Google and OnePlus Crackables 2.0 could be the perfect pandemic distraction – SlashGear

Back in 2018, OnePlus teamed up with UNIT9, Sleep Deprivation Lab, and Google to launch a mobile game called Crackables. The game had players racing to solve cryptography puzzles over multiple rounds, with the ultimate gaming setup waiting at the end for the grand prize winner. Crackables is making a comeback this year, with OnePlus announcing Crackables 2.0 today.

It sounds like Crackables 2.0 will follow the same kind of structure the original Crackables did in 2018. That means itll be another race to solve these crypto-puzzles and go toe-to-toe with other players for a grand prize. While the grand prize was a gaming setup last time around, this time the prize players will be competing for is straight up cash specifically, the grand prize winner will get $10,000 for themselves and an additional $10,000 to donate to a charity supporting those affected by COVID-19.

Crackables 2.0 is based on Google technology (with the big G helping conceptualize the game as well) and is primarily made by UNIT9 and Sleep Deprivation Lab. OnePlus promises that puzzle difficulty will start low and ramp up from there, so if youre not sure if crypto-puzzles are for you, youll be able to get your feet wet with some easy puzzles to start. In its announcement today, OnePlus said that players will need to travel through gates to move between levels, and that some of those gates will involve community-oriented challenges that will have you working together with others.

The game will open up to everyone on April 14th, and the first 10 players to solve the final puzzle will have the chance to square off in a grand finale tournament for that $10,000 prize. Regular gameplay wraps up on April 30th a little more than two weeks after the game begins and the tournament will be live-streamed for everyone to watch beginning on May 7th.

If Crackables 2.0 is something that you want to participate in, you can register for the game beginning today over on the OnePlus website. Registration will run until April 14th, when the game will kick off for everyone.

Originally posted here:
Google and OnePlus Crackables 2.0 could be the perfect pandemic distraction - SlashGear

Hardware Encryption Market Analysis On Trends and Need 2025 – Science In Me

Global Hardware Encryption Market: Snapshot

A variety of factors or specific business needs influences the choice of specific encryption solutions among various end-use industries. Hardware encryption is gaining popularity for protecting sensitive data on portable devices such as laptops and USB flash drives. Its ease of use, consistent performance, and robust protection against numerous common and less sophisticated attacks offsets its high cost compared to software-based encryption. For instance, any brute-force attacks by hackers to gain access to hardware encrypted chips can be easily thwarted with the help of this. The mechanism of hardware encryption works on the devices on-board security, which performs the needed encryption and decryption. Unlike software-based encryption, it doesnt require drivers and has minimal configuration requirements.

Download Brochure of This Market Report at https://www.tmrresearch.com/sample/sample?flag=B&rep_id=647

However, since it is tied to a particular device, hardware encryption methods may not prove so helpful. Nevertheless, the soaring use of mobile devices by several governmental agencies and the storage of confidential financial and healthcare data in mobile devices have propelled the demand for hardware encryption methods. In case the devices are stolen, the data cannot be compromised.

In recent years, Advanced Encryption Standard (AES), a specification standard by the National Institute of Standards and Technology (NIST) has been gaining prominence for data security for hardware as well as software encryption method. The cryptographic module is fast gaining adoption among several military, government, healthcare institutions, and financial organizations world over, especially in developing and developed nations. AES has become one of the most popular algorithms adopted in symmetric key cryptography by various governmental agencies in the U.S. Boasting of marked improvements over its predecessors, AES employs longer cryptographic keys, offers easy implementation, and can be used in restricted environments such as in smart cards.

Global Hardware Encryption Market: Overview

The global market for hardware encryption is projected to witness healthy growth throughout the forecast period, thanks to the advent of portable storage devices in order to transfer files and information between computers. In addition, these devices help in improving the security concerns and confidentiality of data. These devices cannot be altered or removed by any malware or virus or be uninstalled by the user, owing to which the market is likely to witness high growth over the coming few years.

The research report on the global hardware encryption market offers a thorough overview, focusing on the key growth drivers and currents trends in the market. The research study throws light on the product segmentation, applications, technological advancements, and the regional segments of the global hardware encryption market. In addition, the limitations and challenges that are being faced by the prominent players in the overall market have been discussed in the research study.

Global Hardware Encryption Market: Drivers and Restraints

The rising concerns related to the privacy of data and data security and tremendous expansion of the digital content are anticipated to encourage the growth of the global hardware encryption market throughout the forecast period. In addition, several advantages offered by hardware encryption in comparison with software encryption technology and the rising need of regulatory framework are some of the other factors estimated to accelerate the growth of the overall market in the near future.

On the contrary, the need for high capital investment and the lack of awareness among consumers reading the benefits of hardware encryption technology are projected to restrict the growth of the global hardware encryption market in the next few years. Nevertheless, the emergence of economical and compact hardware encryption technique and the rising adoption of cloud computing are expected to offer promising opportunities for market players in the coming years.

Global Hardware Encryption Market: Region-wise Outlook

The global market for hardware encryption has been divided on the basis of geography into Europe, the Middle East and Africa, North America, Latin America, and Asia Pacific. The research study has provided a detailed analysis of the leading regional segment, highlighting the market share and anticipated growth rate. In addition, the key factors that are encouraging the growth of these segments have been discussed in the scope of the research study.

