The following essay is reprinted with permission fromThe Conversation, an online publication covering the latest research.

Government officials continue to seek technology companies help fighting terrorism and crime. But the most commonly proposed solution would severely limit regular peoples ability to communicate securely online. And it ignores the fact that governments have other ways to keep an electronic eye on targets of investigations.

In June, government intelligence officials from the Five Eyes Alliance nations held a meeting in Ottawa, Canada, to talk about how to convince tech companies to thwart the encryption of terrorist messaging. In July, Australian Prime Minister Malcolm Turnbull called on technology companies to voluntarily ban all systems that totally encrypt messages in transit from sender to recipient, an approach known as end-to-end encryption. British Home Secretary Amber Rudd made global headlines with her July 31 newspaper opinion piece arguing that real people dont need end-to-end encryption.

These claims completely ignore the one billion real people who already use secure messaging apps like Signal and WhatsApp. And it leaves no room for people who may decide they want that security in the future. Yet some technology companies look like they might be considering removing end-to-end encryption and others installed backdoors for government access years ago. Its been two decades since the Clipper chip was in the news, but now a revival of the government-business-consumer crypto-wars of the 1990s threatens.

One thing is very clear to computer scientists like me: We real people should work on improving security where we are most vulnerable on our own devices.

For the moment at least, we do have good, easy-to-use solutions for secure communication between computers, including end-to-end encryption of our messages. End-to-end encryption means that a message is encrypted by the sender, and decrypted by the recipient, and no third party is able to decrypt the message.

End-to-end is important, but security experts have warned for years that the most vulnerable place for your data is not during transit from place to place, but rather when its stored or displayed at one end or the other on a screen, on a disk, in memory or on some device in the cloud.

As the WikiLeaks release of CIA hacking tools highlighted, if someone can gain control of a device, they can read the messages without needing to decrypt them. And compromising endpoints both smartphones and personal computers is getting easier all the time.

Why are we most vulnerable at the endpoint? Because we dont like to be inconvenienced, and because adding more protection makes our devices harder to use, the same way putting multiple locks on a door makes it harder to get in, for both the homeowner and the burglar. Inventing new ways to protect our digital endpoints without reducing their usefulness is very challenging, but some new technologies just over the horizon might help.

Suppose a criminal organization or bad government, EvilRegime, wants to spy on you and everyone you communicate with. To protect yourself, youve installed an end-to-end encryption tool, such as Signal, for messaging. This makes eavesdropping even with a courts permission that much more difficult for EvilRegime.

But what if EvilRegime tricks you into installing spyware on your device? For example, they could swap out a legitimate upgrade of your favorite game, ClashBirds, with a compromised version. Or, EvilRegime could use a malware network investigative technique as a backdoor into your machine. With control of your endpoint, EvilRegime can read your messages as you type them, even before they are encrypted.

To guard against either type of EvilRegimes trickery, we need to improve our endpoint security game in a few key ways, making sure that:

In addition, it would be ideal if users could control their apps security themselves, rather than having to rely on app store security provided by yet another vulnerable corporation.

Computer security experts are excited about the idea that blockchain technology might be able to help us secure our own endpoints. Blockchain, the technology that underpins Bitcoin and other cryptocurrencies, creates a verifiable, unchangeable public record of information.

What this means for endpoint security is that computer scientists might be able to create blockchain-based tools to help us verify the origin of our apps. We could also use blockchains to confirm our data havent been tampered with, and to ensure our privacy. And as long as the source code for these programs is also free for us to inspect as Signal is today the security community will be able to verify that there are no secret backdoors.

As with any new technology, there is an enormous amount of hype and misinformation around blockchain and what it can do. It will take time to sift through all these ideas and develop secure tools that are easy to use. In the meantime, we all need to continue to use end-to-end encryption apps whenever possible. We should also stay vigilant about password hygiene and about what apps we install on our machines. Finally, we must demand that real people always have access to the best security mechanisms available, so we can decide for ourselves how and when to resist surveillance.

This article was originally published onThe Conversation. Read the original article.

Go here to read the rest:
End-to-End Encryption Isn't Enough Security for Real People - Scientific American

Encryption and Mindset: 2 Keys to Securing Modern Communications As omnichannel contact centers become more pervasive, ensuring the security of these connections is extremely important.

As omnichannel contact centers become more pervasive, ensuring the security of these connections is extremely important.

