Category Archives: Encryption
How To Secure Microsoft Windows 10 In Eight Easy Steps – Forbes
Searching for the best way to secure Windows 10? Here are eight expert tips.
A guy walks into a bar full of nerds and says, "how do I secure my Windows 10 PC?" and the nerds reply, "install Linux." Funny, but not that helpful for the vast majority of people who are quite happy with their Windows 10 computer but want to make it a bit more secure. Thankfully, it's not that hard to accomplish. All you have to do is follow these eight easy steps. No nerds required.
Love it or loathe it, Microsoft Windows has been the most common non-smartphone operating system since before many of you reading this even owned your first computer. That's just a simple fact. It's also a fact that Windows in general, and that includes Windows 10, has had more than its fair share of security scares. During 2019 I have reported on "devious and evil" malware that can bypass Windows 10 security software, a hidden backdoor being used by APT attack groups, critical zero-day threats to Windows 10 users, a Windows threat that even the U.S. Government warned about and, yes, the seemingly never-ending stream of Windows 10 update problems.
Yet, and I'm risking the wrath of Windows XP or Windows 7 aficionados who will no doubt beg to differ, Windows 10 is almost certainly the most secure version of the OS to date. In which case, why do you need a guide to secure it? Good question and the simple answer is that you can always improve on what you've got when it comes to securing a Windows computer. Be it fresh out of the box when you'll need to get the security configurations right, or after years of ownership when you may well have tweaked those settings in a less secure direction.
I asked a bunch of security experts to share their top tips for securing Windows 10, in all flavors from Windows 10 Home through to Pro and beyond. Here's the sum of that hard-earned knowledge distilled down to eight easy steps to secure Windows 10; some are aimed more at business users, others at consumers but most apply to everyone.
Think of this as a Windows 10 security tips pick and mix.
"It's absolutely essential that you turn on disk encryption," Richard Henderson, head of global threat intelligence at Lastline, says. While both Windows 10 Pro and Windows 10 Enterprise include BitLocker, Windows 10 Home doesn't.That said, "all versions of Windows include some version of disk encryption," Henderson says, "and there are many free options out there online as well." Enabling full disk encryption minimizes the chance that data on your computer will ever be misused. Once you have enabled BitLocker, or whatever full disk encryption solution you choose, remember to "keep the recovery key securely locked away on both USB storage and paper," says Matt Aldridge, principal solutions architect at Webroot.
"Use a local login account, not your Windows account, to log onto your machine," Ciaran Byrne, head of platform Operations at Edgescan, says. Although Windows 10 Home will default to your Windows account, as this makes it easier to log in across all devices with one account, Byrne says, "the problem is that if, say, your Hotmail credentials were compromised, then your machine would also be compromised."
Consider enabling Controlled Folder Access, Chris Doman, a security researcher for AT&T Alien Labs, says, "to limit the damage caused by ransomware. This is available in all editions of Windows 10."
"Turn on Windows Hello," Joe Morley, a future workplace consultant at SoftwareONE, says, "one of the simplest ways for small businesses to secure Windows 10 is by turning on the Windows Hello feature." This enables users to unlock devices with facial recognition and fingerprint readers, bypassing passwords which are more likely to be hacked or stolen. "Of course, pins can still be held for backup," Morley says, "but Windows Hello provides a method of logging in that is not only faster but more secure."
"Enable Windows Defender," Ciaran Byrne, head of platform Operations at Edgescan, says, "this is as good as any paid-for antivirus on the market and is maintained by the people who should know Windows 10 better than anyone else." It's good to enable the built-in firewall as well, to block any unwanted intrusions. "Block, block, block and unblock piece by piece later if you encounter any problems due to firewall rules," Byrne says. Enable the Windows Defender real-time protection and set up virus and threat protection scanning. "If you have inadvertently downloaded a malicious file," Byrne says, "having the proper protection in place can help remove these before your system is compromised and a hacker takes control."
"Set up separate user accounts and don't use ones with Administrator privileges for your day-to-day needs," says Ken Underhill, a master instructor at Cybrary, "unless your day-to-day requires it, of course." Matt Aldridge, the principal solutions architect at Webroot, says the ideal is to have one admin account that you "only use for installing new software or updates," while keeping an unprivileged user account for everything else. "Obviously, ensure unique and secure passwords are used for both accounts," Aldridge says. If admin privileges are required when installing software, say, you won't have to swap accounts as Windows 10 will pop up a box asking for the admin password if you want to proceed. Simple and secure, just the way I like it.
"Keep Windows 10 updated automatically," Joe Morley, a future workplace consultant at SoftwareONE, says, "Windows 10 is delivered as-a-service so it updates continually." This may be a controversial suggestion to some, given the warnings that have flowed regarding the Windows Update Assistant and Windows updates borking things including Windows Defender on occasion. Yet I agree with Morley; your computer is far more secure with Windows updates applied than without them. Businesses should "deploy upgrades in test environments initially to ensure safety," David Higgins, technical director (EMEA) at CyberArk, says, "because it allows security teams to check and verify that patches are safe to roll out to the entire business." For everyone else, though, instant access to security fixes is the trump card of automatic updating.