According to the research study, Asia Pacific is anticipated to witness strong growth throughout the forecast period, owing to the robust development of the IT industry. In addition, a substantial contribution from China, India, Malaysia, and South Korea is expected to accelerate the growth of the hardware encryption market in Asia Pacific throughout the forecast period. Furthermore, with the presence of a large number of established hardware encryption manufacturing companies, North America is anticipated to witness healthy growth in the next few years.

Key Players Mentioned in the Research Report are:

The global hardware encryption market is projected to witness a high level of competition in the coming few years. The leading players in the market are focusing on offering new products to consumers in order to enhance their market penetration and maintain their dominant position throughout the forecast period. Some of the prominent players operating in the hardware encryption market across the market are Netapp, Maxim Integrated Products, Inc., Toshiba Corp., Gemalto NV., Micron Technology, Inc., Samsung Electronics Co. Ltd., Kanguru Solutions, Thales (E-Security), Winmagic Inc., Kingston Technology Corp., Western Digital Corp., and Seagate Technology PLC.

Furthermore, the research study has provided a detailed analysis of the competitive landscape of the global hardware encryption market. An in-depth overview of company profiles and their financial overview have been discussed at length in the scope of the research study. Additionally, the business strategies, SWOT analysis, and the recent developments have been included to offer a clear understanding of the overall market.

Request For TOC On this Market Report at https://www.tmrresearch.com/sample/sample?flag=T&rep_id=647

About TMR Research:

TMR Research is a premier provider of customized market research and consulting services to business entities keen on succeeding in todays supercharged economic climate. Armed with an experienced, dedicated, and dynamic team of analysts, we are redefining the way our clients conduct business by providing them with authoritative and trusted research studies in tune with the latest methodologies and market trends.

Link:
Hardware Encryption Market Analysis On Trends and Need 2025 - Science In Me

More Effective Cybersecurity: The Practical Application of The MITRE ATT&CK Framework – Redmondmag.com

More Effective Cybersecurity: The Practical Application of The MITRE ATT&CK Framework

Date: Wednesday, April 29th at 11:00am PT / 2:00pm ET

In March, Chris White, CSO and Co-Head of MSS at BlueVoyant presented the MITRE ATT&CK framework and discussed its implications for Security TeamsConsisting of 11 tactics and 291 techniques, MITRE ATT&CK can easily overwhelm security teams. The most common question is almost always How and where do I start?

In this webinar, Chris will summarize and expand on the discussion from his previous discussion. This webcast will focus on:

Register now!

About the presenter:

Chris is BlueVoyant's Co-Head of Managed Security Services. He has a decade of experience consulting to Fortune 500 and US Intelligence Community organizations and was previously Booz Allen's Chief Engineer for Commercial Cyber Engineering Services and Data Protection Solutions. He is an experienced advisor in the realm of cryptography, data discovery, metadata analysis, risk metrics/analytics, data visualization, and reporting. Throughout his career, he has assessed, designed and built information security programs for a wide variety of large financial, pharmaceutical and technology organizations.

Date: 04/29/2020

Time: 11:00amPT

Sponsored By

Read the original:
More Effective Cybersecurity: The Practical Application of The MITRE ATT&CK Framework - Redmondmag.com

Pathways to Growth: ‘Chain’ reaction – Accounting Today

Most of us first became aware of blockchain the cloud-based distributed general ledger as a technology associated with bitcoin. Today blockchain is emerging with extraordinary implications for firm growth.

At the most recent AICPA Blockchain Symposium, I talked with three pioneers in the field. As a former auditor, I was especially interested in how blockchain is disrupting the traditional audit function. These explorers have embraced this brave new technology, even as guidelines are still being formulated. I was curious, like many of you, about what its like to audit the blockchain.

I interviewed Andr Sterley, digital asset group leader for Mazars USA in New York; Andries Verschelden, the partner who leads the blockchain practice at Armanino in San Francisco; and Jagruti Solanki, an assurance partner at Aprio in Atlanta specializing in technology and blockchain.

These pioneers have a couple things in common. They were all born outside the U.S. and all had a strong internal motivation to master blockchain technology. An Aha! moment for me was finding out that the blockchain is a subledger. I could get my head wrapped around auditing a subledger. Yet its very different in that it represents a single set of books, housed in the cloud, which serves as a historical repository for every cryptocurrency-based transaction.

A personal journey

South Africa native Andr Sterley, who had always wanted to live and work in the U.S., moved from Mazars South Africa to join Mazars USA in their New York City office in 2014. During the move, parts of his life were on both continents, and Andr found that conventional means of making cross-border payments were slow, costly and inefficient. He started studying bitcoin, thinking it might be an alternative to methods like MoneyGram and Western Union.

Andrs intellectual curiosity grew beyond his own needs. After an in-depth exploration he conducted experiments with a few transactions. It took seconds, versus the days in more traditional methods, plus it was quite inexpensive. Andr saw the potential immediately and concluded that crypto assets and blockchain technology presented an enormous potential business opportunity. Since then, he has become something of a LinkedIn blockchain personality, providing entertaining content and commentary.

