Facebooks messaging application doesnt support encryption, but an open-source chat program, Cryptocat, has made it possible to chat with friends there over an encrypted connection.

The programs founder, Nadim Kobeissi, wrote Monday that the latest 2.2 version of Cryptocat can log a user into Facebook and pull his contact list in order to set up an end-to-end encrypted conversation.

Effectively, what Cryptocat is doing is benefitting from your Facebook Chat contact list as a readily available buddy list, he wrote.

The move could augment Cryptocats user base since new users wont have the chore of building a new contacts list, although they would need to download Cryptocats browser extension or iPhone application to benefit from encryption.

The security of emails and messages was brought sharply into focus by secret documents leaked by former U.S. National Security Agency contractor Edward Snowden revealing sophisticated online surveillance techniques used by the spy agency.

Facebook has said it could enable end-to-end encryption between users exchanging data, but said such technology is complicated and makes it harder for people to communicate.

Messages exchanged using Facebook are protected by SSL (Secure Sockets Layer) encryption, but that only encrypts data between an end user and Facebook. The social networking service would have access to the clear text of those conversations, which potentially could be surrendered to law enforcement under a court order.

(Click to enlarge.)

If two people are using Cryptocat, Facebook will know an exchange occurred between the two users and the time of their chat. But the messages themselves will only say: [encrypted message].

The fact that Facebook knows two people are chatting, a type of information known as metadata, should not be a deal breaker, Kobeissi wrote. Users presumably know theyre divulging that information already to Facebook by using their service.

See the article here:
Here's how to chat with your Facebook friends using end-to-end encryption

Enterprises that have adopted the cloud are finding that while cloud computing confers very real benefits, it also creates significant security challenges, which traditional network and perimeter security measures are inadequate to address. Organizations must protect their data, rather than their infrastructure, if they use the cloud at all. Cloud data encryption is the answer.

When it comes to security, 2013 was the year of Edward Snowden. The NSA whisteblower exposed a vast, secretive program of systematic electronic surveillance. The implications for the enterprise are disturbing, especially in light of the NSA's infiltration of major cloud service providers' data centers worldwide. And eavesdropping hasn't been the only way that government agencies have gotten their hands on private data. A 2014 transparency agreement led to revelations of tens of thousands of government data requests voluntarily fulfilled by major cloud service providers in the last year alone.

Government spying isn't enterprises' only concern, of course. As more and more sensitive datamuch of it protected by data privacy regulations like HIPAA, HITECH, GLBA, and PCI DSSmakes its way into the cloud, the threats of data theft and inadvertent data leakage loom ever larger. Data breaches and compliance violations are serious business. Penalties can hit seven figures, and mandatory breach disclosures can deal catastrophic damage to organization's reputations.

Traditionally, enterprises have sought to secure their data from theft and leakage by locking it down behind a corporate perimeter, keeping it under the enterprise's control and rendering it less vulnerable to access by third parties. These days, however, many companies are finding the on-premises model untenable. Data is proliferating thanks to technology movements like Big Data and the Internet of Things. Meanwhile, mobility and BYOD demand anytime, anywhere access to applications and data. Supporting all these initiatives in-house would cost more than many organizations are willingor ableto invest, making the cloud an attractive alternative.

But with cloud computing comes a loss of control. When your data's housed on a third party's servers, how confident can you be that it's safe? And even if your cloud service providers make good on their promises of cloud encryption, who's to say they won't turn your data over to government agencies without your knowledge or consent? What about all the copies of your data being made, moved, and backed up as part of your cloud service providers' everyday operations?

For these reasons, 2014 looks set to be the year of encryption, as Enterprise Networking Planet contributor Paul Rubens wrote for BBC.com. Cloud data encryption solves many of the control challenges that enterprises face in the cloud. Even if cloud service providers are infiltrated or compelled to disclose data, for example, whatever is encrypted will remain unreadable to unauthorized viewers as long as enterprises retain control of their encryption keys. Additionally, placing the focus on the data rather than on infrastructure helps ensure that data will remain safe even if hardware vulnerabilities are exploited.

