Rep. Adam Schiff (D-CA) revealed allegations on Monday that President Donald Trumps national security adviser, Michael Flynn, may have tried to hide his unofficial discussions with Russia by using encryption technology.

Speaking to CNNs Wolf Blitzer, Schiff explained that the Trump administration was not labeling allegations against Flynn as fake news because U.S. intelligence agencies may have audio recordings of him speaking to Russian officials while President Barack Obama was still in office.

They know that if there is a transcript, if there are recordings, that cant be dismissed, Schiff said. The fact that they would mislead the country about this is inexplicable.

What I think is interesting here, there are allegations again, as yet unproven that they may have also used encrypted communications, he added. Since Flynn was talking with the Russians, if he was using encrypted communications, it wasnt to conceal it from the Russians. Then you have to ask, who were they concealing conversations from?

According to Schiff, the allegations suggest that Flynn engaged in encrypted communications in addition to the un-encrypted discussions that were reportedly recorded by U.S. intelligence agencies.

This is something that I think we need to determine as part of an investigation, he said. But if there were then the question is, why were those being used? Who were those conversations to be concealed from, why was it necessary to go to that if you were simply talking about Christmas greetings as Sean Spicer apparently misrepresented to the country?

Watch the video below from CNN, broadcast Feb. 13, 2017.

Originally posted here:
Adam Schiff drops bombshell: Michael Flynn may have used encryption to hide Russia talks from US - Raw Story

Data protection startup Rubrik will add support for physical Windows servers, software-based encryption and customized reporting in the next version of its Cloud Data Management platform.

Due to the features of most modern backup software which include snapshot management, DR elements, cloud support, VM protection backups can do so much more than simply restoring data in the event of a storage or server failure. Download this guide and not only discover the latest upgrades to today's top enterprise backup vendors, but also learn where backup software works best in your computing environment.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

Version 3.1 of Rubrik's Cloud Data Management platform will mark the seventh product upgrade since the Palo Alto, Calif., company started shipping products in 2015. The Rubrik software is due to ship before the end of March.

Rubrik's Cloud Data Management combines backup, recovery, replication, Google-like search, analytics, archival and copy data management. The Rubrik software can run on premises, in a commodity hardware appliance that the vendor sells with flash and hard disk drives, and in clouds such as Amazon Web Services or Microsoft Azure. Last year, Rubrik also began making available a software-only version designed for remote and branch offices.

One of the main new features in the upcoming 3.1 release is the extension of support to physical Windows servers. Rubrik added support for physical Microsoft SQL servers and physical Linux servers in the 3.0 product release that became generally available in November.

Rubrik founder and CTO Arvind Nithrakashyap said prior versions focused primarily on VMware virtualized workloads. But, as the product gained wider adoption, enterprise customers wanted the Rubrik software to protect data running on physical servers as well, he said. Future releases will add support for additional platforms based on customer demand, according to Nithrakashyap.

Davies Ward Phillips & Vineberg LLP, a law firm with offices in Montreal, Toronto and New York, became a Rubrik customer in November. Evans Vogas, a Montreal-based network operations analyst at the firm, said 97% of the company's workloads run on VMware virtual servers. But, the company still uses legacy Windows servers in production and needs to back them up.

Vogas said the firm uses Commvault backup software to protect the physical Windows boxes, but he looks forward to the day when he can back up all of his virtual and physical servers from the same Rubrik console. He said he encountered problems in the past with software vendors blaming hardware vendors for problems, or vice versa.

"There's no finger-pointing anymore. It's one box, one throat to choke, one number to call. It's their software running on their appliance," Vogas said.

Another important new feature for Vogas is software-based encryption. The law firm's cloud-based archival data is already encrypted, but the in-house data is not. Prior to the 3.1 release, Rubrik previously offered hardware-based, Federal Information Processing Standard 140-2-certified encryption through self-encrypting drives. Vogas said he asked for software-based encryption before buying a Rubrik appliance, and the vendor assured him it would add that feature.