By early 2018, he was able to offer services to his first Mazars USA client a business in need of an external financial statement audit. Andr described the need to develop cryptography skills: Auditors were never taught cryptography, the functional discipline combining computer science and locking things digitally. This includes techniques derived from algorithms to secure information in ways that are hard to decipher. But now I had to rely on cryptography and had to get educated, to know that what I was evaluating could be relied upon.

Also, since blockchain is a universal ledger, a transactions historical record can be visible to all parties who have permission to access the blockchain. Imagine grain bushels on a boat, coming in and out of various locations, with the entire record chained together. This becomes the central source of truth, eliminating the necessity for traditional confirmations and reconciliations.

Instead, typical questions to be answered are: Was this particular transaction authorized? Did it go to the right address? Were the parties to the transaction related?

Leveraging a passion

Andries Verscheldens career choice was not a surprise. His father Frans was managing partner of the Moore Stephens (now Moore) firm in Brussels, Belgium. In 2017 Andries merged the interim CFO business he was leading with Armanino, a leading Moore member based out of California. Andries was drawn to the firm for its relentless focus on innovation. He went on to lead the firms entire outsourcing business.

Increasingly fascinated by blockchain and the growing use of cryptocurrencies, Andries expressed his interest to managing partner Matt Armanino, who was impressed by his passion and enthusiasm. Having been involved in helping clients since 2014 with blockchain services, in 2019 Armanino upped its strategic investment in blockchain. The firm made the equally strategic decision to put Andries in charge of the practice. He entered the arrangement with the understanding that blockchain would not be just another industry offering, but one that could fundamentally change the profession, the business model and client expectations.

How revolutionary would that change be? Extremely! Andries described to me the intriguing fact that the majority of digital assets today have no underlying real world asset associated with them. They are series of ones and zeros that only live in this blockchain world, and have the ability to instantaneously transfer value around the world in a direct (peer-to-peer), secure way. He said, Basically, youre being asked to do audits on something that is purely digital in nature, but is known to have value. Ponder that for a moment!

Also of note is the fact that existing enterprise resource planning systems are not set up to integrate with blockchain transactions. In a client situation, this creates a mixed bag of digital assets (like bitcoin) and non-digital assets (like greenbacks) living in different systems. The challenge is reconciling the two with existing tools such as Excel. Luckily, a number of new software startups are closing this gap. Examples are Lukka, Ledgible, Softledger and Blox.

Early adopter

Born in India and raised in Oman, Jagruti Solanki (pictured) is an audit partner at Aprio in Atlanta. All things considered, shes an old hand at blockchain, having served her first client in 2013 when Bitcoin was selling for $200. She recalls with a smile her response (Youre crazy!) when her husband suggested investing. Then it hit $20,000 and I thought I was the crazy one, she added.

Always up for a challenge, this tech-minded auditor made clear her interest in getting involved. Like Andr and Andries, she jumped in with both hands and feet, learning as she went about the risks and the upside potential.

Traditionally, blockchains have been operated publicly. And while private blockchain applications are growing, including among large retailers like Walmart, Jagruti noted the reluctance, even fear, on the part of some accounting firms to get involved.

Thats because they see auditing companies using blockchain technology as carrying a high risk. One contributing factor is that there is currently an absence of definitive standards for auditing the blockchain.

As a result, said Jagruti, theres a considerable amount of judgment involved. Firms that wish to get involved in blockchain should have a culture that is welcoming to technology and has significant trust in its leaders. Whats more, she said, there is not yet a checklist for auditors in this space.

The path forward

Andries noted, I wish there were a clearer roadmap, but we arent there yet. As a result, those CPAs working with blockchain have a sharing community, learning from each other and making the journey together. The AICPA has been instrumental in facilitating this evolution.

I asked the three experts how they would proceed vis vis blockchain if they were managing partners at their respective firms. Aprios Solanki recommended moving boldly forward without fear, and bringing your clients along with you. She believes the spoils will go to the proactive, not to those who rest on the sidelines waiting and watching.

All three explorers concurred that training to get firm members comfortable with the technology is a high priority. Mazars Sterley suggested building blockchain into your strategic planning for the future. Start thinking about what you will offer and how you will get up to speed. Survey clients to gauge their level of understanding and interest.

Armaninos Verschelden weighed in, calling blockchain a trustless, utopian world that disrupts perceptions of traditional trust and value in the CPA domain, like the production of quarterly or annual financial statements.

Armanino recently released the worlds first real-time audit capability, Trustexplorer. It is a tool that utilizes blockchain technology to continuously collect audit evidence. It enables users to generate an audit report over balances that are never older than 30 seconds, on demand when the end user needs it. The technology reminds me of streaming on demand versus how we accessed audio/video in years past.

Our explorers agreed that its essential to ask the tough questions, i.e., will your culture support adoption of blockchain? How forward-looking is your firm? Are members locked into compliance mode, or are they ready to break out and innovate?

As you consider adopting blockchain as a strategic technology, note that its viewed as a plus by young accounting professionals and could even become a recruitment tool. Offering it may also win you points from tech-forward clients, and those whose trust in established financial institutions and structures has eroded over the years.

Said Verschelden, We are providing trust today. But our trust-providing function will change dramatically and the value that we are bringing cant be the way its always been through quarterly reports.

