Postmortem / Root Cause Analysis

Up to version 4.0, the SecurID App was classified as a 'standalone' app by the Google Play app store. With the addition of cloud-based MFA features in 4.0 (e.g., push to approve), on 15th April, Google reclassified retroactively the app as a 'connected mode' app. For connected mode apps, Google requires that app developers provide an account with which to test the app’s connected features.

With the separation of RSA from Dell, the Google team sent notification if this new requirement (including a deadline on 1st May) to an old email address, which is no longer monitored. SecurID has corrected the issue and provided the Google team with a test account. After successful testing, Google has approved and re-listed the SecurID 4.0 app."

Mitigations

SecurID is continuously taking steps to improve the SecurID services and processes to help ensure such incidents do not occur in the future. This includes, but is not limited to:

• The app store email policy has been updated so future emails are sent to multiple contacts so future emails can’t be lost.
• Going forward, future versions of the app will only be submitted as a connected app, with the required test credential, so there will be no reclassification risk in the future.