Vogas said software-based encryption will save the law firm a significant amount of money, because hardware-based encryption requires special servers and more expensive storage drives.

"If I had $7 million to spend, I'd probably prefer everything be hardware-based encryption, because it's very hard to break," Vogas said. "But software-based encryption accomplishes the encryption requirement. For myself, this will be sufficient."

Rubrik's Nithrakashyap said another capability many enterprise customers require is rich, customized reports to manage capacity, track data protection tasks, and comply with service-level agreements for backups and archives.

Rubrik previously included a set of reports with the product. But Nithrakashyap said the new Rubrik Envision feature, due in the 3.1 release, will allow enterprises to create customized reports. Envision can also deliver HTML5-based reports via email, he said.

The fast rise of the company's revenue and ability to get into large enterprises early on has been impressive. Dave Russellvice president and distinguished analyst of storage technologies, Gartner

The Rubrik Cloud Data Management 3.1 update will be free to all existing customers, according to Nithrakashyap. Rubrik claims it is approaching an annual bookings run rate of $100 million, with a customer growth rate of seven times in 2016.

"The fast rise of the company's revenue and ability to get into large enterprises early on has been impressive," Dave Russell, a Gartner vice president and distinguished analyst of storage technologies, wrote in an email. "This year will be very telling. Can Rubrik maintain, or even increase, the same level of growth and expanded deployment? That will be very interesting to watch."

Russell said he sees Rubrik going up against Veritas NetBackup, the Dell EMC Data Protection Suite -- Avamar or NetWorker -- with Data Domain, and Commvault. He added that startup Cohesity is generating market buzz as well.

"Rubrik's ease of deployment and management, scale-out architecture and overall cost structure are the reasons I see customers interested in Rubrik, and this release should help sustain that -- not that any of those other vendors are standing still by any means," Russell wrote.

Phil Goodwin, a storage systems and software research director at IDC, said Rubrik's market share remains small. He said even Veeam, ranked higher at fifth in the market, has a single-digit market share in the range of 4% to 5%.

"A lot of [Rubrik's] capabilities are wrapped around the ability to fundamentally integrate with the cloud," Goodwin said. "If you look at the way most typical products are architected, they have an on-premise solution, and they add cloud into it. Rubrik has really been designed from the ground up to include a cloud-based component to their solution."

Goodwin said he views the Rubrik software update as a significant one. He said the Windows Server support is important because enterprises virtualize only about 75% of their workloads and still run roughly a quarter on dedicated physical servers. He said encryption has become a must-have for most organizations, and Rubrik Envision represents a key expansion into data management, a trend that IDC has noted.

New options for backup and recovery planning

Backup appliances do more than just backup

Latest wave of data protection products

See the article here:
Rubrik software adds Windows Server support, encryption - TechTarget

The Christian Science Monitor has posted an interesting article detailing some (but certainly not all) of the ways the US Secret Service can obtain data from locked phones. In all the cases discussed in the article, the data itself wasn't encrypted, but was otherwise inaccessible without the password.

In addition to using third-party forensic software and hardware (like that of recently-hacked Cellebrite), the Secret Service also engages in a lot of manual labor to recover phone data. In one instance, the Secret Service was able to pull out the phone's flash memory and grab data from it -- although this process took it nearly a week.

A Huawei phone obtained by the agency called for a very unique brute force approach.

In another case, involving a password-locked Huawei H883G phone, agents bought multiple copies of the same model and practiced carefully polishing off material from the back of the device with an automated sander.

Often, agents can apply heat to phones to open them up. But Huawei built this particular model in a way that applying too much heat could damage its memory. So, agents sanded off material from the back of the Huawei H883G device to excise sexually explicit images for a case involving a different New Hampshire man.