Much remains to be known about the role and impact of blockchain in the future. But there is no doubt that it will continue to migrate from the perimeter into the mainstream of our profession. And our pioneers will continue to chart the course in delivering on-the-ground, real-life experiences.

See original here:
Pathways to Growth: 'Chain' reaction - Accounting Today

ConsenSys Health launches Stop COVID-19 Ethereum Blockchain Hackathon – Ledger Insights

TodayConsenSys Healthannounced the Stop COVID-19 Virtual Hackathon to start April 13 and run through to May 11. Sponsors of the initiative includeGitcoin,Hyperledger,ConsenSys,One Million DevelopersandOpenMinded. The first virtual panels by mentors will be available today.

The project brings together three open source communities from Ethereum, Hyperledger and OpenMinded.

Working together for the first time with a very specific toolset, this interdisciplinary group will rapidly create highly-relevant solutions with the potential to have both immediate- and long-term positive impact, said Heather Leigh Flannery, Founder and CEO of ConsenSys Health. The core of our effort is to leverage converging innovations like blockchain, tokenization, zero-knowledge cryptography, and federated machine learning to advance immediate and long-term public health goals while preserving individual privacy.

Healthcare and life sciences volunteers will mentor developers. The group aims to address many of the issues highlighted in the news. The areas include clinical trials for vaccines, galvanizing supply chains for ventilators, location tracking without compromising privacy and other topics.

The award for first place is $10,000, with second and third place receiving $7,000 and $3,000, respectively.

The panel of judges so far includes ConsenSys founder and CEO Joseph Lubin, Brian Behlendorf, Executive Director of Hyperledger and four executives from ConsenSys Health. ConsenSys Health recently spun out of ConsenSys.

A week ago a few members of Hyperledger including HACERA, IBM and Oracle agreed to collaborate to collate Coronavirus data. And to the surprise of some, U.S. Homeland Security listed blockchain as a critical service in the context of COVID-19.

Read more:
ConsenSys Health launches Stop COVID-19 Ethereum Blockchain Hackathon - Ledger Insights

This is the Secret to Getting Clean, Secure Code from Your Developers – Computer Business Review

Add to favorites

The time between a vulnerability announcement and its exploits appearing in the wild is just three days, so being proactive is now a must.

The secret ingredient to more secure code is out and its simple: happiness.

Thats according to a sweeping annual survey of over 5,000 developers, which found that they are triple as likely to spot security issues if happy at work.

The finding might seem faintly ludicrous: most businesses nowadays aspire, superficially or otherwise, to creating a positive working environment and those that fail should hardly expect insecure code as the inevitable outcome.

(It is extremely likely, of course, that happiness is an outcome of other factors that are in themselves greater contributors to more considered code reviews/QA: adequately staffed teams, less pressure to ship code at an unreasonable pace..)

But with developers shipping code ever faster under pressure from business leaders to iterate and innovate at pace and the same survey showing that 28 percent of mature organisations have suffered an open source breach in past 12 months, business leaders may want to ask themselves how they can make their developers happier.

Open source software security specialist Sonatypes seventh annual DevSecOps community survey which reached devs in UK, USA, India, Canada and the EU is not all full of guidance on creating a merry bed of roses for developers however.

With software supply chain security firmly in the spotlight, following a string of security incidents, many businesses are looking closely at how to shore up the integrity of the code amid increasingly rapid development cycles. (The report found that 55 percent are deploying code to production at least weekly, up from 47 percent in 2019).

The security or otherwise of application code and beneath it/baked into it, open source code components is vital: hundreds of thousands of open source software packages are in production applications throughout the supply chain; many rife with issues ranging from outdated versions; understaffed projects; and existence of known security flaws.

Sonatype found that happy developers those that feel secure in their job, have access to training and are being given the right tools are 65 percent more likely to conduct rigours code checks.Dennis Orner, Software Engineer, TWT Digital Health commented in the survey that: Security falls short when things get shipped under pressure. This is not the case as often when security is part of the process.

When asked what caused the most friction in an organisation members of mature DevOps teams reported no friction, while others cited immature practices and management as key causes of disruption.

Derek Weeks, Vice President at Sonatype commented that: Developer happiness based on mature DevOps practices is fundamental to the quality and delivery of secure software. By introducing mature DevOps practices, businesses can not only innovate faster, they can enhance their development teams job satisfaction, and ultimately differentiate themselves as employers critical when so many companies face significant skills shortages and increased competition.

Nearly one in five (24 percent) queried reported that they have suspected or have verified a breach within the last 12 months.

Breaches caused by the integration of open source components has dropped slightly to 21 percent following a sharp rise two years ago around the time of the Equifax breach, which they blamed on an open source framework.

Established DevOps security teams are 69 percent more likely to follow an open source governance policy. These governance policies sit as a guiding framework for security teams and layout step by step how organisations approach and handle the array of open source components it needs to operate. A key move for teams following a good governance policy is the implementation of software composition analysis tools.

However, only 45 percent of those operating mature DevOps practices say they keep a full software bill of materials for open source components that is used in their applications.

Mitesh Shanbhag, Assistant Vice President, Nomura International PLC, UK commented that: The time between a vulnerability announcement and its exploits appearing in the wild is just three days, so being proactive is now a must.