Backing up your data should be part of every security strategy for if things do go wrong. "Use a trusted cloud backup service to continuously backup your data, Matt Aldridge, principal solutions architect at Webroot, says, "and keep an offline copy of your critical files locally, ideally in a fire safe." You should also ensure that System Restore is enabled, and that restore points are being successfully created. "This is advice that people typically ignore until it happens to them, but it's still sage advice," Richard Henderson, head of global threat intelligence at Lastline, says, "and it's equally applicable to home and office users." Having a "cold" (offline) backup "ensures that you're triple-protected against a ransomware attack, a hardware failure, or the theft of your device," Henderson says, "an ounce of prevention is worth a pound of cure."
See the article here:
How To Secure Microsoft Windows 10 In Eight Easy Steps - Forbes
Future of Encryption Software Market Reviewed in a New Research Study 2019-2025 – Daily News Reports 24
A leading research firm, Zion Market Research added a latest industry report on "Global Encryption Software Market" consisting of 110+ pages during the forecast period and Encryption Software Market report offers a comprehensive research updates and information related to market growth, demand, opportunities in the global Encryption Software Market.
According to the report the Future of Encryption Software Market Reviewed in a New Research Study 2019-2025
The Encryption Software Market report provides in-depth analysis and insights into developments impacting businesses and enterprises on global and regional level. The report covers the global Encryption Software Market performance in terms of revenue contribution from various segments and includes a detailed analysis of key trends, drivers, restraints, and opportunities influencing revenue growth of the global consumer electronics market.This report studies the global Encryption Software Market size, industry status and forecast, competition landscape and growth opportunity. This research report categorizes the global Encryption Software Market by companies, region, type and end-use industry.
Request a Free Sample Report on Encryption Software Market:https://www.zionmarketresearch.com/sample/encryption-software-market
The Encryption Software Market report mainly includes the major company profiles with their annual sales & revenue, business strategies, company major products, profits, industry growth parameters, industry contribution on global and regional level.This report covers the global Encryption Software Market performance in terms of value and volume contribution. This section also includes major company analysis of key trends, drivers, restraints, challenges, and opportunities, which are influencing the global Encryption Software Market. Impact analysis of key growth drivers and restraints, based on the weighted average model, is included in this report to better equip clients with crystal clear decision-making insights.
The Encryption Software Market research report mainly segmented into types, applications and regions.The market overview section highlights the Encryption Software Market definition, taxonomy, and an overview of the parent market across the globe and region wise.To provide better understanding of the global Encryption Software Market, the report includes in-depth analysis of drivers, restraints, and trends in all major regions namely, Asia Pacific, North America, Europe, Latin America and the Middle East & Africa, which influence the current market scenario and future status of the global Encryption Software Market over the forecast period.
Get Free PDF Brochure of this Report: https://www.zionmarketresearch.com/requestbrochure/encryption-software-market
The Encryption Software Market report provides company market size, share analysis in order to give a broader overview of the key players in the market. Additionally, the report also includes key strategic developments of the market including acquisitions & mergers, new product launch, agreements, partnerships, collaborations & joint ventures, research & development, product and regional expansion of major participants involved in the market on the global and regional basis.
Major Company Profiles Covered in This Report:
BM, Microsoft, Sophos ltd, Gemalto, Net App Inc, Hewlett- Packard, Vormetric, Oracle, Intel and Symantec
Some of the major objectives of this report:
1) To provide detailed analysis of the market structure along with forecast of the various segments and sub-segments of the global Encryption Software Market.
2. To provide insights about factors affecting the market growth. To analyze the Encryption Software Market based on various factors- price analysis, supply chain analysis, porter five force analysis etc.
3. To provide historical and forecast revenue of the Encryption Software Market segments and sub-segments with respect to four main geographies and their countries- North America, Europe, Asia, and Rest of the World.
4. Country level analysis of the market with respect to the current market size and future prospective.
5. To provide country level analysis of the market for segment by application, product type and sub-segments.
6. To provide strategic profiling of key players in the market, comprehensively analyzing their core competencies, and drawing a competitive landscape for the market.
7. Track and analyze competitive developments such as joint ventures, strategic alliances, mergers and acquisitions, new product developments, and research and developments in the global Encryption Software Market.
About Us:
Zion Market Research is an obligated company. We create futuristic, cutting edge, informative reports ranging from industry reports, company reports to country reports. We provide our clients not only with market statistics unveiled by avowed private publishers and public organizations but also with vogue and newest industry reports along with pre-eminent and niche company profiles. Our database of market research reports comprises a wide variety of reports from cardinal industries. Our database is been updated constantly in order to fulfill our clients with prompt and direct online access to our database. Keeping in mind the clients needs, we have included expert insights on global industries, products, and market trends in this database. Last but not the least, we make it our duty to ensure the success of clients connected to usafter allif you do well, a little of the light shines on us.
Contact Us:
Zion Market Research
244 Fifth Avenue, Suite N202
New York, 10001, United States
Tel: +49-322 210 92714
USA/Canada Toll Free No.1-855-465-4651
Email: sales@zionmarketresearch.com
Website: https://www.zionmarketresearch.com
Sorry! The Author has not filled his profile.
Read more here:
Future of Encryption Software Market Reviewed in a New Research Study 2019-2025 - Daily News Reports 24
Examine Mobile Encryption Market expected to obtain $2,917.9 million by 2022 – WhaTech – WhaTech
Mobile Encryption Market report provides detailed synopsis about opportunities, competitive landscape, emerging technologies, key trends and dynamics.