What's not contained in the article are complaints about encryption. Either the Secret Service doesn't encounter that much of it, or it just doesn't find it to be that much of an obstacle when it does. Dave Aitel, a former NSA research scientist, is the only person quoted in the article who says anything about encryption -- and even he believes the Secret Service's combination of hardware and software is a better approach than giving government agencies encryption backdoors.

Watering down encryption on phones is "not a good path," says Dave Aitel, a former National Security Agency research scientist who currently runs the cybersecurity firm Immunity. "The path of hacking is much nicer from a policy perspective."

[...]

"If a device is using encryption at rest ... that could be problematic, especially if the implementation of the encryption is good, he said.

It could be problematic, but encryption keeps bad guys out the same way it keeps the good guys out. And there's nothing covered here that suggests the Secret Service is as opposed to encryption as FBI Director James Comey is. Granted, the Secret Service probably runs into fewer encrypted phones than the FBI does, but even in its more-limited selection, it seems to be making the progress it needs without suggesting the government force companies to give them all-access backdoor keys.

One other somewhat surprising revelation contained in the piece is the fact that small phone manufacturers might (inadvertently) be making more secure phones than the Apples and Samsungs of the world. Why? Because the limited market draws less interest from government contractors who develop cell phone-cracking tools. If there are fewer government buyers interested in cracking Brand X, no company is going to expend research resources trying to find a way around the phone's built-in protections.

"A cheaper phone that might be less popular, it seems like it'd be easier for the vendors to get into it," says [James] Darnell of the Secret Service phone lab. "But it's actually quite the opposite."

What's covered here indicates James Comey's "sky is falling darkening" proclamations are pretty much his alone. Law enforcement at large isn't demanding encryption backdoors. It's just the same handful of holdouts, albeit ones with inordinately-large soapboxes.

See the original post:
US Secret Service Prefers Belt Sanders And Third-Party Vendors To Cell Phone Encryption Backdoors - Techdirt

NEW DELHI: Digital security giant Gemalto on Monday launched two new solutions that provide fast speed, performance and security while encrypting data on Cloud, enterprise applications and high-speed corporate networks.

The new solutions are "SafeNet Luna HSM 7" and "SafeNet High Speed Encryptors".

"As organisations increasingly embrace the Internet of Things (IoT) and cloud-based applications, their requirements to cope with big data are intensifying," said Todd Moore, Senior Vice President of Encryption Products at Gemalto, in a statement.

The "SafeNet Luna HSM 7" (Hardware Security Module) offers most scalable platform to perform the highest number of simultaneous cryptographic operations including encryption, decryption, authentication and digital signing while providing tamper-resistant protection for cryptographic keys.

The 100-Gbps "SafeNet High Speed Encryptor" provides unmatched performance and security to protect data and sensitive communications across large-scale, high-capacity networks.

"Streamlined management of data security controls have become vital in securing data as it moves between enterprises, multi-cloud environments, networks and devices," Moore added.

The rest is here:
Gemalto launches new encryption solutions to protect data - Economic Times

New SafeNet Luna HSM and 100 Gbps high-speed encryptors provide the industry's fastest speeds and performance to encrypt data

Amsterdam - February 13, 2017 - As data encryption is more widely adopted to protect sensitive applications and information, Gemalto (Euronext NL0000400653 GTO), the world leader in digital security, today announced the launch of two new solutions that give enterprises unparalleled speed, performance and security when encrypting data across the cloud, enterprise applications and high-speed corporate networks.

Gemalto's new SafeNet Luna HSM 7 (Hardware Security Module) offers the industry's most scalable platform to perform the highest number of simultaneous cryptographic operations including encryption, decryption, authentication and digital signing while providing total, tamper-resistant protection for cryptographic keys. The new capabilities enable enterprises to support encryption at massive scale and secure even larger volumes of encryption keys that protect sensitive information and applications in the cloud and on-premise.

