The release of Kubernetes version 1.18 comes at an interesting time, to say the least. The Kubernetes release team has done an amazing job of pushing out the new version despite all the turmoil and uncertainty caused by the spread of COVID-19, which impacts the global Kubernetes developer community members like everyone else.

The release features a number of new enhancements and changes. New and maturing features include enhanced security options, improved support for Windows, multiple extensions to the Container Storage Interface, and more. We will cover a few of these changes and enhancement highlights.

Version 1.18 includes several backwards-incompatible changes that users and developers need to know about before upgrading.

kubectl no longer defaults to using http://localhost:8080 for the Kubernetes API server endpoint, to encourage using secure, HTTPS connections. Users must explicitly set their cluster endpoint now.

Cluster administrators can choose to use a third-party Key Management Service (KMS) provider as one option for encrypting Kubernetes secrets at rest in the etcd data store backing the cluster. The KMS provider uses envelope encryption, which uses a data encryption key (DEK) to encrypt the secrets. Kubernetes stores a KMS-encrypted copy of the DEK locally. When the kube-apiserver needs to encrypt or decrypt a Secret object, it sends the DEK to the KMS provider for decryption. Kubernetes does not persist the decrypted DEK to storage.

Release 1.18 makes several changes to the KMS provider interface used for EncryptionConfiguration resources. The CacheSize field no longer accepts 0 as a valid value; the CacheSize type changes from int32 to *int32; and validation of the Unix domain socket for the KMS provider endpoint now happens when the EncryptionConfiguration is loaded.

Weve compiled a checklist to help ensure your K8s clusters are production-ready for security, stability, and scale.

Download Today

To simplify the configuration and security of Kubernetes API calls that involve streaming connections to containers, this change deprecates two streaming configurations.

Kubernetes persistent volumes default to giving containers in a pod access to the volume by mounting the filesystem, a suitable method for the majority of applications and use cases. However, some applications require direct access to the storage block device, notably certain databases that use their own storage format for increased performance.

This enhancement allows users to request a persistent volume as a block device where supported by the CSI and underlying storage provider. In the corresponding pods container specification, users can set the device path which the containers application can use to access the block device.

The horizontal pod autoscaling (HPA) API allows users to configure the automatic addition and removal of pods in a replica set based on various metric values. This enhancement adds an optional behavior field to the HorizontalPodAutoscaler resource type. Users can set the scale-up and scale-down rates, enabling them to customize the HPA behavior for different applications. For example, an application like a web server which sometimes gets sudden spikes in traffic may require adding new pods very quickly.

Because web servers are generally stateless, pods could also be removed quickly when the traffic subsides. On the other hand, users may want to slow the scale-down for deployments with a higher initialization overhead, e.g., containers running Java.

Cloud providers and many on-premises environments offer multiple zones or other topological divisions that provide redundancy in case of a localized failure. For applications to benefit from the independent availability of multiple failure zones, replicas need to be deployed to multiple zones. However, the default Kubernetes scheduler had no awareness or options for spreading a replica sets pods across zones.

This feature adds an optional topologySpreadConstraints field to the pod specification. Users can select node labels to use for identifying these domains and configure the tolerance and evenness for replica placement.

Currently, Secret and ConfigMap objects mounted in a container periodically get updated with the new object value if the associated Kubernetes resource gets changed. In most cases, that behavior is desirable. Pods do not need to be restarted to see the new value, and if a workload only needs the startup value, it can read it once and ignore future changes.

Some use cases may benefit from preserving the secret or config map data as it was at the pods start time. Making the data available in the mounted volume immutable protects applications from potential errors in updates to the underlying Kubernetes object. It also reduces the load on the kubelet and the kubeapi-server, because the kubelet no longer has to poll the Kubernetes API for changes for immutable objects.

This change adds the optional ability to make Secret and ConfigMap objects immutable through the new immutable field in their specifications. A resource created as immutable can no longer be updated, except for metadata fields. Users will need to delete an existing resource and recreate it with new data to make changes. If users do replace an object with new values, they will need to replace all running pods using those mounts, because existing pods will not get updates for the new data.

The ability to create a persistent volume cloned with the data from an existing persistent volume claim as source graduates to generally available. This feature is supported only via the Container Storage Interface, not in in-tree drivers. In addition, the back-end storage provider and the CSI plugin in use must support creating a volume from an existing volumes image. Specify a dataSource in a PersistentVolumeClaim to clone from an existing PVC.

Note that the exact method of cloning depends on the storage provider. Some providers may not support cloning mounted volumes or volumes attached to a virtual machine. In addition, cloning active volumes creates the possibility of data corruption in the copy.

Currently, the kube-apiserver in most Kubernetes clusters uses one of two methods to connect to nodes, pods, and service endpoints in the cluster. In most cases, the server makes a direct connection to the target, but this ability requires a flat network with no overlap between the IP CIDR blocks of the control plane, the nodes, and the clusters pod and service network.

The other method, largely used only in Google Kubernetes Engine, creates SSH tunnels from the control plane network to the cluster. The reliability and security of the SSH tunnel method have not held up well. SSH tunnel support in Kubernetes has been deprecated and will be removed altogether in the future.

As a replacement, this feature creates an extensible TCP proxy system for connections from the control plane to endpoints in the cluster. It uses the new Konnectivity service, with a server component in the control plane network and clients deployed as a DaemonSet on the cluster nodes. This architecture simplifies the API servers code base, as well as opening up the possibility of using a VPN to secure and monitor traffic between the control plane and the nodes and offering other opportunities for customization.

We just covered a handful of the enhancements in the 1.18 release, focusing on new features that may be extremely useful to some users and others which highlight the ongoing work to improve the security posture of Kubernetes and to address the complexity of the code base, which had created issues and questions during last years audit. Check out the (soon to be published) official release notes for a complete list of changes. Also, in case you missed it, you can find a great interactive tool for searching Kubernetes release notes at https://relnotes.k8s.io/.

View original post here:
Whats New in Kubernetes 1.18? Enhancements and Feature Updates - Security Boulevard

Apart from the obvious health and economic impacts, the coronavirus also presents a major opportunity for cybercriminals.

As staff across sectors and university students shift to working and studying from home, large organisations are at increased risk of being targeted. With defences down, companies should go the extra mile to protect their business networks and employees at such a precarious time.

Reports suggest hackers are already exploiting remote workers, luring them into online scams masquerading as important information related to the pandemic.

On Friday, the Australian Competition and Consumer Commissions Scamwatch reported that since January 1 it had received 94 reports of coronavirus-related scams, and this figure could rise.

As COVID-19 causes a spike in telework, teleheath and online education, cybercriminals have fewer hurdles to jump in gaining access to networks.

The National Broadband Networks infrastructure has afforded many Australians access to higher-speed internet, compared with DSL connections. Unfortunately this also gives cybercriminals high-speed access to Australian homes, letting them rapidly extract personal and financial details from victims.

The shift to working from home means many people are using home computers, instead of more secure corporate-supplied devices. This provides criminals relatively easy access to corporate documents, trade secrets and financial information.

Read more: What's your IT department's role in preventing a data breach?