You don't have to look far for proof that technology rules our society today. Just a few decades ago, for example, an organization's greatest fear may have been physical theft or robbery, but today a cybersecurity breach tops the list of the C-suite's worst nightmares -- in just about any organization in the world.

Consider the following scenario: a national credit union uses an omnichannel contact center solution for connecting with customers. As a result, it relies on this system to securely collect and store the payment card industry (PCI) data for millions of consumers. One day, cyberattackers break into the system, and the private data of millions of consumers becomes vulnerable. Clearly, today's security concerns have not only shifted in method, but also magnified in scale.

According to the Identity Theft Resource Center's (ITRC) 2016 Data Breach Report, the U.S. hit a record high for data breaches last year, with the number soaring to 1,093 -- a 40% increase from 2015. As omnichannel contact centers become more pervasive, ensuring the security of these connections is extremely important.

Keys to securing communications, especially for contact centers, are the use of network encryption and a shift in cultural mindset on what the application of communications security means.

Securing Enterprise Communications Creating an encrypted network is the first step in securing enterprise communications and contact center channels. Network encryption refers to the process of encrypting or encoding data and messages transmitted or communicated over a computer network. With modern communications solutions spreading in both popularity and usage across all industries today, organizations must prioritize efforts to make sure systems are encrypted at all levels. A deeper level of encryption is becoming necessary for all communications modalities -- whether email, video, or chat -- as well.

As both the threat and skill of hackers continue to escalate, end-to-end encryption of all data is now the new standard in enterprise communications. Evidence of this threat, and further reinforcement of the need for end-to-end encryption, is PwC's recent finding that 32% of companies surveyed have been victims of cybercrime in 2016.

Unfortunately, according to the SANS IT Security Spending Trends 2016 survey, organizations allocated only 63% of total security spending to protecting sensitive data.

Adding to the lack of spending on security, organizations continue to implement BYOD policies to increase the level of engagement for employees and consumers across organizations. However, these policies can lead to more security breaches if they are not properly supported by the network. According to the 2016 BYOD & Mobile Security Spotlight Report from Skycure (a Symantec company), 21% of organizations have traced a data breach to their BYOD programs. Even worse, another 24% have found that employee-owned devices have been connected to malicious Wi-Fi hotspots -- putting the information stored on those devices in direct harm.

Why Cultural Mindset Matters In conjunction with increasing end-to-end encryption for the rising number of connected devices today, an organization's culture (specifically surrounding contact center use) needs to center around security at every point of the interaction. As a result, a culture that places importance on security is the other key to locking up communications security. Possessing, and championing, a security-conscious cultural mindset means creating a set of shared practices when using connected devices in any organization. This becomes increasingly important as millennials make up increasing proportions of the workplace today (and in contact centers specifically).

According to data from the Bureau of Labor Statistics, millennials (those between the ages of 20 and 35) make up a good portion of the workforce in call centers, accounting for about 40%. This has led to a subsequent increase in personal device use, which in turn has translated into a surging security issue.

For example, a 2014 TrackVia survey found that 70% of millennials admitted to bringing outside applications into an enterprise setting, even in violation of IT policies. Additionally, 60% of those employees weren't concerned about the corporate security ramifications of using personal apps instead of corporate apps -- pointing to a disconnect in industry best practices and those carried out internally as the result of an organization's cultural attitude toward security and employee mindset about their impact on it.

If organizations create a cultural mindset that places security front and center, and focus more time and investment on network encryption, the future of enterprise communications will only continue to grow. Omnichannel communications is the way of the future for contact centers, and ensuring its stability and growth benefits all organizations around the globe.

Read the original post:
Encryption and Mindset: 2 Keys to Securing Modern Communications - No Jitter

Encryption may make terrorist activity more difficult to track, but the trade-offs in improved cybersecurity protection are worth it, according to the former head of Britains MI5 service.

In a recent interview with BBC Radio 4, Jonathan Evans said that recent attacks by militants in the U.K. are not a reason to increase risks by weakening encryption systems. As cybercriminals use more sophisticated techniques to penetrate government and private sector organizations, he argued, its important to remember the variety of threats facing the public and use whatever measures necessary to ward them off. Evans was chief of the British spy operations for six years and spent 33 years with the organization before he left in 2013.