In addition, Gemalto today also announced the launch of its new 100 Gbps SafeNet High Speed Encryptor that provides unmatched performance and security to protect data and sensitive communications across large-scale, high-capacity networks. The new SafeNet CN9100 High Speed Encryptor, developed by Gemalto and encryption partner Senetas, encrypts network traffic at Layer 2 to protect information sent across networks, between corporate offices and into the cloud at native speeds of 100 Gbps.

These latest editions to Gemalto's extensive data protection portfolio are being showcased at RSA Conference 2017 (South Hall, Booth #1907).

"As organizations increasingly embrace the Internet of Things (IoT) and cloud-based applications, their requirements to cope with big data intensify. Streamlined management of data security controls have become vital in securing data as it moves between enterprises, multi-cloud environments, networks and devices," said Todd Moore, Senior Vice President of Encryption Products at Gemalto. "This necessitates organizations to conduct more cryptographic operations in the same, or a shorter amount of time, which means they need an easy, scalable way to attach security directly to the data in order to protect it while in motion and at rest."

"Because organizations are faced with securing more data, identities, transactions and connection points, highly scalable and frictionless data encryption is critical," said Garrett Bekker, principal security analyst at 451 Research. "It's no longer an option to secure one part of the ecosystem, security is required throughout the entire data lifecycle, from the cloud and core of the enterprise to the edge of the network."

More about Gemalto's SafeNet Luna HSM and SafeNet High Speed Encryptors:

The latest SafeNet Luna HSM 7 brings best-in-class performance and industry leading security for the protection of cryptographic keys in high-assurance, tamper-resistant hardware. Gemalto's HSM portfolio offers a broad range of options to accommodate the breadth of security, performance, operational and compliance needs of customers.With up to 10,000 RSA-2048 or 20,000 ECC P-256 operations per second, the SafeNet Luna HSMs easily scales to support the execution requirements in a number of markets such as IoT, Blockchain and data encryption.

The most recent addition to Gemalto's SafeNet High Speed Encryptor portfolio protects communications at speeds of 100 Gbps encrypted bandwidth. Ensuring tha available bandwidth is maximed, the SafeNet Ethernet Encryptor CN9100 features low latency of under 2 microseconds to ensure network performance is optimized as increasingly large amounts of data, and big data, cross the network securely in real-time at higher bandwidths.

Visit our website to get more information on Gemalto at RSA.

Related Resources

About Gemalto

Gemalto (Euronext NL0000400653 GTO) is the global leader in digital security, with 2015 annual revenues of 3.1 billion and customers in over 180 countries. We bring trust to an increasingly connected world.

Our technologies and services enable businesses and governments to authenticate identities and protect data so they stay safe and enable services in personal devices, connected objects, the cloud and in between.

Read More

Gemalto's solutions are at the heart of modern life, from payment to enterprise security and the internet of things. We authenticate people, transactions and objects, encrypt data and create value for software - enabling our clients to deliver secure digital services for billions of individuals and things.

Our 14,000+ employees operate out of 118 offices, 45 personalization and data centers, and 27 research and software development centers located in 49 countries.

For more information visit http://www.gemalto.com or follow @gemalto on Twitter.

Gemalto media contacts:

Attachments:

http://www.globenewswire.com/NewsRoom/AttachmentNg/1c2b6072-c468-4f42-b132-44a4427350fa

Link:
RSA Conference: Gemalto unveils the industry's most robust encryption solutions to protect data across the cloud ... - Yahoo Finance

Gigamon has announced an expansion to its GigaSECURE SSL/TLS Decryption solution. It has delivered new inline capabilities to enhance the ability to decrypt SSL/TLS traffic. This enables Security Operations (SecOps) teams to see what is movingin and out of the organisation. The ability to decrypt encrypted data has become a key part of the security landscape. Attackers are just as good at using encryption as companies, in some cases they are better.