Continued here:
This is the Secret to Getting Clean, Secure Code from Your Developers - Computer Business Review

Open Source Software Market Summary, Trends, Sizing Analysis and Forecast To 20 – News by aeresearch

Latest Report on Open Source Software Market size | Industry Segment by Applications ((BMForum, phpBB and PHPWind), by Type (Shareware, Bundled Software, BSD(Berkeley Source Distribution) and Advanced Driver Assistance Systems (ADAS), Regional Outlook, Market Demand, Latest Trends, Open Source Software Industry Growth & Revenue by Manufacturers, Company Profiles, Shares, Forecasts 2026. Analyzes current market Analysis and upcoming Few years growth of this industry.

The Open Source Software Market report provides a detailed overview of the industry including both qualitative and quantitative information. Open Source Software market with detailed market segmentation by return type, end-user and geography. The global Open Source Software market is expected to witness high growth during the forecast period. The report provides key statistics on the market status of the leading Open Source Software market players and offers key trends and opportunities in the market. The global Open Source Software market is segmented on the basis of return type and end-user.

The report also includes the profiles of key companies along with their SWOT analysis and market strategies. In addition, the report focuses on leading industry players with information such as company profiles, components and services offered, financial information, key development in past five years.

Request Sample Copy of this Report @ https://www.aeresearch.net/request-sample/145737

Global Open Source Software Market Segment by Manufacturers, this report covers:

Global Open Source Software Market Segment by Applications, can be divided into

Global Open Source Software Market Segment by Type, covers:

The Open Source Software market report provides a detailed analysis of global market size, regional and country-level market size, segmentation market growth, market share, competitive Landscape, sales analysis, impact of domestic and global market players, value chain optimization, trade regulations, recent developments, opportunities analysis, strategic market growth analysis, product launches, area marketplace expanding, and technological innovations.

Reason to Buy:

Save and reduce time carrying out entry-level research by identifying the growth, size, leading players and segments in the global Open Source Software marketHighlights key business priorities in order to assist companies to realign their business strategies.The key findings and recommendations highlight crucial progressive industry trends in the Ribbon Fiber Optic Cable market, thereby allowing players to develop effective long-term strategies.Develop/modify business expansion plans by using substantial growth offering developed and emerging markets.Scrutinize in-depth global market trends and outlook coupled with the factors driving the market, as well as those hindering it.Enhance the decision-making process by understanding the strategies that underpin commercial interest with respect to products, segmentation and industry verticals.The report analyzes factors affecting Open Source Software market from both demand and supply side and further evaluates market dynamics effecting the market during the forecast period i.e., drivers, restraints, opportunities, and future trend. The report also provides exhaustive PEST analysis for all five regions namely; North America, Europe, APAC, MEA and South & Central America after evaluating political, economic, social and technological factors effecting the Open Source Software market in these regions.

Table of Contents:

IntroductionKey TakeawaysResearch MethodologyOpen Source Software Market LandscapeOpen Source Software Market Key Market DynamicsOpen Source Software Market Global Market AnalysisOpen Source Software Market Revenue and Forecasts to 2026 Product TypeOpen Source Software Market Revenue and Forecasts to 2026 ApplicationOpen Source Software Market Revenue and Forecasts to 2026 Geographical AnalysisIndustry LandscapeOpen Source Software Market, Key Company Profiles

Request Customization on This Report @ https://www.aeresearch.net/request-for-customization/145737

Read this article:
Open Source Software Market Summary, Trends, Sizing Analysis and Forecast To 20 - News by aeresearch

Customer Personal Information Is the Number One Data Protection Priority nCipher 2020 Global Encryption Trends Study – Yahoo Finance

Organizations racing to protect sensitive data as it proliferates across cloud, IoT devices and 5G networks

As organizations accelerate digital initiatives such as cloud and the internet of things (IoT), and data volumes and types continue to rise, IT professionals cite protection of customer personal information as their number one priority, according to the 2020 Global Encryption Trends Study from the Ponemon Institute.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20200407005297/en/

The Ponemon Institute has collaborated with nCipher Security, an Entrust Datacard company and world leader in hardware security modules (HSMs), on this multinational survey of how and why organizations deploy encryption, now in its fifteenth year.

Threats, drivers and priorities

For the first time, protecting consumer personal information is the top driver for deploying encryption (54% of respondents), outranking compliance, which ranked fourth (47%). Traditionally compliance with regulations was the top driver for deploying encryption, but has dropped in priority since 2017, indicating that encryption is transitioning from a requirement to a proactive choice to safeguard critical information.

Employee mistakes continue to be the biggest threat to sensitive data (54%) and significantly outweigh concerns over attacks by hackers (29%), or malicious insiders (20%). In contrast, the least significant threats cited include government eavesdropping (11%) and lawful data requests (12%).

Data discovery the number one challenge

With the proliferation of data from digital initiatives, cloud use, mobility, IoT devices and the advent of 5G networks, data discovery continues to be the biggest challenge in planning and executing a data encryption strategy, with 67% of respondents citing this as their top concern. And that is likely to increase, with a pandemic-driven surge in employees working remotely, using data at home, creating extra copies on personal devices and cloud storage.