Instead of attacking a corporations network, which would likely be secured with advanced cybersecurity countermeasures and tracking, they now simply have to locate and attack the employees home network. This means less chance of discovery.

Cryptolocker-based attacks are an advanced cyberattack that can bypass many traditional countermeasures, including antivirus software. This is because theyre designed and built by advanced cybercriminals.

Most infections from a cryptolocker virus happen when people open unknown attachments, sent in malicious emails.

In some cases, the attack can be traced to nation state actors. One example is the infamous WannaCry cyberattack, which deployed malware (software designed to cause harm) that encrypted computers in more than 150 countries. The hackers, supposedly from North Korea, demanded cryptocurrency in exchange for unlocking them.

If an employee working from home accidentally activates cryptolocker malware while browsing the internet or reading an email, this could first take out the home network, then spread to the corporate network, and to other attached home networks.

This can happen if their device is connected to the workplace network via a Virtual Private Network (VPN). This makes the home device an extension of the corporate network, and the virus can bypass any advanced barriers the corporate network may have.

Read more: Hackers are now targeting councils and governments, threatening to leak citizen data

If devices are attached to a network that has been infected and not completely cleaned, the contaminant can rapidly spread again and again. In fact, a single device that isnt cleaned properly can cause millions of dollars in damage. This happened during the 2016 Petya and NotPetya malware attack.

On the bright side, there are some steps organisations and employees can take to protect their digital assets from opportunistic criminal activity.

Encryption is a key weapon in this fight. This security method protects files and network communications by methodically scrambling the contents using an algorithm. The receiving party is given a key to unscramble, or decrypt, the information.

With remote work booming, encryption should be enabled for files on hard drives and USB sticks that contain sensitive information.

Enabling encryption on a Windows or Apple device is also simple. And dont forget to backup your encryption keys when prompted onto a USB drive, and store them in a safe place such as a locked cabinet, or off site.

A VPN should be used at all times when connected to WiFi, even at home. This tool helps mask your online activity and location, by routing outgoing and incoming data through a secure virtual tunnel between your computer and the VPN server.

Existing WiFi access protocols (WEP, WPA, WPA2) are insecure when being used to transmit sensitive data. Without a VPN, cybercriminals can more easily intercept and retrieve data.

VPN is already functional in Windows and Apple devices. Most reputable antivirus internet protection suites incorporate them.

Its also important that businesses and organisations encourage remote employees to use the best malware and antiviral protections on their home systems, even if this comes at the organisations expense.

People often backup their files on a home computer, personal phone or tablet. There is significant risk in doing this with corporate documents and sensitive digital files.

When working from home, sensitive material can be stored in a location unknown to the organisation. This could be a cloud location (such as iCloud, Google Cloud, or Dropbox), or via backup software the user owns or uses. Files stored in these locations may not protected under Australian laws.

Read more: How we can each fight cybercrime with smarter habits

Businesses choosing to save files on the cloud, on an external hard drive or on a home computer need to identify backup regimes that fit the risk profile of their business. Essentially, if you dont allow files to be saved on a computers hard drive at work, and use the cloud exclusively, the same level of protection should apply when working from home.

Appropriate backups must observed by all remote workers, along with standard cybersecurity measures such as firewall, encryption, VPN and antivirus software. Only then can we rely on some level of protection at a time when cybercriminals are desperate to profit.

See original here:
'Click for urgent coronavirus update': how working from home may be exposing us to cybercrime - The Conversation AU

Working From Home Creates New Security Concerns for Companies

The global pandemic caused by the novel coronavirus is changing work environments to an unprecedented degree. More employees than ever are being asked to work remotely from home. Along with the new work practices comes a variety of security challenges.Without the proper precautions, working from home could become a cybersecurity nightmare, says Purdue University professor Marcus Rogers. Criminals will use the crisis to scam people for money, account information and more, he says. With more people working from home, people need to make sure they are practicing good cybersecurity hygiene, just like they would at work. There is also a big risk that infrastructures will become overwhelmed, resulting in communication outages, both internet and cell.Covid-19 concernsConcerns about the coronavirus have increased the business worlds dependence on teleworking. According to Cisco Systems, WebEx meeting traffic connecting Chinese users to global workplaces has increased by a factor of 22 since the outbreak began. Traffic in other countries is up 400% or more, and specialist video conferencing businesses have seen a near doubling in share value (as the rest of the stock market shrinks).Basic email security has remained unchanged for 30 yearsEmail is a core element of business communications, yet basic email security has remained unchanged for 30 years. Many smaller businesses are likely to still be using outdated Simple Mail Transfer Protocol (SMTP) when sending and receiving email. The default state of all email services is unencrypted, unsecure and open to attack, putting crucial information at risk, says Paul Holland, CEO of secure email systems provider Beyond Encryption.With remote working a likely outcome for many of us in the coming weeks, the security and reliability of our electronic communication will be a high priority, says Holland. The companys Mailock system allows employees to work from any device at home or in the office without concerns about data compromise or cybersecurity issues.Acting quickly and effectivelyAs the virus spreads, businesses and organizations will need to act quickly to establish relevant communication with their employees, partners and customers surrounding key coronavirus messages, says Heinan Landa, CEO and Founder of IT services firm Optimal Networks. Employers should also enact proper security training to make sure everyone is up to speed with whats happening and can report any suspicious online activity.Reviewing and updating telework policies to allow people to work from home will also provide flexibility for medical care for employees and their families as needed.Scammers, phishing, and fraudAn additional factor in the confusing environment created by the coronavirus is growth in phishing emails and creation of domains for fraud. Phishing is an attempt to fraudulently obtain sensitive information such as passwords or credit card information by disguising oneself as a trusted entity. Landa says homebound workers should understand that phishing can come from a text, a phone call, or an email. Be wary of any form of communication that requires you to click on a link, download an attachment, or provide any kind of personal information, says Landa.Homebound workers should understand that phishing can come from a text, a phone call, or an emailEmail scammers often try to elicit a sense of fear and urgency in their victims emotions that are more common in the climate of a global pandemic. Attackers may disseminate malicious links and PDFs that claim to contain information on how to protect oneself from the spread of the disease, says Landa.Ron Culler, Senior Director of Technology and Solutions at ADT Cybersecurity, offers some cyber and home security tips for remote workers and their employers:When working from home, workers should treat their home security just as they would if working from the office. This includes arming their home security system and leveraging smart home devices such as outdoor and doorbell cameras and motion detectors. More than 88% of burglaries happen in residential areas.When possible, its best to use work laptops instead of personal equipment, which may not have adequate antivirus software and monitoring systems in place. Workers should adhere to corporate-approved protocols, hardware and software, from firewalls to VPNs.Keep data on corporate systems and channels, whether its over email or in the cloud. The cyber-protections that employees depended on in the office might not carry over to an at-home work environment.Schedule more video conferences to keep communication flowing in a controlled, private environment.Avoid public WiFi networks, which are not secure and run the risk of remote eavesdropping and hacking by third parties.In addition to work-from-home strategies, companies should consider ways to ensure business cyber-resilience and continuity, says Tim Rawlins, Director and Senior Adviser for risk mitigation firm NCC Group. Given that cyber-resilience always relies on people, process and technology, you really need to consider these three elements, he says. And your plan will need to be adaptable as the situation can change very quickly.Employees and their employersSelf-isolation and enforced quarantine can impact both office staff and business travelersSelf-isolation and enforced quarantine can impact both office staff and business travelers, and the situation can change rapidly as the virus spreads, says Rawlins.Employees should be cautious about being overseen or overheard outside of work environments when working on sensitive matters. The physical security of a laptop or other equipment is paramount. Its also important to look at how material is going to be backed up if its not connected to the office network while working offline, says Rawlins.Its also a good time to test the internal contact plan or call tree to ensure messages get through to everyone at the right time, he adds.