Ananda Rajagopal, Vice President of Products, Gigamon said: Inline SSL decryption represents a strategic technology evolution that further expands the benefits of the Gigamon Security Delivery Platform. By offering SSL decryption as a service in the Security Delivery Platform complemented by strong policy enforcement, organizations can create a centralized decryption zone, enabling them to more easily see and manage their growing SSL/TLS traffic volumes, while enabling their security tools with newfound visibility into formerly encrypted traffic and threats.

Organisations are now encrypting much if not all the traffic moving in and out of their networks. This is to protect data from cybercriminals. Yet those same cybercriminals are just as good at using encryption as the enterprise. Using the same encryption channels, they infiltrate malware and exfiltrate data. Data is not the only thing that is encrypted. Most of the communication between infected machines and command and control (C&C) servers is done across encrypted channels.

The problem for SecOps is that the tools they have are not designed for real-time examination of traffic. They require significant compute power and cause traffic delays in the decrypt, examine, encrypt cycle. Users become unhappy with network performance and SLAs are breached. To resolve this, some companies have invested in SSL appliances. Gigamon says this is ineffective as it just adds to the complexity of the network.

Gigamon has added a decrypt once and feed to multiple tools approach. It begins with detecting all SSL/TLS traffic on the network. It then applies a series of rules to that traffic to decide if it warrants further investigation. The Gigamon Visibility Platform decides which traffic to inspect andwhich tool to use for decryption.

The solution also uses advanced policies based on a number of different sources. It uses the Webroot BrightCloud Web Classification Service to determine the trust rating of URLs. Whitelists and blacklists allow for the blocking of sites based on threat intelligence data. For example, decrypted traffic between on-premises servers and backup systems could be marked as safe. It can also say to inpectall traffic going to cloud-based services not on a company whitelist.

There has been a rush to encrypt all traffic to meet good data protection standards. This is a good thing but it has also created a blind spot where encryption is seen as good enough. SecOps teams now realise that they are not the only ones encrypting data. To regain control of network traffic they have to be able to decrypt and validate traffic.

This is not news to many SecOps teams. They have been doing SSL/TLS decryption and checking data for over a year. Their problem is the amount of traffic that they have to inspect and the indiscriminate approach of many tools. Gigamon is offering them a more focused solution that will not cause network delays or user conflicts.

Excerpt from:
Making encrypted data visible - Enterprise Times

This InfoCenteris a collection of resourcesaboutencryption for stored informationonportable devices, such as laptops, tablets, and externally attachedstorage. (Refer to SSL certificates in the Related InfoCenters box forinformation related toencrypted network communications.) The Help Desk provides general support for Windows BitLocker and for OSX FileVault2 full disk encryption.Questionsshould normally be handled by a departmental IT support person, and if necessary willbe escalated to the InformationSecurity & PolicyOffice or the ITS Enterprise Client Management team.

Encryption is a method to protect digital information, byscrambling it as it travels across the Internet, or scrambling it when the information is "at rest"or stored on our computers. This ensures that only authorized users can decrypt (un-scramble) the information and use it. Encryption enhances the privacy and confidentiality, as well as the integrity and authenticity of our information. It helps us keep our information safe.

Portable devices such as laptops, tablets, and USB storage are most at risk for being misplaced or stolen. If a device is lost or stolen, encryption prevents unauthorized users from accessing data stored locally on the device. Without encryption, unauthorized users canuse various techniques to bypass the accounts and permissions in order to access the localdrive contents.

In order to meet our legal obligations and our responsibility to protect the privacy of those we serve, The University of Iowa requires full disk encryption to be implemented onall university owned mobile computing devices (i.e.laptops,tablets, USBstorage). The best way to avoid theft or lossof sensitive data is to keepit in a secure file storage offering such as OneDrive, RDSS,or department shared drives, where it's physically secured and regularly backed up. Then,you can easily access the information remotelyfrom your mobile computer. However, encryption is oursafety net for new files,temporary (cached) files, and other information that is stored on a mobile device.