Blockchain, quantum and adoption of new encryption technologies

The study indicates that 48% of organizations have adopted encryption strategies across their enterprises, up from 45% in 2019. With encryption deployment steadily growing, how are organizations looking ahead? In the near term, 60% of organizations plan to use blockchain, with cryptocurrency/wallets, asset transactions, identity, supply chain and smart contracts cited at the top use cases.

Other much-hyped technologies are not on IT organizations near-term radar. Most IT professionals see the mainstream adoption of multi-party computation at least five years away, with mainstream adoption of homomorphic encryption more than six years away, and quantum resistant algorithms over eight years out.

Trust, integrity, control

The use of hardware security modules (HSMs) continues to grow, with 48% of respondents deploying HSMs to provide a hardened, tamper-resistant environment with higher levels of trust, integrity and control for both data and applications. Organizations in Germany, the United States and Middle East are more likely to deploy HSMs, with Australia, Germany and the United States most likely to assign importance to HSMs as part of their organizations encryption or key management activities.

HSM usage is no longer limited to traditional use cases such as public key infrastructure (PKI), databases, application and network encryption (TLS/SSL). The demand for trusted encryption for new digital initiatives has driven significant HSM growth for big data encryption (up 17%) code signing (up 12%), IoT root of trust (up 10%) and document signing (up 7%). Additionally, 35% of respondents report using HSMs to secure access to public cloud applications.

The race to the cloud

Eighty-three percent of respondents report transferring sensitive data to the cloud, or planning to do so within the next 12 to 24 months, with organizations in the United States, Brazil, Germany, India and South Korea doing so most frequently.

In the next 12 months, respondents predict a significant increase in the ownership and operation of HSMs to generate and manage Bring Your Own Key (BYOK), and integration with a Cloud Access Security Broker (CASB) to manage keys and cryptographic operations. The survey found that the most important cloud encryption features are:

Story continues

"Consumers expect brands to keep their data safe from breaches and have their best interests at heart. The survey found that IT leaders are taking this seriously, with protection of consumer data cited as the top driver of encryption growth for the first time," says Dr Larry Ponemon, chairman and founder of Ponemon Institute. "Encryption use is at an all-time high with 48% of respondents this year saying their organization has an overall encryption plan applied consistently across the entire enterprise, and a further 39% having a limited plan or strategy applied to certain application and data types."

"As the world goes digital, the impact of the global pandemic highlights how security and identity have become critical for organizations and individuals both at work and at home," says John Grimm vice president of strategy at nCipher Security. "Organizations are under relentless pressure to deliver high security and seamless access protecting their customer data, business critical information and applications while ensuring business continuity. nCipher empowers customers by providing a high assurance security foundation that ensures the integrity and trustworthiness of their data, applications and intellectual property."

Other key trends include:

Download the 2020 Global Encryption Trends Study here.

2020 Global Encryption Trends Study methodology

The 2020 Global Encryption Trends Study, based on research by the Ponemon Institute, captures how organizations around the world are dealing with compliance, increased threats, and the implementation of encryption to protect their business critical information and applications. 6,457 IT professionals were surveyed across multiple industry sectors in 17 countries/regions: Australia, Brazil, France, Germany, India, Japan, Hong Kong, Mexico, the Middle East (which is a combination of respondents located in Saudi Arabia and the United Arab Emirates), the Russian Federation, Southeast Asia (Indonesia, Malaysia, Philippines, Thailand, and Vietnam), South Korea, Taiwan, the United Kingdom, the United States and two new regions for the first time, Netherlands and Sweden.

About nCipher Security

nCipher Security, an Entrust Datacard company, is a leader in the general-purpose hardware security module (HSM) market, empowering world-leading organizations by delivering trust, integrity and control to their business-critical information and applications. Todays fast-moving digital environment enhances customer satisfaction, gives competitive advantage and improves operational efficiency it also multiplies the security risks. Our cryptographic solutions secure emerging technologies such as cloud, IoT, blockchain, and digital payments and help meet new compliance mandates. We do this using our same proven technology that global organizations depend on today to protect against threats to their sensitive data, network communications and enterprise infrastructure. We deliver trust for your business-critical applications, ensure the integrity of your data and put you in complete control today, tomorrow, always. http://www.ncipher.com

Follow us on LinkedIn, Twitter, Facebook and Instagram search nCipherSecurity.

View source version on businesswire.com: https://www.businesswire.com/news/home/20200407005297/en/

Contacts

nCipher Security Liz Harris liz.harris@ncipher.com +44 7973 973648

View post:
Customer Personal Information Is the Number One Data Protection Priority nCipher 2020 Global Encryption Trends Study - Yahoo Finance

Zoom’s Flawed Encryption Linked to China – The Intercept

Meetings on Zoom, the increasingly popular video conferencing service, are encrypted using an algorithm with serious, well-known weaknesses, and sometimes using keys issued by servers in China, even when meeting participants are all in North America, according to researchers at the University of Toronto.

The researchers also found that Zoom protects video and audio content using a home-grown encryption scheme, that there is a vulnerability in Zooms waiting room feature, and that Zoom appears to have at least 700 employees in China spread across three subsidiaries. They conclude, in a report for the universitys Citizen Lab widely followed in information security circles that Zooms service is not suited for secrets and that it may be legally obligated to disclose encryption keys to Chinese authorities and responsive to pressure from them.

