

At AusCERT 2016, Bill Duane, an RSA Distinguished Engineer, presented a keynote detailing his firsthand experience responding to the landmark 2011 cyberattack on RSA Security. While Duane framed himself not as a traditional malware or cyber warfare specialist, but rather as an engineer working on cryptographic algorithms, he was thrust into leading technical triage when suspicious activity surfaced on RSA's secure infrastructure.

The keynote addresses the reality of defending an enterprise against a nation-state tier adversary, the initial discovery process, and the broader context surrounding the breach.

## Initial Detection and the Investigation

The incident began in early spring 2011 when a fellow engineer alerted Duane to an unusual access anomaly on one of RSA's secure servers. Key details of the initial detection include:

* **Detection Anomaly:** A meticulous, compulsive system administrator noticed that a single inactive account had a single unauthorized permission set on it. * **Lack of Log Evidence:** There was zero evidence in the system log files or elsewhere indicating how or when the permission had changed. * **Escalation:** Despite initial skepticism that the anomaly might be insignificant, pulling on this single administrative thread uncovered an extensive, sophisticated intrusion. * **Operational Impact:** The immediate investigation consumed Duane's life entirely for a month, while subsequent remediation and repair activities lasted for well over a year.

## Threat Actor Profile and Attack Motivations

Duane outlined the motives and capabilities behind the breach based on internal findings and external disclosures:

* **Strategic Objective:** The primary goal of the attackers was to obtain military secrets from a major defense contractor. Because the contractor utilized RSA technology for defense, the adversary targeted RSA directly to bypass or weaken those protections. * **Attack Arsenal:** The intrusion utilized advanced military-grade cyber weaponry, specifically leveraging advanced persistent threat (APT) methodologies alongside zero-day malware. * **Attribution:** While Duane noted that commercial entities like RSA typically lack the intelligence capabilities to definitively attribute such actors, General Keith Alexander (then head of the NSA) publicly stated in a U.S. Senate forum that China's military was responsible for attacking RSA and several other U.S. companies. Subsequent reporting and research by Mandiant and *The New York Times* corroborated these findings.