The Verizon 2015 Data Breach Investigations Report indicates15% of all security incidents involved some form of physical loss or theft.

Everyone uses network encryption today: over https connections from your browser to a website, over cellular phone-to-tower communications, and also over wireless networks that require a login or connection password, such as Eduroam, in order to protect the privacy of communications. Full disk encryption is similarly designed to protect information when its stored.

More:
Encryption | Information Technology Services

Whether youre an activist living under an autocratic regime, or a law-abiding citizen in the worlds biggest democracy, you have many reasons to fear for the safety of your data. State-sponsored cybercriminals, fraudsters, three-letter agencies and data-hungry corporations will go to great lengths to lay their hands on your files and data and use them for their own ends.

If theres one thing eavesdroppers and data thieves hate, its encryption. It keeps them away from your private and sensitive dataor at the very least gives them enough headaches to go seek prey elsewhere.

Here are seven tips that will beef up your defenses against hackers by encrypting the data you store and share across your devices and the internet.

We use messaging apps for a lot of our work and personal communications, ignoring the fact that some of them will not protect us against hackers. Server hacks and man-in-the-middle attacks are two popular methods that can give unwanted parties access to your sensitive messages.

Secure messaging apps such as Signal, which feature end-to-end encryption, scramble your messages in a way that allow on the recipient of the message to read them. While there are several end-to-end encrypted messaging apps out there, Signal is by far the most secure because it stores the least amount of information about its users. A more detailed discussion of messaging app security can be found here.

A hacker with your login credentials or a government agency with a search warrant can scan your emails stored on a server. Just ask John Podesta. In order to protect your mailbox from potential hacks, you can use PGP, a technique that encrypts your messages with a key that only you possess.

PGP might not be very intuitive and user-friendly, but its worth the added security. Alternatively, you can sign up for a secure email service such as ProtonMail, which encrypts your emails end-to-end.

A more detailed discussion of email security can be found here.

You might want to prepare in advance for the day your phone or laptop becomes lost or stolen (or gets confiscated by security forces if youre ruled by a tyrannical regime). And no, a good login-screen password will not protect the files on your computer. Anyone with the most basic IT skills can plug your hard disk into another computer and extract your files.

Full-disk encryption (FDE) automatically encrypts everything that is stored on your drive with a key that is only accessible to you, preventing someone with physical access to your device from accessing your files.

Software such as Symantec Endpoint Encryption offer full-disk encryption, but the latest version of most operating systems already have built-in FDE features. In Windows its called BitLocker, in MacOS its FileVault. Apples iOS 8 and later as well as Android Lollipop (5.x) and higher have full-disk encryption enabled by default.

Encrypting the files you store on the cloud can protect you from unwanted access to your account. A simple option is to store your files in password-protected zip archives before uploading them to your cloud storage. However, the extra manual effort required to zip and unzip your files might be too frustrating.

An alternative is to use third-party tools such as Boxcryptor, which adds client-side encryption to most famous cloud storage services such as Google Drive and Dropbox. You can also opt for secure storage services such as SpiderOak One, which have built-in encryption.

Thumb drives and memory cards easily get lost, so you if youre carrying your data on removable media, you should always plan for the worst.

Your best option would probably be to choose a secure memory stick such as datAshur. These USB drives come with built-in hardware encryption protected by a 7-15 PIN code and are compatible with all major operating systems.

If you want to stick to your old memory drive, there are some decent software alternatives. Windows users can encrypt removable drives with BitLocker to Go, and Mac users can use FileVault. Most third-party full-disk encryption software supports removable drive encryption as well.

While browsing the internet, make sure you only fill in forms on websites that have addresses starting with https (the s stands for secure). Sites with plain HTTP dont encrypt your data and are vulnerable to eavesdropping.

The Electronic Frontier Foundations HTTPS Everywhere extension for FireFox, Chrome, and Opera adds a layer of security by encrypting your traffic when you visit major websites.