Zoom could not be reached for comment.

Earlier this week, The Intercept reported that Zoom was misleading users in its claim to support end-to-end encryption, in which no one but participants can decrypt a conversation. Zooms Chief Product Officer Oded Gal later wrote a blog post in which he apologized on behalf of the company for the confusion we have caused by incorrectly suggesting that Zoom meetings were capable of using end-to-end encryption. The post went on to detail what encryption the company does use.

Diagram of how Zoom meetings work.

Zoom

Based on a reading of that blog post and Citizen Labs research, here is how Zoom meetings appear to work:

When you start a Zoom meeting, the Zoom software running your device fetches a key with which to encrypt audio and video. This key comes from Zooms cloud infrastructure, which contains servers around the world. Specifically, it comes from a type of server known as a key management system, which generates encryption keys and distributes them to meeting participants. Each user gets the same, shared key as they join the meeting. It is transmitted to the Zoom software on their devices from the key management system using yet another encryption system, TLS, the same technology used in the https protocol that protects websites.

Depending on how the meeting is set up, some servers in Zooms cloud called connectors may also get a copy of this key. For example, if someone calls in on the phone, theyre actually calling a Zoom Telephony Connector server, which gets sent a copy of the key.

Some of the key management systems 5 out of 73, in a Citizen Lab scan seem to be located in China, with therest in the United States. Interestingly, the Chinese servers are at least sometimes used for Zoom chats that have no nexus in China. The two Citizen Lab researchers who authored the report, Bill Marczak and John Scott-Railton, live in the United States and Canada. During a test call between the two, the shared meeting encryption key was sent to one of the participants over TLS from a Zoom server apparently located in Beijing, according to the report.

The report points out that Zoom may be legally obligated to share encryption keys with Chinese authorities if the keys are generated on a key management server hosted in China. If the Chinese authorities or any other hypothetical attacker with access to a key wants to spy on a Zoom meeting, they also need to either monitor the internet access of a participant in the meeting, or monitor the network inside the Zoom cloud. Once they collect the encrypted meeting traffic, they can use the key to decrypt it and recover the video and audio.

Citizen Lab flagged as worrisome not only the system used to distribute Zoom encryption keys but also the keys themselves and the way they are used to encrypt data.

Zooms keys conform to the widely used Advanced Encryption Standard, or AES. A security white paper from the company claims that Zoom meetings are protected using 256-bit AES keys, but the Citizen Lab researchers confirmed the keys in use are actually only 128-bit. Such keys are still considered secure today, but over the last decade many companies have been moving to 256-bit keys instead.

Furthermore, Zoom encrypts and decrypts withAES usingan algorithm calledElectronic Codebook, or ECB, mode, which is well-understood to be a bad idea, because this mode of encryption preserves patterns in the input, according to the Citizen Lab researchers. In fact, ECB is considered the worst of AESs available modes.

Heres why: It should be impossible to tell the difference between properly encrypted data and completely random data, such as static on a radio, but ECB mode fails to do this. If theres a pattern in the unencrypted data, the same pattern shows up in the encrypted data. This Wikipedia page has a useful illustration to visualize this:

Patterns appearing in data encrypted with AES in ECB mode.

Wikipedia

Once it has been poorly encrypted in this manner, video and audio data is distributed to all participants in a meeting through a Zoom Multimedia Router server. For most users, this server runs in Zooms cloud, but customers can choose to host this part on-premises. In this case, Zoom will generate, and thus have access to, the AES key that encrypts the meeting but shouldnt have access to the meeting content itself, so long as none of the aforementioned connector servers (for phone calls and so forth) are participating in the meeting. (In its blog post, Zoom said self-hosting customers will eventually be able to manage their own encryption keys.)

Meeting hosts can settheir meetings to have virtual waiting rooms, making it so that users do not directly enter the meeting when they log on with Zoom but instead must wait to be invited in by a participant. The Citizen Lab researchers discovered a security vulnerability with this feature while conducting their encryption analysis. They said in their report that they have disclosed the vulnerability to Zoom but that we are not currently providing public information about the issue to prevent it from being abused. In the meantime, the researchers advised Zoom users who desire confidentiality to avoid using waiting rooms and instead set passwords on meetings.

The newly uncovered flaws in Zooms encryption may be troubling for many of the companys customers. Since the coronavirus outbreak started, Zooms customer base has surged from 10 million users to 200 million, including over 90,000 schools across 20 countries, according to a blog post by Zoom CEO Eric Yuan. The U.S. government recently spent $1.3 million on Zoom contracts as part of its response to the pandemic, according to a review of government contracts by Forbes, and the U.K. government has been using Zoom for remote Cabinet meetings, according to a tweet from Prime Minister Boris Johnson.

Among those who should be concerned about Zooms security issues, according to Citizen Lab, are governments worried about espionage and businesses concerned about cybercrime and industrial espionage.

Despite a recent flood of security and privacy failures, Yuan, Zooms CEO, appears to be listening to feedback and making a real effort to improve the service. These new, mostly consumer use cases have helped us uncover unforeseen issues with our platform. Dedicated journalists and security researchers have also helped to identify pre-existing ones, Yuan wrote in his blog post. We appreciate the scrutiny and questions we have been getting about how the service works, about our infrastructure and capacity, and about our privacy and security policies.