According to a new market research report"Mobile Encryption Marketby Component (Solution and Services), Application (Disk Encryption, File/Folder Encryption, Communication Encryption, and Cloud Encryption), End-User Type, Deployment Type, Vertical, and Region - Global Forecast to 2022" published by MarketsandMarkets, the Mobile Encryption Market size expected to grow from USD 761.4 Million in 2017 to USD 2,917.9 Million by 2022, at a Compound Annual Growth Rate (CAGR) of 30.8%.
Browse in-depth TOC on"Mobile Encryption Market66- Tables 57- Figures 143- Pages
Make an Enquiry @ http://www.marketsandmarkets.com/Enquiry=120317676
The key forces driving the Mobile Encryption Market include the proliferation of smartphones and tablets across enterprises, need for stringent compliance and regulatory requirements, and increased concerns for data security and privacy issues. Moreover, with the subsequent increase in the adoption rate of cloud-based mobile encryption solutions, the Mobile Encryption Market is expected to gain a major traction during the forecast period.
Disk encryption application is expected to have the largest market share in 2017.
Disk encryption is expected to have the largest market share and dominate the Mobile Encryption Market from 2017 to 2022, due to growing demands for hardware-based encryptions that ensure data security at the source. With the increase in the BYOD trend, employees have the freedom to carry personal devices and exchange of critical data via personal devices is made possible.
Adoption of strong encryptions can protect the confidential data, even if an employees device is lost or stolen.
Telecom sector isexpected to grow at the highest rate during the forecast period.
Telecom and healthcare sectors are expected to grow at the highest CAGRs from 2017 to 2022, in the Mobile Encryption Market, due to the increase in the amount of personal and health-related data being stored on cell phones, tablets, and the Internet. The majority of the telecom companies rely on communication encryption for securing the data in motion, such as calls and messages for their customers.
North America is expected to contribute to the largest market share; Asia Pacific to grow the fastest during the forecast period.
North America is expected to have the largest market share and dominate the Mobile Encryption Market from 2017 to 2022, owing to the early adoption of new and emerging technologies and the presence of a large number of players in this region. APAC offers extensive growth avenues in the Mobile Encryption Market, owing to a widespread presence of SMEs that are implementing enhanced mobile encryption solutions to prevent unauthorized access to critical business data and unethical use of confidential information.
Download PDF Brochure @ http://www.marketsandmarkets.com/pdfdown=120317676
The major vendors providing mobile encryption solutions are Adeya SA (Morges, Switzerland), AlertBoot Data Security (Las Vegas, US), Becrypt, Ltd. (London, UK), BlackBerry Ltd. (Ontario, Canada), CSG, Inc.(Washington, US), Certes Networks, Inc. (Pennsylvania, US), Check Point Software Technologies, Ltd.(Tel Aviv, Israel), DataMotion, Inc. (New Jersey, US), Dell Technologies, Inc.(Texas, US), ESET (Bratislava, Slovakia), Gold Line Group Ltd. (Israel), Hewlett Packard Enterprise (California, US), Huawei Technologies Co.Ltd. (Shenzhen, China), IBM Corporation (New York, US), Intel Corporation (California, US), KoolSpan, Inc. (Maryland, US), MobileIron, Inc.(California, US), Open Whisper Systems (California, US), Proofpoint, Inc. (California, US), SecurStar (Munich, Germany), Silent Circle, LLC (Le Grand-Saconnex, Switzerland), Sophos Ltd.(Abingdon, UK), Symantec Corporation (California, US), T-Systems International GmbH (Frankfurt, Germany), and Zix Corporation (Texas, US).
For More Details:
MnM Blog: mnmblog.org
Content Source: http://www.marketsandmarkets.com/PressReyption.asp
This email address is being protected from spambots. You need JavaScript enabled to view it.
Go here to read the rest:
Examine Mobile Encryption Market expected to obtain $2,917.9 million by 2022 - WhaTech - WhaTech
Facebook’s end-to-end encryption will enhance user privacy but its not good news for law enforcement – Firstpost
The ConversationDec 16, 2019 16:16:27 IST
Facebook isplanning end-to-end encryption on all its messaging servicesto increase privacy levels. The tech giant startedexperimentingwith thisearlier this year. Soon, end-to-end encryption will be standard for every Facebook message.
But Australian, British and United States governments andlawmakersarenthappy about it. They fear it will make it impossible to recover criminal conversations from Facebooks platforms, thus offering impunity to offenders.
For instance, this was a major concern followingthe 2017 London terror attacks. Attackers used WhatsApp (Facebooks end-to-end encrypted platform), and this frustrated police investigations.
Image: Reuters
But does Facebooks initiative place the company between a political rock and an ethical hard place?
(Also read:Facebook to encrypt conversations on more of its messaging services: Mark Zuckerberg)
End-to-end encryptionis a method of communicating more securely, compared to non-encrypted communications. It involves using encryption (via cryptographic keys) that excludes third parties from accessing content shared between communicating users.
When the sender wants to communicate with the receiver, they share a uniquealgorithmic key to decryptthe message. No one else can access it, not even the service provider.
Facebooks plan toenact this change is paradoxical, considering the company has a history ofharvesting user dataandselling it to third parties. Now, it supposedly wants to protect the privacy of the same users.
One possible reason Facebook is pushing for this development is because it will solve many ofits legal woes. With end-to-end encryption, the company will no longer havebackdooraccess to users messages.