However, HTTPS does not conceal everything, and an eavesdropper will still be able to monitor the sites and URLs youre visiting (which sometimes contain sensitive information). A more secure alternative would be to use TOR, a browser that encrypts your entire traffic and forwards it through other computers (called TOR nodes). A malicious actor would no longer be able to extract any information by monitoring your traffic.

If you want to go the extra mile to encrypt everything that comes in and goes out of your device, consider using a virtual private network (VPN). VPNs encrypt and forward all your traffic through a server in another geographical location, which makes it difficult to monitor your activities.

A software VPN that offers decent performance is Psiphon, a free-to-use tool that was designed to help people living under the censorship of repressive regimes. Psiphon can be installed on all major desktop and mobile operating systems.

A hardware alternative is Anonabox, a TOR/VPN router that can secure your traffic while also saving you the processing power required to theextra encryption and decryption.

These tips will help you put up a tougher fight against hackers. However, take note that theres no such thing as absolute security, and encryption per se is not a silver bullet that will fix all your security problems. You still have to adhere to basic cybersecurity principles, such as keeping your operating system and antivirus updated and choosing strong passwords for your account.

Ben Dickson is a software engineer and the founder of TechTalks. Follow his tweets at @bendee983 and his updates on Facebook.

The rest is here:
How to encrypt all your data - The Daily Dot

Norm Morin

In case you haven't heard, there are plenty of scams circulating on the Internet.

The most popular one is the encryption virus scam. This one is real nasty. If your computer is infected, any documents, pictures, or any personal files will be encrypted. For all purposes, your files are as good as gone.

The usual delivery method is by email. You might receive a fake notice of a missed delivery. When you open the attachment included in the email, the virus is launched. The virus encrypts any files that your computer has and will attempt to encrypt any files that are available to your computer on the local network.

Viruses used to be considered pranks, files could be deleted but the encryption virus attempts to extort you for access to your files. This is serious business. Encryption virus scams generate big money for criminals. Every anti-virus developer has statistics available. It doesn't matter whose information you believe, criminals are making big money.

Viruses are pretty old news. It didn't seem like law enforcement was doing anything about the encryption virus scammers. The scammers have caused serious damages with impunity. You won't see any big news headlines that encryption virus scammers are being apprehended. The news media seems more preoccupied with scaring the public. The encryption virus scammers are being apprehended and convicted of their crimes. They are getting serious jail sentences.

The best defense against the encryption virus is having a good backup.

It is too late to think about the encryption virus after your computer is infected. You can't do much to recover from the virus. Are you comfortable to pay the ransom? Would you pay a criminal to give you access to your files? When the virus first appeared, the ransomware developers operated on an honor system. They promised to give victims keys to gain access to their files. The current scammers may or may not give the victims keys to unlock their files. Would you expect to get your files back if you paid the ransom?

One has to wonder, after the ransomware scams are stopped, what will be the next scam? How many times during the day have you been accosted by scammers. It tax season and scammers have turned their attention to people expecting tax refunds. Money will always attract scammers. Don't get taken by a con, use common sense.

Norm Morin is founder of NKC Systems computer repair and consulting. Call 978-453-1355; visit 155 Broadway Road, Dracut; or email techside@nkcsystems.com.

See the original post here:
Encryption virus scam is no laughing matter - Sentinel & Enterprise

Much of the debate about encrypted devices and messaging services has been centered on more sophisticated criminal or terrorist activities, where the people involved are actively searching out ways to avoid detection by law enforcement. However, the FBIs top attorney contends that tech companies may be inadvertently giving dimwitted crooks a leg up by making quality encryption so widely available.

End-to-end encryption, or decryption of devices, is increasingly available by default, said FBI General Counsel James A. Brady yesterday at a Center for Strategic & International Studies panel discussion on privacy and law enforcement. Your average bad guy, whos not particularly sophisticated, can avail himself of high quality encryption, so thats part of our problem.

