RSA went into lock-down mode, giving employees free food round-the-clock for a month while they investigated. The two hacker groups stole specific information about SecurID, but RSA has declined to explain what was stolen. Coviello said on Tuesday that the "piece of information was important" but it was only one piece of information.
But RSA's follow-up with its customers was slow, causing widespread concern that SecurID was broken. RSA has offered to replace SecurID tokens for customers, although Coviello said that a relatively small number of customers requested that.
The motive for the attack against RSA was clearly to gain access to U.S. defense-related technology, Heiser said. RSA reached out to about 500 of its top customers while also using its partner network to contact others. Nonetheless, many companies felt left out of the loop, wondering if their systems were vulnerable.
"We had our trial by fire," Heiser said. "Many stakeholders felt we could have done more and we should have done more sooner, and to those customers we inconvenienced, we truly apologize."
Heiser said media reports have not always been accurate. To date, there has been only one attack that tried to use the SecurID information taken from RSA. The company attacked -- which Heiser did not identify -- was in the defense industry, but the attack was ultimately unsuccessful. The RSA breach is believed to have threatened companies including Lockheed Martin, L-3 and Northrop Grumman.
RSA withheld more detailed information because it didn't want to give the attackers an idea of what RSA knew about them, Heiser said. There was also fear that another group might try to mount a quick attack.
"They were stealthy but they did leave some information behind," Heiser said.
Sign up for Computerworld eNewsletters.