In addition to promptly fixing several security issues that were reported, the company removed an attendee attention tracker feature, a privacy nightmare which let meeting hosts track whether participants had the Zoom window or some other apps window in focus during a meeting. It has also invested in new training materials to teach users about the security features like setting passwords on meetings to avoid Zoom-bombing, the phenomenon where people disrupt unprotected Zoom meetings.

Because Zooms service is not end-to-end encrypted, and the company has access to all encryption keys and to all video and audio content traversing its cloud, its possible that governments around the world could be compelling the company to hand over copies of this data. If Zoom does help governments spy on its users, the company claims that it hasnt built tools specifically to help law enforcement: Zoom has never built a mechanism to decrypt live meetings for lawful intercept purposes, Gal, Zooms chief product officer, wrote in the technical blog post, nor do we have means to insert our employees or others into meetings without being reflected in the participant list.

Unlike some other tech companies, Zoom has never released any information about how many government requests for data it gets, and how many of those requests it complies with. But after the human rights group Access Nows open letter urging Zoom to publish a transparency report, Yuan also promised to do just that. Within the next three months, the company will prepare a transparency report that details information related to requests for data, records, or content. Access Now has commended Zoom on committing to publish a transparency report.

Read this article:
Zoom's Flawed Encryption Linked to China - The Intercept

This startup is going back to basics to strengthen encryption – Livemint

Ahack is no longer just about exposing a bank account or somebodys photos. There can be far scarier fallouts. Satellite systems can be hacked to spoof GPS signals, for example, and send drones to the wrong destination or hijack oil tankers.

Time was when randomly generated binary number sequences were good enough for symmetric encryption of streaming data. But in todays world of grid and cloud computing, those are can be cracked easily, says Jay Hotti, co-founder and CEO of cybersecurity startup Byneri, based in Bengaluru and Singapore.

Encryption tries to stay one up on hackers by adding algorithmic layers of security on top of the binary sequences. The data encryption standard was adopted in 1977 and superseded by the advanced encryption standard in 2001. RC4 was a secret cipher until it got leaked.

Another algorithm is Blowfish which has been superseded by Twofish. They use different mechanisms to add security, but each introduces new challenges and vulnerabilities, explains Hotti. The more steps you introduce in any encryption, the more potential weaknesses you expose. And you never know what you dont know until somebody hits that, which happens now and then."

Layers of complexity

Byneri goes to a more fundamental level of strengthening the underlying binary sequences. The mathematics to generate such sequences was developed in the late 1960s and early seventies by US DARPA (Defence Advanced Research Projects Agency). Later, when the internet exploded at the turn of the millennium, asymmetric encryption arrived, using prime numbers where a public key is used to encrypt a message and a private key to decrypt it.

Asymmetric encryption is mainly used for identification and authentication. But most online systems, such as payments, still depend on symmetric encryption where one key is used for both encryption and decryption. Thats because asymmetric encryption would become unwieldy with large amounts of data.

This brings us to Byneris innovation, which goes to the roots of symmetric encryption. We can generate binary sequences whose linear complexity is many orders of magnitude more than the existing ones. And were able to do this very fast," says Hotti.

The linear complexity determines the strength of an encryption key," adds angel investor P.G. Ponnapa, who is working with Byneri. A 1024-bit key can be cracked with 10 to the power of six permutations. The Byneri way raises that to 10 to the power of 154 permutations."

One of its early testers is a company making receivers for low earth orbit (LEO) satellites, typically used for applications involving GPS. The overcrowding in space means these receivers have to distinguish between the many satellites in their view. To do this, they needed a large number of binary sequences which couldnt have been done with their existing system," says Hotti.

Going to market with such a highly technical black box product is a challenge. Ponnapa experienced this himself when he first heard the idea of Byneri. I have known Jay 35 years. We were in college together (NIT Surathkal). When he told me he had cracked this, I met him for dinner. Two hours later, I had understood nothing," says Ponnapa with a smile. He met Hotti again the next day with more specific questions, and the penny dropped.

Hottis involvement with cryptography goes back to his work with payment systems. He worked on Thailands national payment system and implemented Indias first payment network, Swadhan for the Indian Banks Association in the nineties. That was the basis of how shared ATM networks started in India," says Hotti, who was also CTO of Singapores payment gateway and merchant payment network NETS.

Multiple uses

Hottis co-founder is Professor Mahalinga V Mandi of the Ambedkar Institute of Technology in Bengaluru, who was researching the application of binary sequences in satellite communication and navigation. He was initially sceptical when Hotti suggested it could also be applied in banking and other industries. I kept pestering him and we ended up making a matrix of implementations in 14 industry types."

It took them two-and-a-half years to develop the product and test it. Then we went to a space company last year. They tried it on heterogeneous systems and it worked. Thats when we decided to raise some money. Until then it was funded by our own money."

Byneri has also been talking to a tech company that provides solutions to space companies. The order confirmation came last month, just before the country went into a lockdown.

Sumit Chakraberty is a Consulting Editor with Mint. Write to him at chakraberty@gmail.com

See the rest here:
This startup is going back to basics to strengthen encryption - Livemint