Brady seemed to question the logic of making full-disk encryption the default on phones and other devices, when in his view most people arent thinking about this issue.

The super-sophisticated bad guys are always going to be able to find tools to try to thwart us, he added. They think about it actively and they will endeavor to do that.

To demonstrate the volume of encryption challenges law enforcement now faces, Brady says that in just three months of 2016, the FBI attempted to access 2,870 different devices; this includes devices brought to the agency by state and local authorities in need of assistance.

Of those, 1,715 were encrypted and protected by password locks, but the FBI was only able to crack the passwords for 470, leaving the contents of 1,245 devices still locked up tight.

Lawful hacking the process of getting a court to compel a company to aid in opening a secured device provides some relief, said Brady, but only some. Its slow, its expensive, its fragile; its just not a comprehensive solution to this problem. Well use it when necessary, but its not a panacea.

Its not as difficult to obtain metadata things like when and who you texted or emailed, but without any content but Brady noted that this is rarely the kind of information that can lead to a criminal prosecution.

After both Apple and Google moved to encrypt their smartphone operating systems so that even they couldnt access a device without a password, Bradys boss, FBI Director James Comey, called on Congress to come up with some solution to make it less difficult for law enforcement to access suspects locked devices.

Brady, without suggesting anything specific, also noted that its ultimately up to lawmakers to sort out where to draw the line.

At the end of the day, the FBI works for the American people and we will use whatever tools you want us to have to deal with the threats that you want us to address, he explained.

So far, suggestions about what such a law would look like have been limited to make tech companies put in a back door or require that tech companies be able to crack their own encryption upon request. Privacy and cybersecurity advocates say that such practices and policies are effectively like leaving out a welcome mat to hackers.

No matter how thick the door or tough the lock, the house is now more vulnerable to intrusion in at least three ways: The door can be battered down, wrote Washington Post tech columnist Craig Timberg in 2014. The keys can be stolen. And all the things that make doors work the hinges, the lock, the door jamb become targets for attackers. They need to defeat only one to make the whole system fail.

Brady, at yesterdays panel, tried to downplay the level of access the FBI seeks, but also provided such an all-encompassing description of the factors in play that its doubtful any policy could address even a majority of them.

The FBI is not pushing some particular solution, said Brady, who then showed off his predilection for making lists: Were not trying to undermine encryption. Were not trying to create a backdoor. We dont want a golden key. We dont want any of that. We want something that is safe and effective.

We need some type of solution, he continued, that adequately addresses all of the values that I think we all share with respect to protecting public safety, protecting cybersecurity, maintaining the innovativeness and competitiveness of U.S. companies, protecting privacy, free expression, freedom of association all of that.

Brady conceded that it may require multiple policies, but Whatever we come up with its gotta really accommodate all of those values otherwise its not really a solution.

This battle over encryption between the FBI and tech companies was pushed into the spotlight following the Dec. 2015 terrorist attack in San Bernardino, CA. The FBI had sought to compel Apples help in unlocking one of the killers iPhones, but Apple fought back. The company said that not only did it not have the ability to crack the encryption, but that forcing a company to find a vulnerability in its own security put other users at risk and allegedly violated Apples rights.

That matter was never resolved when an unnamed third party provided the FBI with a solution for bypassing the encryption.

Victoria A. Espinel, President and CEO of BSA|The Software Alliance, said its important to separate the bigger policy issues from individual tragedies, as the rhetoric from both sides of this debate can make it difficult to find common ground.

Individual horrible events can create understandably pressure on policymakers, explained Espinel, adding that this discussion needs to happen now, but outside the shadow of a particular event.

Brady agreed, noting that time is of the essence. We should move forward quickly, smartly, but promptly because we dont want to have this debate driven by some type of catastrophe down the road.

More here:
FBI Attorney: Tech Companies Are Helping Dumb Criminals By Providing Quality Encryption - Consumerist