One common cloud data encryption solution involves service providers encrypting customers' data. That's the approach that major cloud service providers like Microsoft, Google, and Yahoo are taking. To help other cloud hosts and service providers offer encryption services, EMC last week announced its choice of the AFORE Solutions CloudLink SecureVSA to anchor its Encryption as a Service (EaaS) offering. EMC touts EaaS as a way for cloud hosts and cloud service providers to "offer their customers simple to deploy, pay-as-you-go data encryption," according to an AFORE statement.

What may make EaaS particularly attractive, both to the cloud service providers that offer it and the enterprises looking to adopt it, is its flexibility. CloudLink supports both VMware vSphere and Microsoft Hyper-V; runs in private, hybrid, and public cloud environments; and requires no additional hardware to deploy. It provides strong AES 256-bit encryption for data in rest and motion and, perhaps most critically, includes options for customers to manage their own encryption keys, ensuring the continued protection of their data even in the event of a breach. Service providers looking to beef up their security offerings and assuage their customers' security concerns may find it a useful tool. So might customers hoping to streamline their cloud encryption efforts.

On the other hand, for enterprises who've adopted any of a number of popular public cloud services like Salesforce, Box, Dropbox, or Google, client-side cloud data encryption may be the way to go. A number of cloud encryption gateways exist to enable enterprises to detect and encrypt sensitive data at the moment it leaves the corporate perimeter. These solutions require an infrastructure investment but can provide peace of mind for enterprises unwilling to trust cloud service providers' encryption promises.

Among vendors offering cloud encryption gateways, CipherCloud stands out with the robustness of its offering. CipherCloud's cloud data encryption solution comes pre-integrated with a number of popular public cloud services and boasts easy integration with any other cloud service the customer chooses. The vendor claims this helps ensure that encrypted data remains searchable, sortable, and reportablein other worlds, functionalin the cloud. A number of different encryption and tokenization options and granular control of their application to different data types helps enterprises maintain control over their data protection, as does enterprise-exclusive encryption key access and management. And data discovery and DLP tools enable customers to gain visibility and control of all their protected cloud data and the activity around it.

Link:
Cloud Computing Demands Cloud Data Encryption

Press Release: ADVA Optical Networking Launches Industry First with 100G Metro and Built-in Encryption

ADVA Optical Networking SE / ADVA Optical Networking Launches Industry First with 100G Metro and Built-in Encryption . Processed and transmitted by NASDAQ OMX Corporate Solutions. The issuer is solely responsible for the content of this announcement.

New Technology Delivers Most Secure Transport for Big Data Era

Martinsried/Munich, Germany. May 14, 2014. ADVA Optical Networking http://www.advaoptical.com/ today launched its new 100G Metro technology http://www.advaoptical.com/en/innovation/100g-transport.aspx with built-in on-the-fly encryption. Fully integrated into the ADVA FSP 3000 http://www.advaoptical.com/en/products/scalable-optical-transport/fsp-3000.aspx , this is the first solution available on the market capable of transporting 100Gbit/s data rates with integrated line-side encryption. Designed specifically for users who need to transport enormous amounts of data in the most secure way possible, the ADVA 100G Metro with built-in encryption has already been deployed by a number of enterprises and service providers. Based upon the 4x28G technology of the original ADVA 100G Metro, this new solution continues to push the boundaries of 100Gbit/s connectivity services.

"The security of data has never been so important; its integrity never so public. We're living in a new era of data awareness," said Uli Schlegel, director, data center business development, ADVA Optical Networking. "In the wake of Heartbleed and other data security scares, businesses are only too aware of how vulnerable their mission-critical data is. How susceptible it is to theft and malicious use. Data security is now of paramount importance. At the same time, the volume of data has never been so immense. Transporting and protecting this data requires something purpose built, something special. That's what sets our 100G Metro with built-in encryption technology apart. It's the only product on the market capable of securely transporting big data."