Thus, it wont be forced to comply with requests from law enforcement agencies to access data. And even if police were able to get hold of the data, they would still need the key required to read the messages.
Only users would have the ability to share the key (or messages) with law enforcement.
(Also read: Facebook is requested not to use encrypted messages as it does not let officials peek)
Implementing end-to-end encryption will positively impact Facebook users privacy, as their messages will be protected from eavesdropping. This means Facebook, law enforcement agencies and hackers will find it harder to intercept any communication done through the platform.
And although end-to-end encryption is arguably not necessary for most everyday conversations, it does haveadvantages, including:
1) protecting users personal and financial information, such as transactions on Facebooku Marketplace
2) increasing trust and cooperation between users
3) preventing criminals eavesdropping on individuals to harvest their information, which can render them victim tostalking, scamming and romance frauds
4) allowing those with sensitive medical, political or sexual information to be able to share it with others online
5) enabling journalists and intelligence agencies to communicate privately with sources.
(Also read:Facebooks end-to-end encryption could come to an end as us, UK fight child abuse and terrorism)
However, even though end-to-end encryption will increase users privacy in certain situations, it may still not be enough to make conversations completely safe.
This is because the biggest threat to eavesdropping is the very act of using a device.
End-to-end encryption doesntguaranteethe people we are talking to online are who they say they are.
Also, while cryptographic algorithms are hard to crack, third parties can stillobtain the key to open the message. For example, this can be done by using apps totake screenshotsof a conversation, and sending them to third parties.
When Facebook messages become end-to-end encrypted, it will beharder to detect criminals, including people who use the platform to commitscamsand launchmalware.
Others use Facebookfor humanor sex trafficking, as well aschild groomingandexploitation. Facebook Messenger can also helpcriminals organise themselves, as well as plan and carry out crimes, including terror attacks and cyber-enabled fraud extortion hacks.
The unfortunatetrade-offinincreasing user privacyis reducing the capacity for surveillance and national security efforts. End-to-end encryption on Facebook would also increase criminals feeling ofsecurity.
However, although tech companies cant deny the risk of having their technologies exploited for illegal purposes they also dont have acomplete duty to keep a particular countrys cyberspace safe.
A potential solution to the dilemma can be found in variouscritiquesof theUKs 2016 Investigatory Powers Act. It proposes that, on certain occasions, a communications service provider may be asked to remove encryption (where possible). However, this power must come from an authority thatcan be held accountablein court for its actions, and this should be used as a last resort.
In doing so, encryption will increase user privacy without allowing total privacy, which carriesharmful consequences. So far, several governments have pushed back against Facebooks encryption plans, fearing it will placethe company and its users beyond their reach, and make it more difficult tocatch criminals.
End-to-end encryption is perceived as a bulwark for surveillance by third parties and governments, despiteother ways of intercepting communications. Many also agree surveillance is not onlyinvasive, but also prone to abuseby governments and third parties.
Freedom from invasive surveillance alsofacilitates freedom of expression, opinion and privacy, as observed by the United Nations High Commissioner for Human Rights. In a world where debate is polarised by social media, Facebook and similar platforms are caught amid the politics of security. Its hard to say how a perfect balance can be achieved in such a multifactorial dilemma. Either way, the decision is a political one, and governments as opposed to tech companies should ultimately be responsible for such decisions.
Roberto Musotto, Cyber Security Cooperative Research Centre Postdoctoral Fellow, Edith Cowan UniversityDavid S. Wall, Professor of Criminology, University of Leeds
This article is republished fromThe Conversationunder a Creative Commons license. Read theoriginal article.
Find latest and upcoming tech gadgets online on Tech2 Gadgets. Get technology news, gadgets reviews & ratings. Popular gadgets including laptop, tablet and mobile specifications, features, prices, comparison.
See the original post:
Facebook's end-to-end encryption will enhance user privacy but its not good news for law enforcement - Firstpost
Fortanix expert on how European companies are taking back control of their data in the cloud – Intelligent CIO ME
When running workloads with sensitive and regulated data in the cloud, organisations are seeking greater options to enable them to protect and control that data themselves. Faiyaz Shahpurwala, Chief Product Officer at Fortanix, tells us how, by taking control of their encryption keys, organisations will be able complete their Digital Transformation journeys and start applying the benefits of the cloud for their most sensitive and essential assets.
Cloud technology has redefined the business world in recent years, with IDC finding that 90% of organisations now have at least some of their applications or infrastructure hosted in the cloud and the remainder expected to catch up by 2021.
The increased flexibility, agility and cost-savings offered bymoving to the cloud mean there are few reasons for organisations to hold back.One of the last barriers for public cloud adoption is concern around securityand data protection. While most firms now have at least some of theiroperations based in the cloud, many are still reluctant when it comes to theirmost sensitive data and mission critical assets.
Why are public clouds a security concern?
Working with a third-party cloud provider necessitates a certain loss of control and a large degree of trust. If a cloud host is not properly configured and secured, it will leave the data of its customers vulnerable to being breached by threat actors. Data security regulations such as GPDR also make it clear that an organisation is still responsible for any data breach involving a third party, so firms must ensure they carry out due diligence on their chosen cloud providers.
One of the most important elements of good cloud security is the proper use of encryption. When it comes to data security compliance, GDPR, as well as others such as the upcoming California Consumer Protection Act (CCPA) maintain that firms will not be subject to penalties if they suffer a data breach, but only if the information has been encrypted.