Original post:
Beyond Encryption Tests Its Remote Working Policy In Face Of Covid19 | Security News - SecurityInformed

AUCKLAND, New Zealand, March 24, 2020 /PRNewswire/ -- MEGA The Privacy Company announced today that free 12 month PRO subscriptions would be available to teachers and students of verified educational institutions.

Stephen Hall, Executive Chairman of MEGA, said, "The encrypted cloud storage and chat provided by MEGA provides an excellent basis for continued teacher-student interaction, allowing effective remote learning."

Many educational institutions have closed in order to limit the spread of Covid-19. MEGA's platform provides the ideal features to allow students to continue their studies by connecting to teachers and teaching resources.

Recently a private school in Portugal quickly and easily shared folders to nearly 2,000 accounts, facilitating their remote learning activities.

MEGA is now offering all educational institutions free PRO accounts for all their teachers and students. This will allow them to

MEGA is available in Arabic, Chinese (Traditional and Simplified), Dutch, English, French, German, Indonesian, Italian, Japanese, Korean, Polish, Portuguese, Romanian, Russian, Spanish, Tagalog, Thai, Turkish, Ukrainian and Vietnamese.

Educational Institutions should apply to education@mega.nz

After verification of their status, MEGA will provide vouchers, or automatic upgrade for the verified domain, to give all their accounts free PRO status for 12 months, which provides 400 GB of file storage and 1 TB of transfer quota for every account.

*Note: The number of participants in multi-party chats depends on the quality of each user's internet connection. We recommend a maximum of 6 for full multi-party video.

An IT professional working for a Portuguese private school reported to MEGA:

"I'm writing this e-mail to compliment your service. I've created a free account last Friday to help teachers, parents and students to be able to share work while we are all at home because of the covid-19 pandemic. I've shared folders to almost 2,000 users and I must say it's impressive how Mega holds it together, it works flawlessly and every single person that created an account after I sent the invitations are very impressed. I'm here to congratulate you all on an amazing platform, the best I used so far and free. Keep up the excellent job and keep safe. Best regards from Portugal."

Store securely. Chat securely. See - https://mega.nz/pro

About MEGA

MEGA's end-to-end encrypted cloud storage and chat service has stored more than 72 billion files for over 170 million users in 250 countries / territories.

MEGA is accessible in multiple languages from desktop (Windows, macOS and Linux) and Android / iOS mobile apps.

User files are stored in secure facilities in Europe or in countries (such as New Zealand) that the European Commission has determined to have an adequate level of protection under Article 45 of the GDPR, depending where the user is based. No user files are stored in, or made available from, the United States of America.

MEGA The Privacy Companywas architected around the simple fact that cryptography, for it to be accepted and used, must not interfere with usability. MEGA is accessible without prior software installs and remains the only cloud storage provider with browser-based high-performance end-to-end encryption. Today, millions of business and personal users rely on MEGA to securely and reliably store and serve petabytes of data. We believe that this success is the result of MEGA's low barrier to entry to a more secure cloud.

Logo - https://photos.prnasia.com/prnh/20191219/2676241-1LOGO

SOURCE Mega Limited

Continue reading here:
MEGA Helps Education During Covid-19 with Free PRO Accounts for Teachers and Students - Yahoo Finance

From the 1930s to 1950s (far too long) the medical community just would not wake up to the fact that cigarettes could cause harm (see More Doctors Smoke Camels). Why did they stick with this misperception for so long? When so many good people come to the wrong conclusion it probably means some deeply human cognitive biases are at play. Most people have a long studied desire to prefer the status quo. If this is what was always thought, why think differently?

They are not the only groups of humans to stay anchored to old ways. For years nutritionists believed that all calories in food are the same, including all forms of sugar. This led to the conclusion that we might want to watch calories overall but sugar is great. Now that obesity is an epidemic and diabetes the fastest growing disease in the world, most professionals realize that too much sugar is bad. But even after it was discovered that Harvard medical researchers were paid to lie in studies about sugar, humanity is still almost totally ignoring this topic. Clearly there are cognitive bias issues here too.

The technology community is not immune to getting stuck with an opinion and not wanting to shift, even in the face of evidence. One of the big ones is that you need to use a personal VPN.

In 2010 it was good advice to recommend a VPN for personal use. But in my view, any technologist or security professional recommending that now should be ashamed for not keeping up with the enormous changes in technology over the last decade.

The rest of this post will dive a little deeper into the topic.

To summarize up front: For almost every use case, the only reason to use a VPN is if you are using one provided by a business that requires you to use it to access corporate resources. You do not need a VPN for your home or small business use, even when using public WiFi. Personal VPNs just dont add value to your security posture.

A sponsored piece at CNN says A VPN is vital when working from home. This piece, written in the form of a CNN article but apparently paid for by a VPN provider, claims that data that flows from your computer to the Internet is open and accessible to anyone who can intercept it (this statement is false). They also say that without a VPN, anyone with the right tools can intercept passwords, banking information and everything else you transmit (this is also a false statement).

CNET tells us that Anyone who wants to protect their privacy and security online should use a VPN. This myth is all over the place, especially on sites where companies that provide personal VPN services advertise.

Gizmodo asserts that: The benefits of virtual private networks, or VPNs, are well-documented: They keep you safer on public wi-fi This may have been true in 2010, but the technology of the Internet changed when Gizmodo wasnt watching.

Norton explains that: The encryption and anonymity that a VPN provides helps protect your online activities: sending emails, shopping online, or paying bills. Another 10 year old view.

The highly trusted Consumer Reports claims that Just about all security experts agree that using a VPN, or virtual private network, when youre accessing the internet via computer or phone is a good idea. In particular, a VPN is one of the easiest ways to avoid getting hacked while youre taking advantage of the free WiFi at an airport or library. (This is also a false statement. Additionally, saying Just about all security experts agree reminds me of More doctors smoke Camels.)

An Attorney with the Federal Trade Commission discussing VPNs asserts that: Public networks are not very secure or, well, private which makes it easy for others to intercept your data. This was once very true. But not quite right anymore.

You do not need to use a VPN if you are just trying to secure your personal Internet communications. If you have a well patched operating system and up to date applications, they already establish encrypted communications. This is just the way the Internet and computers work now.

VPN companies would gladly sell you a VPN even if you dont need one, but that may well just introduce more risk. And it does so while slowing your Internet connection and costing you money.

A decade ago having a VPN for your personal use was good advice. A savvy technologist could join a public WiFi network and capture packets and read information from other users, including logins, passwords, or even financial information, depending on what people were doing on the WiFi. Soon as a way of showing how this could be done was coded into a browser plugin called FireSheep. The author of this plugin, Eric Butler, did a great service for WiFi security. By showing these vulnerabilities he motivated significant changes.

