« First...102030...2,2212,2222,2232,2242,225...2,2302,2402,250...Last »

Experts Report Potential Software ‘Back Doors’ in US Standards

Posted on by

San Francisco: U.S. government standards for software may enable spying by the National Security Agency through widely used coding formulas that should be jettisoned, some of the country's top independent experts concluded in papers released on Monday.

Such mathematical formulas, or curves, are an arcane but essential part of most technology that prevents interception and hacking, and the National Institute of Standards and Technology (NIST) has been legally required to consult with the NSA's defensive experts in approving them and other cryptography standards.

But NIST's relationship with the spy agency came under fire in September after reports based on documents from former NSA contractor Edward Snowden pointed to one formula in particular as a Trojan horse for the NSA.

NIST discontinued that formula, called Dual Elliptic Curve, and asked its external advisory board and a special panel of experts to make recommendations that were published on Monday alongside more stinging conclusions by the individual experts.

Noting the partially obscured hand of the NSA in creating Dual Elliptic Curve - which Reuters reported was most broadly distributed by security firm RSA- the group delved into the details of how it and other NIST standards emerged. It found incomplete documentation and poor explanations in some cases; in others material was withheld pending legal review.

As a whole, the panels recommended that NIST review its obligation to confer with the NSA and seek legal changes "where it hinders its ability to independently develop the best cryptographic standards to serve not only the United States government but the broader community."

They also urged NIST to weigh the advice of individual task force members who made more dramatic suggestions, such as calling for the replacement of a larger set of curves approved for authenticating users, in part because they were selected through unclear means by the NSA.

"It is possible that the specified curves contain a back door somehow," said Massachusetts Institute of Technology professor Ron Rivest, a co-founder of RSA and the source of the letter R in its name. Though the curves could be fine, he wrote, "it seems prudent to assume the worst and transition away."

More broadly, Rivest wrote, "NIST should ask the NSA for full disclosure regarding all existing standards... If NSA refuses to answer such an inquiry, then any standard developed with significant NSA input should be assumed to be 'tainted,'" absent proof of security acceptable to outsiders.

In an email exchange, Rivest told Reuters that "NIST needs to have a process whereby evidence is publicly presented" about how the curves were chosen.

Read more:
Experts Report Potential Software 'Back Doors' in US Standards

US government software standards may enable spying by NSA

Posted on by

San Francisco: US government standards for software may enable spying by the National Security Agency through widely used coding formulas that should be jettisoned, some of US' top independent experts concluded in papers released on Monday.

Such mathematical formulas, or curves, are an arcane but essential part of most technology that prevents interception and hacking, and the National Institute of Standards and Technology (NIST) has been legally required to consult with the NSA's defensive experts in approving them and other cryptography standards.

But NIST's relationship with the spy agency came under fire in September after reports based on documents from former NSA contractor Edward Snowden pointed to one formula in particular as a Trojan horse for the NSA.

NIST discontinued that formula, called Dual Elliptic Curve, and asked its external advisory board and a special panel of experts to make recommendations that were published on Monday alongside more stinging conclusions by the individual experts.

Noting the partially obscured hand of the NSA in creating Dual Elliptic Curve - which Reuters reported was most broadly distributed by security firm RSA - the group delved into the details of how it and other NIST standards emerged. It found incomplete documentation and poor explanations in some cases; in others material was withheld pending legal review.

As a whole, the panels recommended that NIST review its obligation to confer with the NSA and seek legal changes "where it hinders its ability to independently develop the best cryptographic standards to serve not only the United States government but the broader community."

They also urged NIST to weigh the advice of individual task force members who made more dramatic suggestions, such as calling for the replacement of a larger set of curves approved for authenticating users, in part because they were selected through unclear means by the NSA.

"It is possible that the specified curves contain a back door somehow," said Massachusetts Institute of Technology professor Ron Rivest, a co-founder of RSA and the source of the letter R in its name. Though the curves could be fine, he wrote, "it seems prudent to assume the worst and transition away."

More broadly, Rivest wrote, "NIST should ask the NSA for full disclosure regarding all existing standards... If NSA refuses to answer such an inquiry, then any standard developed with significant NSA input should be assumed to be 'tainted,'" absent proof of security acceptable to outsiders.

In an email exchange, Rivest told Reuters that "NIST needs to have a process whereby evidence is publicly presented" about how the curves were chosen.

Originally posted here:
US government software standards may enable spying by NSA

Revamping your insider threat program

Posted on by

Why it's important to do now, and factors to consider.

Think headlines about data theft and leakage have nothing to do with you? Think again. Many of these incidents have a common theme: Privileged access. It's your job to make sure your organization doesn't fall victim to the same fate by at the very least examining your existing insider threat program, and perhaps doing a major revamp.

Edward Snowden's theft and release of National Security Agency data, Army Private First Class Bradley Manning's disclosure of sensitive military documents to information distributor WikiLeaks and the shooting at the Washington Navy Yard by a credentialed IT subcontractor have given IT executives across industries pause to reconsider their security policies and procedures.

Tips for insider-threat mitigation

-- Sandra Gittlen

"A crescendo of discussions is happening in boardrooms everywhere about the impact an insider could have on corporate assets," says Tom Mahlik, deputy chief security officer and director of Global Security Services at The MITRE Corporation, a government contractor that operates federally funded research and development centers.