However, encryption is only an effective defence if the cryptographic keys that govern access are well defended. Encryption keys are usually held in the cloud as well and if threat actors are able to get their hands on them, they will have free reign to access all of the information on the cloud server.
From a compliance perspective, PCI DSS, the global creditcard security standard, states that encryption keys cannot be held in the cloud,which means any firm that deals with payment details cannot store this data ona public cloud and remain compliant.
Aside from the threat posed by an external intruder, cryptographickeys held on a cloud server are also potentially vulnerable to maliciousinsiders or other third parties. Because the organisation has no control overthe keys, it will also be unable to prevent the provider from giving them up incircumstances such as legal action.
Taking back control of cloud security
The security, privacy and compliance concerns around storingsensitive data in the cloud can all be overcome by organisations taking controlof their encryption keys and keeping them outside of the cloud. By using abring your own keys (BYOK) approach, organisations will be able to store theirkeys in their own preferred data centre.
Taking this tactic will greatly reduce the risk of encryption keys being accessed by cyberattackers or malicious insiders, as well as restoring control when it comes to access issues from other third parties or legal requests. Even if the cloud provider suffers a catastrophic data breach, the data will remain safely encrypted if the keys are secured in a separate data centre.
The additional security assurance created by taking directownership of their cloud encryption keys means that organisations can gain theconfidence to start using their cloud infrastructure to host sensitive data andmission critical assets. For the first time, firms will also be able to begin storingcredit card data in the cloud without falling foul of the PCI DSS.
Managing encryption keys effectively
Taking control of its cloud encryption keys is only a beneficial strategy if the enterprise itself can secure them properly. Firms should take their time when selecting a colocation data centre to hold their keys and ensure their chosen provider has advance security measures in place.
In addition, organisations need to implement an effective encryption key management system for securely generating, storing and using cryptographic keys and certificates. This is particularly important when it comes to managing multi-cloud environments, which has increasingly become the cloud strategy of choice. Recent research from Gartner found that 81% of public cloud users are working with two or more providers.
Businesses will be dealing with different sites at multiplegeographies, as well as potentially different cryptographic processes includingencryption, tokenisation and shared secrets. Alongside this, many firms rely ona hybrid approach that combines on-premise and cloud-based infrastructure.
An effective management tool will make it easier to cutthrough the complexity created by these environments to establish a consistentapproach that ensures there is no oversight or connectivity issues around theuse of encryption keys.
Ideally, organisations should be seeking a key managementsystem that uses a cloud native approach and is designed to be developerfriendly. In particular, it is important to have an accessible API for cloudand dev-ops teams to work with.
While the cloud has become a ubiquitous part of the business world and particularly Digital Transformation, you could argue that were still very much at the beginning of the journey. Just five years ago, most firms were still only doing minor, low risk testing and development on the public cloud. Only now are we at last getting to the point where more critical assets and infrastructure are being migrated over.
By taking control of their encryption keys into their own hands, organisations will be able complete their Digital Transformation journeys and start applying the benefits of the cloud for their most sensitive and essential assets as well.
Read the original post:
Fortanix expert on how European companies are taking back control of their data in the cloud - Intelligent CIO ME
What’s that? Encryption’s OK now? UK politicos Brexit from Whatsapp to Signal – The Register
It's not just the European Union the UK's ruling party wishes to leave. According to the Guardian, the recently victorious Conservative party is switching from WhatsApp to Signal, in order to accommodate its new influx of MPs.
Unlike WhatsApp, which has a hard limit of 256 members for a group, Signal supports an unlimited number of participants.
The switch to Signal will also allow the Conservative party to stem the flow of leaks emerging from its inner circle.
Earlier this year, Buzzfeed published internal WhatsApp conversations that showed trepidation among Tory parliamentarians that members in marginal seats may lose to the Labour party. Other leaked messages highlighted division within the party, particularly over the fundamental issue of Brexit.
For its part, Labour relied on closed WhatsApp groups to disseminate its general election messages widely, with controversial org Momentum using it to issue "WhatsApp cascades" on polling day, shared on with an estimated 400,000 "young people", amongst other allegations about secret WhatsApp groups.
Like WhatsApp, Signal has end-to-end encryption baked in, preventing a foreign power or individual from accessing sensitive conversations. In addition, it also includes settings, which, when enabled, self-destructs messages after a period of time.
Unfortunately, Signal doesn't allow group moderators to block individuals from taking screenshots, which would frustrate the process of leaking a conversation to the press.
There is a tinge of irony in politicians adopting an encrypted messaging system like Signal.
British government officials have for years called upon tech firms to break encryption to facilitate the access of conversations to law enforcement most notably former Home Sec and PM Theresa May, and later former Home Sec Amber Rudd but more lately current UK Home Secretary Priti Patel.
Erstwhile Prime Minister David Cameron even proposed banning online messaging applications that support end-to-end encryption.
That notwithstanding, Signal is increasingly used in governmental spheres. In 2017, the US Senate Sergeant at Arms approved the app as a communications tool for staffers and legislators alike.
The app has also been endorsed by Edward Snowden, the fugitive former CIA employee, who disclosed the depth of US government surveillance against the general public.