Other attacks possible in the old days included ways to trick your browser into thinking an attacker is the ultimate destination. The attacker sits in the middle of comms between the user and the ultimate destination and breaks the encryption and replaces it with his own. This is a man-in-the-middle attack.

In part due to problems of unencrypted traffic and man-in-the-middle attacks, the technology of the Internet and devices and applications have changed pretty significantly.Changes in the way the Internet and our systems work include:

So, today Almost all web traffic is now encrypted. And ifan attacker tries a man in the middle attack against your web browsing session you will get a warning and the comms will stop. The warning varies from Chrome to Safari to FireFox but all now prevent this type of attack by checking to see if the certificate that set up the HTTPs encryption matches the correct version maintained in trusted stores online.

Here is what you will see if an attacker is on your public WiFi and tries a Man in the Middle Attack:

VPNs come with their own risk. There are risks that the VPN company you have picked are not protecting your traffic the way the promised. There are risks that they are logging your info in ways they claim they are not. If you think you are using a VPN to protect yourself from government surveillance, they may actually be making it easier on the government to surveil you. (the EFF provides many great references on some of the issues with VPNs, including here and here).

Nothing is ever perfectly safe (this is about managing risk). But since modern applications set up encrypted channels already, we are at the point where personal VPNs do not seem to add anything that reduces real risk.

As previously mentioned, there are reasons for companies to require a VPN for remote employees. This type of VPN can be used to help companies ensure governance over their data and ensure only authorized users are accessing corporate resources. These also help companies that want to search traffic for malicious code. This corporate VPN needs to be managed and updated of course (see recent CISA statement of corporate VPN vulnerabilities being exploited during the Coronavirus crisis). But in general it can be very smart for a corporation to use this method for access to corporate resources. There are new changes in the offing here too, and VPNs are not the answer to every corporate need (corporate technologists should be closely tracking developments in the software defined perimeter and zero trust worlds, including Googles Beyond Corp approach).

Many people recommend that journalists and activists and others operating overseas use a VPN, and there may be good reason to do this if operating in a hostile nation. However, the threat model there is very different. And in many cases, using a VPN there will just give a false sense of security. The hostile nation may well be reading all the VPN traffic and logs anyway. People in these situations need far more security than a VPN (including secure messaging systems).

Some people use VPNs so they can pretend to be using the Internet from a certain geography. This is certainly a good use case if you want to do that. But this does not add security.

But I have not seen any argument by a technologist familiar with how the Internet works today that says paying for a personal VPN makes sense for the average user or small business. It does nothing to improve your security or reduce risks in any meaningful way. In fact, it may actually introduce new risks.

How could it be that so many security professionals are out there right now advising people at home or small businesses to use a VPN? I can only imagine they have not kept up with how the architecture around them has been changing. And of course no VPN company is going to say they are not needed anymore. But the biggest reason is probably the same reason doctors promoted tobacco or we all thought sugar was ok. It is a bias towards the status quo by people who have not wanted to learn how the Internet has changed.

There are certainly many other important things to do to reduce risk.Chief among those things is using an up to date OS and up to date applications (see this list of tips to reduce personal risk and this list to reduce business risk).

And one final point: If the Chinese Ministry of State Security (MSS) or Russias Foreign Intelligence Service (SVR) wants to mount an effort against your Internet use, you have a different threat profile than most of us. But if you think a VPN will slow them down you are fooling yourself. If you need to mount a defense against them lets talk, we can help, but a VPN is not the thing that will save you from them.

Latest posts by Bob Gourley

Related

Originally posted here:
Think Twice Before Deciding To Use A Personal VPN: You could be getting some really bad advice - CTOvision

In the past 12 months there have been 480 million downloads of mobile VPN apps an increase of 50% on the previous year. Thats according to the 2019 Global Mobile VPN reportand it shows that consumers around the world are starting to understand the benefits of connecting to the internet via a virtual private network when outand about.

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

But what about businesses? Have you ever stopped to think whether your business ought to be providing a VPN service to remote workers, or taking advantage of one to protect your sensitive data? We talked to industry experts to find out whether your business needs a VPN.

Before we can address the question of whether your business needs its own VPN, you need to understand exactly what a VPN can do for you and what it cant.

Advertisement - Article continues below

The network encryption provided by a VPN provides a business with confidentiality your data cant be read in transit and integrity your data, messages and transactions cant be tampered with, explainsCharl van der Walt, chief security strategy officer at security services provider SecureData. VPN services achieve this by creating a virtual tunnel between a remote device and your corporate network, requiring strict user authentication and allowing you to enforce access control.

Advertisement - Article continues below

The benefits of this should be obvious. When employees need to provide additional credentials remotely, said Chris Hykin, technical services director at Stone Group, it reduces the chance of the system being accessed by third parties, and prevents flexible working becoming a compromise to security.

Thats not necessarily all your VPN will do.As most VPN products require the installation of a low-level agent on the endpoint, many products also extend into the broader domain ofendpoint and internet protection, providing features like content filtering and blocking malicious sites, addsvan der Walt.

Advertisement - Article continues below

Your company VPN can, therefore, be more than simply a network service: you can think of it as the foundation of secure communication between systems, people and sites. With remote working becoming an increasingly important aspect of the business environment, the value of that is clear.

This all sounds super, smashing and lovely, but there are certain misconceptions about VPNs to clear up. SecureDatas van der Walt told us that, as VPNs have gradually become a commodity, some people have lost sight of their actual capabilities.

VPNs are often seen by the enterprise as a catch-all system that offers everything from confidentiality to access control, he said. Products are frequently over-simplified when theyre sold and deployed; subtle points are overlooked, sometimes resulting in more harm than good.

One important thing to realise is that all of the features offered by a VPN work differently in different phases of the data journey from the endpoint itself onto to the internet, through the VPN gateway and onto the LAN. As an example, lets think about cloud-based VPN products, where the gateway is hosted by a provider somewhere in the cloud.

Advertisement - Article continues below

The confidential data passing through the tunnel terminates at a single point, managed by a third party, which makes it a highly attractive target for attack, compromise or lawful (or unlawful) interception, van der Walt pointsout. These thirdparties often store logs and authentication data in ways which arevulnerable to compromise, as we saw recently withthe breach of NordVPN.

Advertisement - Article continues below

Its also important to recognise that a VPN product can provide complex functionality on both the endpoint and the gateway, which increases the potential exposure to attacks.

Enterprise VPN products that integrate with a directory (like Microsoft Active Directory) are susceptible to phishing, credential reuse, credential stuffing and other forms of credential theft exposing critical internal systems directly to an attacker over the internet, warnsvan der Walt. Indeed, he mentioned that hed seen precisely this type of attack being used successfully, both by red teamers security experts who carry out simulated attacks to expose holes in a companys defences and by genuine bad guys. Its safest to assume that all VPN gateway technologies even from the biggest names will be aggressively targeted in the wild, and any vulnerabilities will be exploited mercilessly.