As Business Insider reported, Evans has no illusions about the dangers technology can introduce. He said that the Dark Web, where online activity is more private, has allowed child abuse, leaks of sensitive government information and other criminal activity to take place more easily. Evans also predicted that cybersecurity attacks will continue to come from a variety of places including the Internet of Things (IoT), which he suggested needs greater protection.

To some extent, The Guardian suggested, Evans comments may be in reaction to British Home Secretary Amber Rudd. She has been criticizing encryption in messaging apps as a tool to hide militant activity.

But as Reuters pointed out, Evans is not the only one who is concerned about the impact of weakened encryption on cybersecurity threats. A senior official with the U.K.s intelligence agency GCHQ, for example, suggested that law enforcement officials could work more collaboratively with technology firms who maintain communication systems. That way, officials would be able to intercept communications by malicious actors, rather than reduce the strength of the underlying systems.

In any case, Evans believes that foiling militants will take at least 30 years which means that weakening encryption could be a short-term and premature move.

See the original post:
Ex-MI5 Leader Advocates for Strong Encryption to Stave Off Cybersecurity Attacks - Security Intelligence (blog)

Earlier this month, UK Home Secretary Amber Rudd idiotically insisted that "real people" don't need encrypted messaging apps; but as foolish a statement as that was, there was a kernel of truth to it.

Because real people don't just need encrypted messaging apps that offer end-to-end protection, they also need end-point security -- the kinds of thoughtful design and expedient updating and transparent code that enables them to defend their devices from attackers who gain access to their messages by compromising their phones and computers.

Computer scientist Megan Square writes in The Conversation that "Inventing new ways to protect our digital endpoints without reducing their usefulness is very challenging, but some new technologies just over the horizon might help."

Suppose a criminal organization or bad government, EvilRegime, wants to spy on you and everyone you communicate with. To protect yourself, you've installed an end-to-end encryption tool, such as Signal, for messaging. This makes eavesdropping even with a court's permission that much more difficult for EvilRegime.

But what if EvilRegime tricks you into installing spyware on your device? For example, they could swap out a legitimate upgrade of your favorite game, "ClashBirds," with a compromised version. Or, EvilRegime could use a malware "network investigative technique" as a backdoor into your machine. With control of your endpoint, EvilRegime can read your messages as you type them, even before they are encrypted.

To guard against either type of EvilRegime's trickery, we need to improve our endpoint security game in a few key ways, making sure that:

* EvilRegime isn't masquerading as the company that makes "ClashBirds" when we install our software.

* No one has tampered with our "ClashBirds" app before or after installation.

* The app doesn't have any backdoors or security holes that could be exploited by EvilRegime after we install it.

In addition, it would be ideal if users could control their apps' security themselves, rather than having to rely on app store security provided by yet another vulnerable corporation.

End-to-end encryption isn't enough security for 'real people' [Megan Squire/The Conversation]

(Image: johnnymip, CC-BY)

A group of researchers from Oxford and TU Berlin will present their paper, White-Stingray: Evaluating IMSI Catchers Detection Applications at the Usenix Workshop on Offensive Technologies, demonstrating countermeasures that Stingray vendors could use to beat Stingrays and other cell-site simulators (AKA IMSI catchers).

The $469 LockState RemoteLock 6i is a smart lock that is sold to Airbnb operators through a partnership with the company, allowing Airbnb hosts to generate and expire unique, per-tenant unlock codes.

Ziemowit Pierzycki bought a $1500 used lens from an Amazon seller who turned out to be a scammer with an ingenious trick: the crook researched a recently widowed person across town and sent them a parcel with a couple of baking mats addressed to the deceased or current resident.

The Pry.Me Bottle Opener holds tens of thousands of times its own weight, and you can pick one up now from the Boing Boing Store.This remarkable keychain is considerably smaller than any of your keys, but dont let that fool you: it can easily open any bottle, and could even tow a trailer full of []

Guaranteeing your privacy online goes way beyond checking the Do Not Track option in your browsers settings. To ensure that your internet activity is totally hidden from Internet Service Providers, advertisers, and other prying eyes, take a look at Windscribes VPN protection. It usually costs $7.50 per month, but you can get a 3-year subscription []

This project management bundle will help you get organized and learn how to lead a team to success. You can pay what you want for these five courses when you pick them up from the Boing Boing Store.To help you become an invaluable asset for your company, this bundle includes a curated collection of professional []

Read more from the original source:
Real people don't (just) need encryption / Boing Boing - Boing Boing

A decade ago, encryption was hot enterprise security news. As a measure of its effectiveness as a technology, it has been incorporated as a key feature in many security suites since. But that doesn't mean it has faded in importance. With so many incidents of ransomware, fraud and data breaches in the news, encrypting sensitive data remains a vital necessity. (For more on how encryption works and how to evaluate encryption products, see the eSecurity Planet article Full Disk Encryption Buyer's Guide.)