Sponsored: Beyond the Data Frontier
Original post:
What's that? Encryption's OK now? UK politicos Brexit from Whatsapp to Signal - The Register
NYPD radio encryption most likely wont happen in 2020 but will soon – amNY
After amNewYork reported this week of the NYPDs plans to encrypt police radios in 2020, police officials said Thursday that it would likely not move forward with encryption for at least a year.
Moreover, police brass indicated that they are open to discussion as to who, outside of the Police Department, would have access to encrypted communications.
Encryption could potentially cut off media groups who currently monitor police radio feeds for breaking news. Outlets would then have to rely upon releases from the NYPD and statements from its officials.
Elected officials, none of whom seemed to know about the multi-million dollar encryption plan, have expressed fears of encryption, as it might significantly reduce transparency of the department. Mayor Bill de Blasios administration has emphasized greater transparency at the NYPD for most of his tenure.
Members of volunteer fire and ambulance squads around the city also use police radios to monitor for trouble, and many of them expressed doubts about the plan, fearing that they too would be cut off.
But on Dec. 19, NYPD Deputy Commissioner for Counter-Terrorism John Miller said encryption would happen in a three- to five-year transition.
So nothings happening today, nothings happening tomorrow, and probably nothings happening next year, Miller said. This is a lot of radios.
Commissioner Dermot Shea said there must be a balance between police officer safety and transparency to the public.
It is an interesting time after just what just happened in Jersey City, Shea said, referring to the Dec. 11 terrorist attack that killed six. With traditional crime and now traditional criminals using encryption, we cant have situation where criminals have better technology than police officers and detectives whether they are drug dealers or breaking into banks. Criminals are using encryption. We should certainly consider transparency, but the priority for keeping New Yorkers safe.
Miller acknowledged some investigative channels are already encrypted to safeguard investigations, as are Federal investigative channels including Drug Enforcement administration, secret service and FBI.
Any further encryption is open to more discussion at this point with a 3-5 year transition, he said. Part of the thinking and planning is where would it be advantageous to say officer safety, the integrity of investigations the commissioner gives the example of a kidnapping, how do you conduct one of those over the radio when the world is listening for entertainment? Its something we are looking at nothing that is happening right away.
Miller, a former journalist himself, noted that There have been other cities gone encrypted, and theyve made arrangements with news media that have made sense. If we ever get to the point where we are going to that level, Im sure that discussion will take place.
Miller testified Wednesday at the City Council Public Safety Committee over proposed legislation, Intro. 487, that would create comprehensive reporting and oversight of NYPD surveillance technologies. The NYPD took a stand against the bill, saying providing detailed information on technology would tip off criminals and terrorists and allow them to thwart investigations.
Sample of a police radio scanner system in action.
See the original post:
NYPD radio encryption most likely wont happen in 2020 but will soon - amNY
If You Think Encryption Back Doors Won’t Be Abused, You May Be a Member of Congress – Reason
The FBI was way too lax when it sought a secret warrant to wiretap former Trump aide Carter Page. Yet some of the very same people who have been publicly aghast at the circumstances Page scandal are still trying to hammer companies like Apple and Facebook into compromising everybody's data security to give law enforcement access to your stuff.
You're forgiven if you missed this news, as it happened at the exact same time last week that the impeachment countsagainst President Donald Trump were revealed. Our extremely tech-unsavvy lawmakers brought in a few experts to a Senate Judiciary Committee hearing and essentially ignored what they said and yelled demands at them. Virtually every tech expert and privacy advocate under the sun has warned virtually every government official in the world that "back doors" that let police bypass encryption has the potential to cause huge harms and actually makes citizens even more vulnerable to crime. But the legislators want their back doors, dammit.
Here's Sen. Lindsey Graham (RS.C.), who just a day later would express shock that the process for the FBI to get a FISA warrant was not as thorough as he believed: "My advice to you is to get on with it, because this time next year, if we haven't found a way that you can live with, we will impose our will on you." When a witness attempted to explain how complicated an issue encryption is, Graham responded, "Well, it ain't complicated for me."
The Democrats haven't been impressive on this issue either. Sen. Dianne Feinstein (DCalif.) still holds the position that it's no big deal if tech companies just let law enforcement officials in to read encrypted material, as long as they've got a warrant. Sen. Dick Durbin (DIll.) thinks the debate is about whether encryption implemented by companies puts information "beyond the reach of the law." He doesn't seem to care about the arguments that weakening encryption and providing back doors will let hackers and hostile nations access the private data and communications of people around the world (including Americans).
The talking point both the Justice Department and the lawmakers have settled on is that they need to be able demand back doors for the children. Apparently, we all need weaker protections in order to fight child sexual abuse and trafficking.
Sen. Sheldon Whitehouse (DR.I.) asked the tech industry witnesses if they'd be willing to "take responsibility for the harm" that might be caused if law enforcement didn't have back door access. But is Congress and the Justice Department going to "take responsibility for the harm" when these vulnerabilities make it out into the wild (as they inevitably would) and are abused by criminals or by authoritarian states?
This encryption fight has been going on for years, and the back door advocates has resolutely refused to consider the possibility of abuse. Graham in particular has been unwilling to consider the possibility that FISA warrants could ever be used to secretly snoop on Americans inappropriately. But by Thursday, he had changed his tune; if nothing else, the Trump case has forced him to think about what can go wrong when the government can secretly access people's private information without their permission.