Advertisement - Article continues below

Another vital point is that, while VPN services may be integrated into broader security solutions, the secure tunnel itself doesnt do anything to detect, block or remove malware or other unwanted content.

If the data payload travelling overthe VPN is infected, saysRyanOrsi, director of product management at WatchGuard, the VPN will securely deliver it to the endpoint where it could run wild if the endpoint doesnt have proper malware protection.

Lastly, we need to talk about the encryption misconception. That may sound like an episode of The Big Bang Theory, but its actually even less funny indeed, the consequences to your business of getting this concept wrong could be pretty darn serious.

A VPN does not encrypt any data at rest, only in transit, explained PaulBischoff, a privacy advocate at Comparitech.com. If the VPN server is acting as a middleman between theuser and the internet, that users traffic is only encrypted up to the VPNserver. The traffic between the VPN server and the final destination a website, for example is not encrypted by the VPN. In other words, the VPN doesnt provide true end-to-end encryption, and if youre relying on a third-party provider they could theoretically be monitoring your traffic, or storing it in a form that could later be released under the weight of legal pressure.

Advertisement - Article continues below

Advertisement - Article continues below

Indeed, the possibility of data logging is more than just a theoretical threat: in certain countries, such as China, its required. In other words, insome territories, private networks are fundamentally compromised by design

Now weve got a grip on those issues, we can start to address the actual question: does your business really need its own VPN, or not?

If youre looking for a simple answer, its yes. As David Emm, principal security researcher at Kaspersky, told PC Pro: A VPN is a necessary part of a business cybersecurity strategy, as it helps ensure that the credentials used to access corporate systems and websites that require input from a login and password cant be intercepted. In a cybersecurity landscape thats dynamically evolving with new threats and vulnerabilities at every turn, it makes sense to embrace all theprotection you can get.

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

At this point you might be wondering whether that really applies to all businesses. What if you dont have any remote workers, and all your office computers are connected to a wired LAN thats managed by a competent IT services provider? In such a scenario, VPN services are admittedly less critical. The added layer of encryption is good, notesPaul Rosenthal, CEO and co-founder of Appstractor. But for many companies, I would consider putting a VPN on each workstation asicing on the cake rather than essential.

Advertisement - Article continues below

Even then, though, a VPN has benefits, as it ensures that your activities cant be snooped on, and cuts down the possible avenues for a data leak.

And things change as soon as you introduce Wi-Fi into the equation, as this greatly increases your exposure to possible attacks. Its very easy for hackers to either intercept your traffic or trick you to connect to a fake access point, where all kinds of attacks can be launched, potentially exposing confidential and sensitive data, Rosenthal remindesus. In his view its pretty much essential that every non-wired device used by every employee should use a VPN.

For home users, choosing a VPN provider largely boils down to simple metrics such as speed and price. As Rosenthal puts it, arguably there isnt a huge amount of difference between the main consumer VPN brands, in terms of the technical level of security they provide.

Advertisement - Article continues below

Advertisement - Article continues below

In a professional context, however, there are other issues to think about. Businesses face a fundamentally different challenge, Rosenthal says, making sure that every device used by every employee has the VPN not only installed, but also switched on and used properly.

This is a key reason why you shouldnt rely on a consumer VPN service for business security: the client software doesnt support central management. Look for a VPN thats designed for deployment in a business, advisesRosenthal, where installation and administration are simplified, and compliance can be enforced. Otherwise youre leaving huge gaps in your cybersecurity defences.

The other option is to operate your own VPN, which you might do eitherby installing or enabling services on your internal servers, or investing in a dedicated gateway appliance.

Either way, the self-hosted approach has the advantage of putting you fully in control of your own security and the use case really kicks in when your business has multiple locations requiring access to a central network. Indeed, the value of this sort of system is understood even in environments that are broadly unfriendly to VPN usage.

Advertisement - Article continues below

In many cases, even countries that block VPN usage will allow corporate entities access to one by requiring either a fee or the collection of data relating to how the VPN is used, explainsLarry Trowell, principal security consultant at Synopsys.

That said, there are scenarios where running your own VPN is an unnecessary investment. Trowell points out that if your workers arent actively collaborating on documents, and you just need to periodically exchange and synchronise data, a secure FTP or email server may be all thats needed.

If you have decided toset up your own VPN, you will need toconfront the question of how its configured. The simplest approach is to route all your traffic through the VPN tunnel, but this can have an impact onperformance. If youre forcing all your network traffic through the VPN tunnel, your latency will increase, and the connection will be slower, warnsRon Winward, a security evangelist at Radware.

Advertisement - Article continues below

The solution could be split tunnelling, which routes only certain types of traffic over the VPN.

Perhaps you have a resource inside of the network that needs remote access, but dont want all your internet traffic to go through the VPN server, Winward says. Split tunnelling allows this. But if you do use split tunnelling, make sure your users understand that not all traffic traverses the VPN tunnel. Dont create a false sense of security for them.

Clearly there are multiple reasons and ways to use a VPN, and many people actually use several VPNs for different purposes. As a global business traveller, Winward says, I run my own VPN servers at trusted locations where I control the network devices on the remote end. Doing so gives him the confidence that his traffic is kept secure as it traverses networks outside of his control. But thats not the whole story: I also connect to other VPNs for different needs, including work, lab access, and basic security hygiene.

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

The upshot is that its essential to properly consider exactly what you want to achieve by using a VPN. Your needs could be best met by a third-party provider, or by running your own VPN or a combination of the two approaches.

Advertisement - Article continues below

Each option has its own considerations, Winward concludes. A service requires that you trust the vendor with your data and your privacy. Buying your own device requires knowledge and support of the device, as well as the cost of purchasing and maintaining it. Open source might reduce your capex spend, but at the cost of not having support from a vendor when you might need it most.

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

All-flash buyers guide

Tips for evaluating Solid-State Arrays

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Go here to read the rest:
Does your business need its own VPN? - IT PRO

Microsoft Teams and Slack arent the only names when it comes to remote teleconferencing solutions. Along with many others, theres also Zoom, which apparently experienced recent growth to 13 million monthly active users.

With a recent internal video leaking online, some have gone as far as to say that Microsoft at one point felt that Zoom video conferencing was as an emerging threat. So, what does Microsoft have to be afraid of? And how does Zoom stack up against Teams? In this guide, well pit the two against each other and help you see the difference.

To begin, well touch on the price. Just like Microsoft Teams, Zoom has a free plan and other paid options. However, its important to note that, unlike paid Teams plans with Office 365, paid Zoom plans do not come bundled with extra software. Zoom is mainly just a teleconferencing solution and not meant to be the Office 365 collaboration hub like Teams is.

There are, however, extra features in paid Zoom plans that help enhance the experience, which we describe more in-depth in the next section. These are divided into a $14.99 Pro plan, a $19.99 Business plan with a minimum of 10 hosts, and a $19.99 Enterprise plan, that has a minimum of 50 hosts. you can read more about the plans here.

Keep in mind that in Zoom terms, these prices are per host. This is someone who schedules, starts and controls the settings in a meeting. A standard Zoom free plan also allows you to invite up to 100 participants in a meeting. However, you can buy more as an add-on for $50 per month or choose a paid Business or Enterprise plan which has access to 300 or 500 participants.

