Category Archives: Encryption
Hedvig storage upgrade adds flash tier, encryption options – TechTarget
Hedvig Inc. today launched the third version of its software-defined storage product featuring support for flash tiering, built-in encryption technology and new plug-ins for third-party backup and container technologies.
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.
Hedvig storage software runs on commodity hardware. Hedvig doesn't sell the hardware, but it supports moving data between fast flash-based SSDs and a tier of slower, less expensive HDDs. Hedvig's new FlashFabric enables two storage tiers in all-SSD server clusters that can span on-premises and public cloud environments.
Hedvig Distributed Storage Platform 3.0 detects performance differences in SSDs, according to Rob Whiteley, Hedvig vice president of marketing. He said those SSDs can be traditional SAS or SATA, newer latency-lowering NVMe-based PCI Express, or emerging 3D XPoint technology from Intel and Micron.
Our system has always been very flash-friendly from a write perspective. There were just some additional things we wanted to do from a read perspective. Rob Whiteleyvice president of marketing, Hedvig
"There are configurations where the customer will have some amount of higher performance, higher cost NVMe flash, plus some amount of more traditional enterprise-grade flash," Whiteley said. "And what they actually want is the ability to automatically tier in and out of different flavors of flash."
Howard Marks, founder and chief scientist at storage test lab DeepStorage LLC, said Hedvig's 3.0 release is not major from a technological standpoint, but the company is early with its support for "all-flash hybrids" with more than one type of SSD.
"The majority of the all-flash systems we see today have one pool of flash. But between NVMe and upcoming post-flash memories like 3D XPoint, we are going to have at least two tiers of solid state," Marks said. "That means folks like Hedvig, who have the logic for dealing with multiple tiers built into their system, have an advantage."
Whitely said the Hedvig storage software tracks data reads and writes at a granular level to ensure the hottest data lands on the highest performing storage media. To enable the SSD tiering, Hedvig engineers created write-through read caches that could take advantage of different flash tiers, he said.
"Our system has always been very flash-friendly from a write perspective," Whitely said. "There were just some additional things we wanted to do from a read perspective."
New Hedvig storage security features include software-based encryption for data in use, in flight and at rest; advanced audit logging designed to enhance the product's monitoring and analytics engines; and improved multi-tenant role-based access control tying into Lightweight Directory Access Protocol and Microsoft Active Directory.
Hedvig's 256-bit Encrypt360 technology secures data through proxy software deployed on host compute servers to minimize the performance hit. The software supports the Advanced Encryption Standard New Instructions from Intel to accelerate host encryption.
Hedvig software deduplicates data before encryption. As with deduplication and replication, Hedvig enables customers to turn encryption on and off on a per-volume, or virtual disk (vDisk), basis, Whiteley said.
In the past, Hedvig advised customers to use self-encrypting drives or third-party products for in-flight encryption, Whiteley said.
"What we've found in the software-defined storage world is self-encrypting drives are often a generation or two behind in hardware technology, and they're a lot more expensive," he said. "Plus, how you then do the key management becomes a very difficult proposition for a lot of large enterprises."
Hedvig does not supply a key management system. The company tested and validated Amazon Web Services' Key Management Service option, and depending on the API, could plug into other third-party key management systems, according to Whiteley.
When setting up a cluster, the Hedvig storage proxy reaches out to the key management system for a unique encryption key for each vDisk. The vDisk keys are cached at the proxy and stored in Hedvig's metadata engine, according to Eric Carter, the company's senior director of product management.
The third feature set in Hedvig's new 3.0 storage software is CloudScale Plugins for Veritas, VMware and Red Hat products, to add to the company's existing support for Docker and OpenStack.
The new Veritas OpenStorage Technology plug-in will enable NetBackup customers to connect to Hedvig for deduplicated backup storage. Whiteley said the Veritas NetBackup plug-in is "probably the most-requested customer feature besides encryption."
Hedvig already had a VMware vSphere Web Client plug-in, but it is now certified with new backup and security capabilities. In addition, Hedvig Storage Proxy containers are now Red Hat-certified and published in the Red Hat Container Catalog. The containers support Red Hat Enterprise Linux and Red Hat's OpenShift container application development platform.