Visit link:
If You Think Encryption Back Doors Won't Be Abused, You May Be a Member of Congress - Reason
Facebook’s Push for End-to-End Encryption Is Good News for User Privacy, as Well as Terrorists and Paedophiles – Nextgov
Facebook is planning end-to-end encryption on all its messaging services to increase privacy levels.
The tech giant started experimenting with this earlier this year. Soon, end-to-end encryption will be standard for every Facebook message.
But Australian, British and United States governments and law makers arent happy about it. They fear it will make it impossible to recover criminal conversations from Facebooks platforms, thus offering impunity to offenders.
For instance, this was a major concern following the 2017 London terror attacks. Attackers used WhatsApp (Facebooks end-to-end encrypted platform), and this frustrated police investigations.
But does Facebooks initiative place the company between a political rock and an ethical hard place?
What is end-to-end encryption?
End-to-end encryption is a method of communicating more securely, compared to non-encrypted communications.
It involves using encryption (via cryptographic keys) that excludes third parties from accessing content shared between communicating users.
When the sender wants to communicate with the receiver, they share a unique algorithmic key to decrypt the message. No one else can access it, not even the service provider.
The Real Incentive
Facebooks plan to enact this change is paradoxical, considering the company has a history of harvesting user data and selling it to third parties.
Now, it supposedly wants to protect the privacy of the same users.
One possible reason Facebook is pushing for this development is because it will solve many of its legal woes.
With end-to-end encryption, the company will no longer have backdoor access to users messages.
Thus, it wont be forced to comply with requests from law enforcement agencies to access data. And even if police were able to get hold of the data, they would still need the key required to read the messages.
Only users would have the ability to share the key (or messages) with law enforcement.
Points in Favour
Implementing end-to-end encryption will positively impact Facebook users privacy, as their messages will be protected from eavesdropping.
This means Facebook, law enforcement agencies and hackers will find it harder to intercept any communication done through the platform.
And although end-to-end encryption is arguably not necessary for most everyday conversations, it does have advantages, including:
1) protecting users personal and financial information, such as transactions on Facebook Marketplace
2) increasing trust and cooperation between users
3) preventing criminals eavesdropping on individuals to harvest their information, which can render them victim to stalking, scamming and romance frauds
4) allowing those with sensitive medical, political or sexual information to be able to share it with others online
5) enabling journalists and intelligence agencies to communicate privately with sources.
Not Foolproof
However, even though end-to-end encryption will increase users privacy in certain situations, it may still not be enough to make conversations completely safe.
This is because the biggest threat to eavesdropping is the very act of using a device.
End-to-end encryption doesnt guarantee the people we are talking to online are who they say they are.
Also, while cryptographic algorithms are hard to crack, third parties can still obtain the key to open the message. For example, this can be done by using apps to take screenshots of a conversation, and sending them to third parties.
A Benefit for Criminals
When Facebook messages become end-to-end encrypted, it will be harder to detect criminals, including people who use the platform to commit scams and launch malware.
Others use Facebook for human or sex trafficking, as well as child grooming and exploitation.
Facebook Messenger can also help criminals organise themselves, as well as plan and carry out crimes, including terror attacks and cyber-enabled fraud extortion hacks.
The unfortunate trade-off in increasing user privacy is reducing the capacity for surveillance and national security efforts.
End-to-end encryption on Facebook would also increase criminals feeling of security.
However, although tech companies cant deny the risk of having their technologies exploited for illegal purposes they also dont have a complete duty to keep a particular countrys cyberspace safe.
What to do?
A potential solution to the dilemma can be found in various critiques of the UKs 2016 Investigatory Powers Act.
It proposes that, on certain occasions, a communications service provider may be asked to remove encryption (where possible).
However, this power must come from an authority that can be held accountable in court for its actions, and this should be used as a last resort.
In doing so, encryption will increase user privacy without allowing total privacy, which carries harmful consequences.
So far, several governments have pushed back against Facebooks encryption plans, fearing it will place the company and its users beyond their reach, and make it more difficult to catch criminals.
End-to-end encryption is perceived as a bulwark for surveillance by third parties and governments, despite other ways of intercepting communications.
Many also agree surveillance is not only invasive, but also prone to abuse by governments and third parties.
Freedom from invasive surveillance also facilitates freedom of expression, opinion and privacy, as observed by the United Nations High Commissioner for Human Rights.
In a world where debate is polarised by social media, Facebook and similar platforms are caught amid the politics of security.
Its hard to say how a perfect balance can be achieved in such a multifactorial dilemma.
Either way, the decision is a political one, and governments - as opposed to tech companies - should ultimately be responsible for such decisions.
Roberto Musotto is a Cyber Security Cooperative Research Centre postdoctoral fellow at the Edith Cowan University and David S. Wall is a professor of criminology at the University of Leeds
This article is republished from The Conversation under a Creative Commons license. Read the original article.
Excerpt from:
Facebook's Push for End-to-End Encryption Is Good News for User Privacy, as Well as Terrorists and Paedophiles - Nextgov
The decline of passwords, the rise of encryption and deepfakes cybersecurity predictions for 2020 – BetaNews
It's the time of year again where the great and good of the tech sector like to consult the tea leaves, gaze into the crystal ball, read the runes -- and of course draw on their industry knowledge -- to give their predictions for the year ahead.
So, what do they think is in store for cybersecurity in 2020?