Microsoft Teams and Slack aren't the only names when it comes to remote teleconferencing solutions. Along with many others, there's also Zoom, which apparently experienced recent growth to 13 million monthly active users. With a recent internal video leaking online, some have gone as far as to say t

On the Microsoft Teams front, you can always go with a Free plan, but there are multiple paid Office 365 plans which include Teams at no added cost, depending on the size of your company or business. These cover Office 365 Business Essentials, Office 365 Business Premium, and Office 365 Business. For larger corporations, there is also Office 365 Enterprise plans.

Under Office 365 Business Essentials, Microsoft Teams will start at $5.00 per user, per month. This is best for small businesses as it has the bare essentials. Then, theres Office 365 Business Premium, which is $12.50, per user, per month. Finally, there is Office 365 Business, which is $8.25 per user per month.

For larger organizations, Microsoft takes things a bit further as it has special Office 365 Enterprise plans (with Teams included.) Office 365 E1 plans include Teams for $8.00 per user, per month. Then, Office 365 E3 plans include Teams for $20.00 per user per month. Again, the differences in these plans boil down between access to email, Office apps, and a few other things, which weve explained here. Theres a lot of extra value in Teams if you need it for more than just video conferencing.

Weve explained the differences in these plans in a separate post, but it boils down to access to other Microsoft services, Office apps, and the Outlook email service. Again, you might not need these features, but its still great to have for day-to-day operations.

Microsoft Teams and Slack aren't the only names when it comes to remote teleconferencing solutions. Along with many others, there's also Zoom, which apparently experienced recent growth to 13 million monthly active users. With a recent internal video leaking online, some have gone as far as to say t

When it comes to features included, Zoom makes it pretty easy. The base plan of Zoom includes hosts of up to 100 participants. Theres also unlimited 1 to 1 meeting, but a 40 minute limit on group meetings. As for features of meetings, you can create an unlimited amount of meetings and even online support if things are to go wrong and you need help.

All Zoom Free plans also include HD video and voice calls, active speaker view, full-screen gallery view, screen sharing, and the ability to join by phone. Other features included in Zooms free plans can be seen below. These all carry over into the other tiers as well. However, please be aware that under the free plan if 3 or more participants join a meeting, the meeting will time out after 40 minutes. Other features covered in all Zoom plans can be seen in the chart below.

As we said under the pricing section, the biggest difference paid versions of Teams is that it gets you bonus features of Office 365. However, Teams mainly shares the same features across free and paid plans. Essentially, the differences between the free and paid versions of Microsoft Teams comes down to maximum members, file storage sizes, extra features in recording meetings as well as phone calls.

Free versions of Teams have a limit of up to 300 members (users) per organization. You also can enjoy up to 250 people on a meeting in Teams which is different from Zooms 100 person limit for the free plan.

Elsewhere, Free Microsoft Teams plans limit storage to 2GB per user, with 10GB shared storage. Paid plans, meanwhile, bump the storage up to 1TB per user. Paid Teams plans can also upgrade you to more maximum members and users per organization. All of the following features are included in both Free and paid versions of Teams.

Just like Zoom, Paid versions of Teams offer up Admin tools for managing users and apps, usage reporting for Office 365 services, 99.9% financially-backed SLA uptime, and Configurable user settings and policies. Compared to Zoom, Teams might work better as a phone solution, though, as paid versions of the plan let you include phone calling for $12-$20 per month. Zoom is a $15 per month add on.

Finally, you might be wondering where Teams and Zoom stands when it comes to security and privacy. Recently, a Twitter thread revealed that Zoom could be monitoring the activity on your computer. Some have also worried that it could collect data on the programs running. Prontonmail gives a good insight into all the privacy flaws of Zoom, so you give it a read.

The concerns, though, are in fact true, though Zoom seemed to dismiss it in a Tweet. Zooms Privacys page notes the following: Whether you have Zoom account or not, we may collect Personal Data from or about you when you use or otherwise interact with our Products. Zoom also claims that its Communications are established using 256-bit TLS encryption and all shared content can be encrypted using AES-256 encryption. Chats are also encrypted end-to-end by TLS 1.2 with the Advanced Encryption Standard (AES) 256-bit algorithm.

When it comes to Microsoft Teams, the story is different. Microsoft explains that it does not use your data for anything other than providing you with the service that you have subscribed to. The company claims it does not scan your email, documents, or teams for advertising or for purposes that are not service-related. Microsoft also doesnt have access to your uploaded content.

As far as encryption goes in Teams, it has one disadvantage to Zoom. Microsoft is using the lesser secure type of encryption policy. According to this support page, Microsoft Teams data is encrypted in transit and at rest. Unlike with end-to-end encryption, the data is not encrypted on a senders system or device, and not only the recipient is able to decrypt it. Teams is also Tier D-compliant. This includes the following standards: ISO 27001, ISO 27018, SSAE16 SOC 1 and SOC 2, HIPAA. More information on that is available here.

In choosing either Teams or Zoom, everything comes down to your needs as a business. Zoom is a great alternative for Teams when it comes to just video conferencing. It gives you access to calling without all the extra stuff. Teams, though, again has the most value for businesses. Its paid plans not only include audio and video calling under Teams, but you also get access to other Office 365 apps and Microsoft 365 services. This isnt something that everyone will need, but it sure might be useful for smaller organizations.

But its not to say that Zoom is just for small companies. Zoom is currently used by 21st Century Fox, Delta, Dropbox, Logitech, Rakuten, Salesforce, and many more. Thats just as Microsoft Teams, too, which is currently being used by BP, GE, NASCAR, Northwhell Health, Toshiba and many Fortune 500 companies, too.

Read the original here:
Microsoft Teams vs Zoom: What does Microsoft have to be afraid of? - OnMSFT

A bill with broad bipartisan support is working its way through Congress and if passed would substantially impair safety and privacy online. How did such a bill become so popular? The way so much similar measures make it through the legislative process: the promise of protecting the children.

The measure the Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act removes legal protection from many of the Internets most popular uses, including blogs, social media, instant message services, apps, and sites whose content is created by the public (think Wikipedia, for example). Should the EARN IT Act become the law, the Internet will be changed forever.

Of course, the bills sponsors insist that such drastic changes to such a broad spectrum of the U.S.s digital information infrastructure are necessary to prevent child sex trafficking.Were not going to live in a world where a bunch of child abusers have a safe haven to practice their craft. Period. End of discussion, said Senator Lindsey Graham (R-S.C.), EARN ITs GOP co-author.

Unless companies demonstrate that they are using best practices to protect children from being exploited online, they will forfeit any legal immunity. To that end, the EARN IT Act mandates that tech companies build backdoor access into all their encrypted offerings. Basically, this back door would give the government ultimate control over almost every public place on the Internet.

Remarkably, the bill would provide no additional power to victims to punish people preying on children online, nor would it give law enforcement any improved tools for investigating such despicable behavior. Nope. Not surprisingly, the only protection afforded by this act is that it gives the government the power to suspend the rights of free speech and privacy for any organization it the government deems irresponsible.