The encryption products covered here are those that have stood the test of time. In the early years of the millennium, there were scores of encryption tools available. But through consolidation, acquisition and attrition, these are the ones that have emerged in what can now be considered a mature market.

Research and product evaluation are necessities, as there remains great diversity among the various options. Some tools work well in certain environments and poorly in others. Incompatibility issues can arise. And the sheer volume of data in existence means that datasets have to be prioritized as part of enterprise encryption management it may not be feasible, in some cases, to encrypt everything.

"Many vendors' encryption products are using proprietary interfaces that are incompatible with other vendor key managers," said Gartner analyst Brian Lowans. "The wide variety of encryption products and vendors makes the selection process problematic."

Here, then, are ten of the top enterprise encryption vendors and their products, followed by a chart comparing encryption product features. Key features include endpoint encryption (hard drive and removable media, email encryption, file encryption, on premises and in the cloud cloud), centralized management, key management, authentication, and integration with other security tools.

IBM Guardium Data Encryption performs encryption and decryption operations with minimal performance impact. Features include centralized key and policy management, compliance-ready, and granular encryption of files and folders, as well as volumes of data, each protected under its own encryption key.

See our in-depth look at IBM Guardium Data Encryption.

The Check Point Full Disk Encryption Software Blade provides automatic security for all information on endpoint hard drives, including user data, operating system files and temporary and erased files. Multi-factor pre-boot authentication ensures user identity.

See our in-depth look at Check Point Full Disk Encryption Software Blade.

DESlock encryption by ESET has a web-based management console that allows multi-user administration across the network. Additional features include remote device wipe, simplified key sharing, and encryption policy setting and enforcement. Centralized management delivers the ability to control devices anywhere in the world.

See our in-depth look at Eset DESlock.

Dell Encryption Enterprise provides software-based, data-centric encryption that protects all data types on multiple endpoints and operating systems. It integrates with existing security platforms and tools, and enables IT to manage encryption policies for multiple endpoints from a single management console. In addition, the encryption tool allows IT to rapidly enforce encryption policies on system drives or external media without end-user intervention.

See our in-depth look at Dell Encryption Enterprise.

McAfee Complete Data Protection comprises data loss prevention, full-disk encryption, device control, and protection for cloud storage as part of an integrated suite. Centralized policy management is provided by the McAfee ePO management console to provide remote access.

See our in-depth look at McAfee Complete Data Protection.

HPE SecureData provides an end-to-end data-centric approach to enterprise data protection, securing data persistently at rest, in motion and in use. It protects data at the field level, preserves format and context, and provides granular policy controls. It offers security controls for Big Data applications too.

See our in-depth look at HPE SecureData.

GravityZone Full Disk Encryption leverages encryption capabilities provided by Windows (BitLocker) and Mac (FileVault) platforms. Encryption management is done from the same cloud or on-premises console used for endpoint protection.

See our in-depth look at Bitdefender GravityZone.

Sophos encryption products include mobile recovery of BitLocker or FileVault recovery keys, and granting of access to encrypted files based on the security state of the endpoint. Further, they provide full disk encryption, central management for Windows BitLocker and macOS FileVault, service-to-service key recovery, role-based access, and application-based encryption.

See our in-depth look at Sophos SafeGuard.

Symantec's integrated encryption product line includes endpoint, email and file encryption. Endpoint encryption encompasses full disk encryption, cloud data encryption, policy enforcement integration, and encryption of messages from Apple iOS and Android.

See our in-depth look at Symantec Encryption.

Trend Micro Endpoint Encryption provides full disk encryption, folder and file encryption, and removable media encryption. A single management console allows clients to manage encryption along with other Trend Micro security products.

See our in-depth look at Trend Micro Endpoint Encryption.

Below is a chart comparing key features of top enterprise encryption products.

Go here to see the original:
Top 10 Enterprise Encryption Products - eSecurity Planet