The decline of the password has been on the horizon for a while, but Ben Goodman, CISSP and SVP of global and corporate development at ForgeRockbelieves 2020 will mark the beginning of the end. "Consumers already log in to dozens of protected resources everyday: from email, banking and financial accounts, social media, healthcare, government accounts, and beyond. Even when tools like TouchID are leveraged each of these resources currently still have an associated username and password that can be attacked. To save time and remember their credentials for all these sites, consumers reuse the same username and password across several sites. As a result, the user's exposure from any one security breach on one of those profiles dramatically increases the odds that additional accounts can be compromised as well, allowing attackers to access far more sensitive information."
This is echoed by Clayton Calvert, a consultant at IT security and risk assessment firm netlogx. "With passwordless authentication, IT reclaims its purpose of having complete visibility over identity and access management. Reuse and sharing are common issues in password-based authentication. Without passwords, there is nothing to phish, share, or reuse. The user is no longer a wild card in an organization's access scheme. It is this crucial element that gives passwordless solutions their security advantage. As an added benefit, GDPR prefers that companies use passwordless authentication to eliminate the storing and securing of passwords exchanged over the network. While consumers have used this technology for a number of years in Apple and Samsung products, companies are beginning to do so as well. Sixty percent of large enterprises and nearly all of midsize organizations will use passwordless authentication by 2020."
With the decline of the password though the rise of deepfakes becomes a greater concern. CEO of Jumio, Robert Prigge says, "With a reported 50 percent of consumers using the same credentials across multiple accounts, automated account takeover attacks will continue to run rampant in 2020. As the industry abandons outdated authentication methods that are easily susceptible to fraud, like SMS-based 2FA and knowledge-based authentication, and turn to more advanced, biometric-based authentication methods as a secure alternative, the rise of deepfake technology will become a larger concern. A deepfake superimposes existing video footage or photographs of a face onto a source head and body using advanced neural network powered AI -- and are relatively easy to create. In 2020, we will see an increase in deepfake technology being weaponized for fraud as biometric-based authentication solutions are widely adopted. Even more concerning is that many digital identity verification solutions are unable to detect and prevent deepfakes, bots and sophisticated spoofing attacks."
Deepfakes raise other concerns too according to Optiv Security, "There has been much publicity around the potential to impact elections using deepfakes (AI-doctored videos that enable individuals to make it appear people said things they never said). However, not enough attention has been paid to how cybercriminals can make money using deepfakes against businesses. This will change in 2020 as we expect to see the first deepfake attacks designed to impact stock prices, by having CEOs, financial analysts, Federal Reserve leaders or other powerful economic figures make phony statements that will cause stock market movements. Cybercriminals will use these videos to make quick killings in the market."
2020 is also set to be the year of encryption according to Peter Galvin, vice president strategy and marketing at nCipher Security. "In the US, lawmakers on Capitol Hill have re-energized a push for encryption backdoors, an initiative that is seeing bipartisan support. Internationally, the UK and Australian governments (in addition to the US government) are pressuring Facebook to scrap plans for end-to-end encryption of Facebook Messenger. Galvin adds, Consumers, meanwhile, want more control and privacy over their data yet are often left confused about what that really means and how to make it a reality. Also factoring into the encryption conversation is the protection of voter information leading up to the US election and advancements in facial recognition software."
We can also expect to see more attacks aimed at critical infrastructure and governments according to Alex Heid, chief research officer at SecurityScorecard. "Malicious nation-state actors will continue to focus on malware and ransomware attacks. Nation-state actors don't just want to sell cardholder data on the Dark Web, theyre targeting critical infrastructure such as electricity and water companies.
"In August of 2019, emails sent to US utilities companies contained a remote access trojan as part of a spear phishing campaign. The advanced persistent threat is another in a long line of attacks targeting critical infrastructure.
"With at least thirteen global presidential elections scheduled for 2020, we can expect to see more malware and ransomware attacks attempting to undermine voters confidence."
The ongoing skills shortage will add to problems says Bret Fund, head of cybersecurity at training specialist Flatiron School, "While the average pay for cybersecurity positions in North America is $90,000, pay levels in some areas -- such as local and federal government -- is below what's needed to attract and retain skilled talent. With healthcare, financial services and other large enterprises making it more lucrative for qualified cybersecurity professionals to work in their organizations, local government will be faced with a great cybersecurity skills shortage. Local government agencies will have to think creatively about how they can re-skill their current employee base to meet their cybersecurity needs."
Healthcare is set to come under attack too says Mike Riemer, chief security architect at Pulse Secure, "It is already well-understood that the healthcare industry struggles to secure its trove of sensitive data. But, even as widely discussed as this issue is, the healthcare industry has been slow to adopt effective security measures and quick to embrace an even greater influx of data during digital transformation efforts. As healthcare continues to evolve towards the convenient, self-service model that todays digital-first consumer demands, there will be serious security implications as companies try to control the release of data and information. For example, telemedicine is making patient care extremely convenient, but is the doctor-patient communication secured and encrypted? If not, anyone can intercept the data and communication in transit. How do you secure that information stored on the end-user's phone? The security of any network is only as strong as the weakest link. In this service model, the end-point device is most likely to be compromised and healthcare organizations need to ensure they are meeting all the security and regulatory requirements."
Are there other trends that you think will affect cybersecurity in 2020? Let us know.
Photo Credit: vinzstudio/Shutterstock
Visit link:
The decline of passwords, the rise of encryption and deepfakes cybersecurity predictions for 2020 - BetaNews