As the Naked Security blog explains:

If passed, the legislation will create a National Commission on Online Child Sexual Exploitation Prevention tasked with developing best practices for owners of Internet platforms to prevent, reduce, and respond to child exploitation online. But, as the EFF [Electronic Frontier Foundation] maintains, Best practices would essentially translate into legal requirements:

If a platform failed to adhere to them, it would lose essential legal protections for free speech.

The blog additionally pointed out that the best practices would be subject to approval or veto by the Attorney General (currently William Barr, whos issued a public call for backdoors), the Secretary of Homeland Security (ditto), and the Chair of the Federal Trade Commission (FTC).

Heres the Verges take on the measure and its likely effects:

For starters, its not clear that companies have to earn what are already protections provided under the First Amendment: to publish, and to allow their users to publish, with very few legal restrictions. But if the EARN IT Act were passed, tech companies could be held liable if their users posted illegal content. This would represent a significant and potentially devastating amendment to Section 230, a much-misunderstood law that many consider a pillar of the internet and the businesses that operate on top of it.

The Section 230 referred to in the Verge story is Section 230 of the Communications Decency Act (CDA). The Electronic Frontier Foundation (EFF) summarized Section 230s protections:Section 230 enforces the common-sense principle that if you say something illegal online, you should be the one held responsible, not the website or platform where you said it (with some important exceptions).

In other words, if a person publishes something on the Internet, the author alone wouldnt be responsible, but the platform on which the targeted content was posted would be held legally liable, as well.

Its called the chilling effect. Such statutes would keep people from posting anything on the Internet that could be subjected to second-guessing by bureaucrats in D.C.

The blog Protocol lays out the bureaucratic hurdles that would be placed between content providers, publishers, and the right to free speech and privacy:

The EARN IT Act would establish the National Commission on Online Child Sexual Exploitation Prevention, a 19-member commission, tasked with creating a set of best practices for online companies to abide by with regard to stopping child sexual abuse material. Those best practices would have to be approved by 14 members of the committee and submitted to the attorney general, the secretary of homeland security, and the chairman of the Federal Trade Commission for final approval. That list would then need to be enacted by Congress. Companies would have to certify that theyre following those best practices in order to retain their Section 230 immunity. Like FOSTA/SESTA before it, losing that immunity would be a significant blow to companies with millions, or billions, of users posting content every day.

The question now is whether the industry can convince lawmakers that the costs of the law outweigh the benefits. Its a debate that will test what tech companies have learned from the FOSTA/SESTA battle and how much clout they even have left on Capitol Hill.

The federal government in the form of the 19-man commission would be granted unfettered, unfiltered, unobstructed, decrypted access to any all online communication. All messages would be forced to pass federal muster. Of course, the supporters of the EARN IT Act reiterate that the committee would only exercise control over content that affects the ability of children to go online without being subjected to sexual exploitation.

As with most such schemes, the government asks for an inch of authority over a small segment of online activity, but will end up exercising a mile of tyranny over any content the ruling regime considers objectionable.

A report on the bill by EFF accurately predicts the likely latitude that will be given to the bills bureaucratic overlords:

The Commission wont be a body that seriously considers policy; it will be a vehicle for creating a law enforcement wish list. Barr has made clear, over and over again, that breaking encryption is at the top of that wish list. Once its broken, authoritarian regimes around the world will rejoice, as they have the ability to add their own types of mandatory scanning, not just for child sexual abuse material but for self-expression that those governments want to suppress.

Once it develops in the body politic, the muscle of tyranny never atrophies.

Photo: anyaberkut/iStock/Getty Images Plus

Joe Wolverton II, J.D., is the author of the books The Real James Madison and What Degree of Madness?: Madisons Method to Make America STATES Again. He also hosts the popular YouTube channel Teacher of Liberty.

See the article here:
EARN IT ACT: Bipartisan Bill Gives Government Backdoor to Encrypted Data - The New American

While everyones been panicking about the coronavirus, the U.S. government has been quietly trying to remove end-to-end encryption. A bill to do so is currently making its way through Congress.

If passed, the EARN IT bill will greatly reduce the privacy of many Americans. End-to-end encryption means that your messages are safe its a form of message-sharing where only those communicating can read the content of the messages. It means youre not being monitored.

By passing this bill and putting a stop to end-to-end encryption, text messages will no longer be protected. To use an analogy described by Forbes, encryption is like a key. One device encrypts a message and scrambles the data, leaving it indecipherable to third parties, and the receiving device decrypts the data using a key.

But by getting rid of end-to-end encryption, there could be a third party listening in or a master key used to decrypt all messages a key someone could steal. Having government back doors into private conversations increases the risk of hackers discovering and using these doors. Data and messaging are safer when the only person who can decrypt said data is the recipient.

The argument for ceasing end-to-end encryption is that it could be used to catch criminals, as it would be easier to discover people discussing illicit activities this way. The bill describes developing recommended best practices to prevent, reduce, and respond to the online sexual exploitation of children.

While this seems like a sound and moral idea on the surface, in reality, it opens the door to the prosecution of those committing lower-level crimes. The number of people caught for serious crimes like murder or distribution of child pornography would be a much lower percentage than the number of people caught for something like a drug or immigration-related offense. A bill proposed to catch big-time criminals would soon develop into the persecution of many small-time, first offenders, and then into a general, pervasive fear of the government itself. No one wants to be monitored like this.

This level of observation is unethical. People should have a right to privacy and a right to discussion without repercussions. It may start with the discovery of a few major criminals due to texting history, but it could very easily lead to people being afraid of speaking their minds. From the 1950s to 70s, the CIA conducted similar operations, violating its charter for 25 years, including instances of illegal wiretapping and domestic surveillance, according to The CIAs Family Jewels, which is a summary of the documents that were released on the CIAs website in 2007 after more than 30 years of secrecy. The revelation of this level of surveillance was a big deal, and putting a stop to end-to-end encryption would be inviting these practices to resume, only legally this time.

This also isnt the first instance of the U.S. government sneaking a bill through Congress while the American public is too distracted to call their representatives and prevent it. The Patriot Act, passed in 2001, allows search warrants to be passed without probable cause. National Security Letters (NSLs) can be issued without a judges approval to retrieve phone records, banking information and more. This personal information is saved forever. According to the American Civil Liberties Union, in just a few years after passing the Patriot Act, 143,074 NSLs were conducted. Fifty-three of these cases led to criminal referrals, and none of them were related to terrorism, which the act was first imposed for.

This bill was pushed through in the wake of the panic following 9/11, similar to how the U.S. government is now trying to use the COVID-19 panic to push through its latest atrocity. The passage of time wont be enough to rid ourselves of this bill, either, as the Patriot Act was restored in 2015 the day after it expired, rechristened as the USA Freedom Act.

Giving up this right to privacy for a payout that would be minimal isnt worth it. The majority of people caught for illegal activities would be insignificant, as proven by the Patriot Act. The thought of being constantly surveilled like this sounds like the start to a dystopian novel.

The government should be working for the people, not against them. We must remain vigilant in the face of COVID-19 or another attack on our privacy will be passed right under our noses when we were all too busy trying to protect ourselves from a much more immediate threat.

Jillian Carey is a sophomore media arts and design major. Contact Jillian and breezeopinion@gmail.com.