Built upon Advanced Encryption Standard (AES) with a key size of 256 bits, the ADVA 100G Metro with built-in encryption features a Diffie Hellmann dynamic key exchange with over 60 exchanges per hour. It provides encryption at the lowest network layer and is completely agnostic to protocols such as Fibre Channel, InfiniBand and Ethernet. It also supports a wide variety of data rates from 5Gbit/s, to 10Gbit/s to 40Gbit/s and onto 100Gbit/s. To ensure compatibility in point-to-point and multi-hop infrastructures, the ADVA 100G Metro with built-in encryption uses optical transport network (OTN) framing. It also adds very little latency to the transmission link - less than 150 nanoseconds - compared to our non-encrypted version. This stands in stark contrast to higher layer encryption technologies that often add significant overhead and multiply the latency of the data stream.

One of the most unique features of the ADVA 100G Metro with built-in encryption is that it also encrypts the header and checksum of the signal, not just the payload or select bytes in the header. Every bit that enters one of our client ports is encrypted. This is one of the most important aspects to comprehensive data security. There are no snippets or breadcrumbs that remain unencrypted, nothing that may be intercepted. What's more, with the ADVA 100G Metro with built-in encryption it is possible to separate network and encryption management. This ensures extremely granular control as to who has access to your business' encryption management. This is vital for any organizations that are leasing encrypted services and don't want their service provider to be privy to their encrypted data.

"The introduction of our 100G Metro proved to be a defining moment in the big data era. One that introduced 100Gbit/s data transport to a whole new market," commented Christoph Glingener, CTO, ADVA Optical Networking. "Cost, space and power consumption have long been defining factors for data center connectivity. Now a fourth one has joined the list of top criteria - security. Businesses need to know that their data is intact and safe. They need to know their data can withstand any attempts at network intrusion, any attempts to be stolen. That's what our 100G Metro with built-in encryption does. It provides businesses with the most robust security possible; it provides them with a genuine peace of mind. With this technology they can focus purely on their core business objectives and not the security of their data."

Watch the latest 100G Metro with built-in encryption video for more information: http://adva.li/secure.

# # #

Continued here:
Press Release: ADVA Optical Networking Launches Industry First with 100G Metro and Built-in Encryption

Facebook is pushing for more email providers to use STARTTLS, a technology that encrypts emails as they pass between servers and clients, after an analysis showed that any SMTP (Simple Mail Transfer Protocol) server that adds the feature now would start encrypting over half of its outbound email traffic.

STARTTLS is an extension for several communication protocols, including IMAP and POP3, SMTP, FTP and XMPP and allows a plain text connection to be upgraded to an encrypted one using the TLS (Transport Layer Security) or SSL (Secure Sockets Layer) protocols.

Researchers at Facebook recently analyzed a days worth of the companys email logs to determine how widely STARTTLS is deployed among email servers around the world. The company is in a good position to run such a test because it sends several billion notification emails every day to user email addresses hosted across millions of domain names.

We found that 76 percent of unique MX hostnames [email server hostnames] that receive our emails support STARTTLS, the Facebook researchers said Tuesday in a blog post. As a result, 58 percent of notification emails are successfully encrypted.

SSL certificates are successfully validated for around half of encrypted email traffic and the other half is opportunistically encrypted, the researchers said.

By opportunistic encryption Facebook refers to encrypted connections that are established despite the SSL certificate presented by the server not passing strict validation criteria. This can happen if the certificate is not signed by a trusted certificate authority, is expired or was not issued for the host name where it was used.

The Facebook researchers found that for over 99 percent of emails that were encrypted using opportunistic encryption the reason for certificate validation failures was a hostname mismatch, the certificates being otherwise acceptable.

Seventy-four percent of MX hosts that supported STARTTLS provided perfect forward secrecy (PFS), a property of some TLS cipher suites that prevents the decryption of previously captured traffic if the servers private key is later compromised.

The majority of email traffic sent by Facebook to servers with STARTTLS support was encrypted with the ECDHE-RSA-RC4-SHA and DHE-RSA-AES256-SHA cipher suites, but that was probably the result of those suites being preferred by the major email providers. When counted by unique deployments, the majority of servers used DHE-RSA-AES128-SHA.

The second most prevalent cipher suite by unique server IP addresses was AES128-SHA, which is concerning because it does not provide perfect forward secrecy, the Facebook researchers said.

The rest is here:
Facebook encourages email providers to deploy STARTTLS encryption to block spy agencies