The Washington Navy Yard incident cost 12 people their lives; the full impact of the WikiLeaks and Snowden data releases cannot yet be quantified.

"These incidents have added another dimension to the threat paradigm -- privileged access," Mahlik says.

Mahlik suggests that existing insider threat programs must increasingly be focused on users with elevated or privileged access to critical information. To that point, he is leading an overhaul of MITRE's own program. His goal is to understand the threats insiders pose and to deter those threats via a program that synchronizes people, policies, processes and technology. "We are in the nascent stage of this effort," he says.

Realizing the new threat

See the rest here:
Revamping your insider threat program

NSA whistleblower Edward Snowden says UK surveillance law "defies belief" | Guardian Interview – Video

Posted on by


NSA whistleblower Edward Snowden says UK surveillance law "defies belief" | Guardian Interview
The NSA whistleblower Edward Snowden has condemned the new surveillance bill being pushed through the UK #39;s parliament this week. Subscribe to The Guardian ...

By: The Guardian

Read more from the original source:
NSA whistleblower Edward Snowden says UK surveillance law "defies belief" | Guardian Interview - Video

Edward Snowden attacks terror Bill prompted by his treason

Posted on by

Edward Snowden causes fury for attack on Britain's new surveillance bill Defence contractor wanted for treason for leaking spy agency documents David Cameron claims new laws necessary because of Snowden's leaks Comes amid concern of new bomb making threats from Al Qaeda

By Ian Drury

Published: 18:09 EST, 13 July 2014 | Updated: 04:45 EST, 14 July 2014

182 shares

216

View comments

Fugitive whistleblower Edward Snowden has attacked Britain's new anti-terror legislation

Fugitive CIA worker Edward Snowden caused fury last night by attacking Britain for introducing emergency legislation to foil terrorist plots.

His critics said the new surveillance Bill was being pushed through Parliament today largely because of his treachery in leaking Britains spy secrets.

Snowden, who has become one of the worlds most wanted men, said the measures to allow the security services and police to monitor the publics phone, email and internet records defied belief.

See the original post:
Edward Snowden attacks terror Bill prompted by his treason

Snowden slams UK emergency surveillance legislation

Posted on by

Whistleblower and former NSA contractor Edward Snowden has condemned the UKs emergency surveillance legislation being rushed through parliament.

The legislation is due to be debated on Tuesday 15 July and complete all its parliamentary stages two days later.

If passed, it will reinstate powersstruck down by the European Court of Justice in April, enabling the government to force phone and internet firms to retain and hand over data.

Justifying the move, David Cameron said: I am simply not prepared to be a prime minister who has to address the people after a terrorist incident and explain that I could have done more to prevent it.

He emphasised that the data retained would not include the content of messages and phone calls, just details of when and whom the service providers customers had called, texted and emailed.

But Snowden (pictured) said he is concerned about the speed at which it is being done, the lack of public debate and increased powers of intrusion, in an interview with The Guardian in Moscow.

He said it is very unusual for a government to pass an emergency law such as this in circumstances other than a time of total war.

Snowden likened the move to the Protect America Act introduced by the US in 2007, which used concerns about terrorist threats to justify and preserve intelligence gathering operations.

The Protect America Act was passed at the request of the NSA after revelations about the agencys warrantless wire-tapping programme.

Snowden said the bill was introduced into Congress on 1 August 2007 and signed into law on 5 August without any substantial open public debate.

Read more:
Snowden slams UK emergency surveillance legislation

Edward Snowden slams the UK government’s DRIP tsunami

Posted on by

NSA WHISTLEBLOWER Edward Snowden is shocked by the fast-paced DRIP legislation in the UK parliament, and has criticised the UK government for reacting so dramatically so late.

We were only introduced to DRIP, the Data Retention and Investigatory Powers Act, late last week and the writing on the wall says that by the close of this week it will be in force for at least two years.

Opponents stepped forward quickly, and DRIP's detractors include the UK Pirate Party and Labour MP Tom Watson.

Edward Snowden, speaking to the Guardian newspaper, has joined the chorus of disapproval and expressed his shock at the fast moving act. DRIP "defies belief", he said, adding that it looks like it was dreamed up by the US National Security Agency (NSA).

"The NSA could have written this draft," he told the newspaper during an interview in Moscow. "They passed it under the same sort of emergency justification. They said we would be at risk. They said companies will no longer cooperate with us. We're losing valuable intelligence that puts the nation at risk."

The swift proposal, the 'emergency' justification, and the almost immediate adoption of DRIP do not impress Snowden, and he said that the UK government has turned away from the April findings of the European Court of Justice and, like others, he said that he would have preferred some informed debate.

"Is it really going to be so costly for us to take a few days to debate where the line should be drawn about the authority and what really serves the public interest?" he asked.

"If these surveillance authorities are so interested, so invasive, the courts are actually saying they violate fundamental rights, do we really want to authorise them on a new, increased and more intrusive scale without any public debate?"

Go here to see the original:
Edward Snowden slams the UK government’s DRIP tsunami


« First...102030...2,2212,2222,2232,2242,225...2,2302,2402,250...Last »