Continued here:
Opinion | The EARN IT bill needs to be stopped - The Breeze

Theres a new bill in the works to fight against child sexual abuse material (CSAM) and other risky services on the internet but it could come at a cost to online privacy.

Eliminating Abusive or Rampant Neglect of Interactive Technologies (EARN IT) was proposed by the Senate Judiciary Committee and sponsored by senators from both sides of the aisle such as Lindsey Graham (R-SC) and Richard Blumenthal (D-CT). The bill is also supported by the National Center for Missing and Exploited Children and the National Center on Sexual Exploitation.

However, this bill is problematic for both freedom of speech and privacy online according to Riana Pfefferkorn, associate director of Surveillance and Cybersecurity at the Center for Internet and Society.

This bill is trying to convert your anger at Big Tech into law enforcements long-desired dream of banning strong encryption, argued Pfefferkorn in a blog post. Pfefferkorns detailed explanation says EARN IT appears less like a legitimate way to prevent the spread of child exploitation content and more like a covert attempt to ban end-to-end encryption, without having to ban it outright.

At the end of January 2020, a draft of the proposal was leaked and met with similar apprehension not only by Big tech juggernauts (Facebook, Google, etc.) but also their sometimes opposing counterparts, freedom of speech advocates.

Were concerned the EARN IT Act may be used to roll back encryption, which protects everyones safety from hackers and criminals, and may limit the ability of American companies to provide the private and secure services that people expect, Facebook spokesperson Thomas Richards said in a statement to the Washington Post.

Clearly, the issue could not be more sensitive. Patrick A. Trueman, president and CEO of the National Center on Sexual Exploitation, recently voiced this opinion, apparently advocating for EARN IT.

Right now, Big Tech has no incentive to prevent predators from grooming, recruiting, and trafficking children online and as a result countless children have fallen victim to child abusers on platforms like Instagram, Snapchat, and TikTok, said Trueman.

While everyone who has publicly condemned EARN IT has also stated a universal commitment to child safety online and in the real world, many say the bills far-reaching approach to content moderation could do more harm than good by essentially eliminating private conversations across the internet, particularly on social media platforms and messaging apps.

To fully comprehend what EARN IT proposes, one needs to understand the importance of two bills passed in the 90s. These laid the groundwork for how privacy and free speech are supposed to operate for U.S. citizens.

First, Section 230 of the Communications Decency Act (CDA), passed in 1996, allows for the continued development of the internet as a free market and universal good for free speech. Section 230 says that online platforms or providers of interactive computer services mostly cannot be held responsible for the things their users say or do on their platforms. It uses the term mostly instead of always because platforms are still liable for exceptions that violate intellectual and federal criminal law. Essentially, this means if someone is defamed for being a fraud, that person can sue their defamer, but they cannot sue the platform for providing the space for free speech.

Second, the Communications Assistance for Law Enforcement Act (CALEA), passed in 1994, requires telecom providers to make their networks wiretappable for law enforcement. However, it also ensured a carve-out for encrypted messages and information services where websites, email, social media, messaging apps and cloud storage fall out of CALEAs jurisdiction.

The purpose of these carve-outs was to reach a compromise between the competing interests of network security providers, privacy advocates, civil liberties, technological growth and law enforcement. In combination, Section 230 and CALEA prevent regulation from suffocating growth and development of the U.S. information economy.

Since the 90s, more regulation has passed to undo Section 230. Section 230 has been amended since it was passed: SESTA/FOSTA, enacted in 2018, pierces providers immunity from civil and state-law claims about sex trafficking, wrote Pfefferkorn. SESTA/FOSTA is currently being challenged in federal court being unconstitutional and doing more harm than good.

There is also already a regulatory reporting scheme for online providers combatting CSAM. Also, Section 230 does not keep federal prosecutors from holding providers accountable for CSAM on their services.

While the current reporting schemes success is questionable, there is reasonable evidence to believe that EARN IT is an attempt to regulate communication on the internet more broadly.

The so-called EARN IT bill will strip Section 230 protections away from any website that doesnt follow a list of best practices, meaning those sites can be sued into bankruptcy, writes Joe Mullin, a policy analyst with the Electronic Freedom Foundation.

Mullin is referring to how EARN IT would target CSAM. It proposes to do this by creating a federal commission to develop a list of best practices for preventing CSAM that online platform providers would have to follow or else lose their immunity under Section 230 meaning they could be sued into bankruptcy. This commission would largely be made up of law enforcement and allied groups such as the National Center for Missing and Exploited Children (NCMEC).

According to Mullin, The best practices list will be created by a government commission, headed by Attorney General Barr, who has made it very clear he would like to ban encryption and guarantee law enforcement legal access to any digital message.

Although the word encryption does not appear anywhere in the EARN IT bill, Mullin is suspicious of how the federal commission might design best practices. For instance, in an earlier draft of the bill, the NCMEC Vice-President stated that online services should be made to screen all messages using screening technology approved by themselves and law enforcement, report what they find in messages to the NCMEC and be held legally responsible for the content of the messages sent by others.

In short, the commission could quietly give backdoor access to all U.S. hosted information services, undoing encrypted messages altogether.

Mullin, Pfefferkorn and other outspoken critics of EARN IT all agree that the bills proposed execution is opening the door for the elimination of encryption: the fact that it is never explicitly addressed is especially concerning..

According to Mullin, its also possible that the current draft of EARN IT will be amended to undo the damage it could do to online privacy. Could be as straightforward as putting a clause in[,] saying the bill doesnt apply to encryption, he writes.

However, until some amendment occurs, critics are wary of a federal commission consisting of fewer than twenty people, according to the latest reports, who would be making large-scale privacy and security decisions for the entire U.S. population.

Such a potentially big power grab would seem a bit ridiculous, but Pfefferkorn also acknowledged that EARN IT rides on a wave of resentment or techlash the U.S. population has begun to harbor against many internet-based companies. This animosity is directed toward both U.S. tech juggernauts, whose business models run off of surveillance capitalism and online free speech platforms which, for the average person, can feel like the concentrated font of human venality every time we open our phones, according to Pfefferkorn.

In general, free speech on social media platforms is already a nuanced and complicated topic. Even under Section 230, social media platforms can still censor content when they deem it inappropriate internally. For example, Twitter has a keyword blacklist and the protocol for how it works can change on a dime.

For Nozomi Hayase, social psychologist and writer, surveillance of encrypted messaging is a movement toward forfeiting democracy. By Hayases reasoning, privacy is a prerequisite for a kind of solitude that allows people to think and act independently and is, therefore, essential to a functioning democratic society.

Democracy requires sovereign individuals who are able to communicate with one another freely. This freedom comes with great responsibility, said Hayase, who recognized EARN IT as the newest installment of a dangerous trend toward online censorship. If we really want to have a truly democratic society, we have to accept the fact that it is the duty of each person to develop his or her own moral capacity to determine what is right and wrong, instead of depending on an external authority to tell us what we should or should not do.

Currently, EARN IT has been referred to the Senate Judiciary Committee. Citizens can contact their congressmen directly or take action through the Electronic Frontier Foundations website.

More here:
EARN IT: The US Anti-Encryption Bill That Threatens Private Speech... - Bitcoin Magazine