Pricing remains unchanged for the Hedvig Distributed Storage Platform, which becomes generally available Friday. Hedvig partners with Cisco, Dell EMC, Hewlett Packard Enterprise (HPE), Lenovo, Quanta and Super Micro Computer on hardware.
Hedvig and HPE in June launched a validated bundled option combining Hedvig's software-defined storage with HPE Apollo 4200 servers. Whiteley said the bundled product, for which HPE provides first-line support, has already grown to about half the opportunities in the company's sales pipeline.
"Just having the HPE sales force boots on the ground is going to be a big driver for both their growth and their market acceptance," Marks said. "If an HPE sales guy sells Hedvig, it counts against their storage quota. Sales guys sell what you incent them to sell."
Read the rest here:
Hedvig storage upgrade adds flash tier, encryption options - TechTarget
Hedvig Bakes Encryption into Software-Defined Storage Platform – IT Business Edge (blog)
Data, in theory, should always be secure and universally available. In practice, data ends up being accessible to only a handful of applications via storage systems incapable of encrypting data.
To make data both inherently more secure and accessible, Hedvig has updated its Distributed Storage Platform with Encrypt360 software to enable IT organizations to encrypt data at the server before storing it. Rob Whiteley, vice president of marketing for Hedvig, says this approach means that all the data passing through its software-defined storage (SDS) platform running on that server can be encrypted on a per-volume basis.
Whiteley says that approach is not only more efficient, it also eliminates the need to depend on magnetic storage drives to encrypt all the data at rest residing on the drive.
The data gets encrypted at the server, so its not only encrypted on the drive, but also as it moves between the storage system and the server, says Whiteley.
Designed to be deployed across multiple platforms, Hedvig Distributed Storage Platform version 3.0 includes enhanced plug-ins for VMware to provide additional security, backup and data protection capabilities. In addition, Hedvig has developed a plug-in to support OpenStorage Technology (OST) developed by Veritas Technologies. Hedvig has also extended its existing support for Docker containers by having its implementation of a Hedvig Storage Proxy container certified by Red Hat. The Hedvig proxy container has also been published on the Red Hat Container Catalog. Hedvig already supports OpenStack environments, as well.
Whiteley says that as software deployed on a server, the Hedvig approach to SDS only adds about 10 percent overhead compared to running software on each local storage array. But because storage is now managed at the server level, Whiteley says IT organizations gain flexibility, better security and lower total cost of storage ownership. Because the Hedvig Distributed Storage Platform is based on a multi-tenant architecture, IT organizations have the option of deploying it on-premises or in the cloud, adds Whiteley.
With this update to the Hedvig Distributed Storage Platform, Whiteley says the company has also updated the Hedvig FlashFabric software the company developed to provide additional auto-tiering and read cache capabilities. Hedvig FlashFabric provides a mechanism to network together all-Flash arrays in a way that Whiteley says can be easily extended to support NVMe, 3D Xpoint and other flash technologies as they become available.
The battle between proponents of various approaches to SDS is already fierce. The first issue IT organizations need to contend with is where they want SDS to run. Historically, storage has been managed by controller software running on dedicated hardware. As SDS running on the server becomes a more viable option, the question IT organizations will need to consider is what level of performance tradeoff is acceptable to reduce overall storage and security management overhead.
Read this article:
Hedvig Bakes Encryption into Software-Defined Storage Platform - IT Business Edge (blog)
To Protect Genetic Privacy, Encrypt Your DNA – WIRED
In 2007, DNA pioneer James Watson became the first person to have his entire genome sequencedmaking all of his 6 billion base pairs publicly available for research. Well, almost all of them. He left one spot blank, on the long arm of chromosome 19, where a gene called APOE lives. Certain variations in APOE increase your chances of developing Alzheimers, and Watson wanted to keep that information private.
Except it wasnt. Researchers quickly pointed out you could predict Watsons APOE variant based on signatures in the surrounding DNA. They didnt actually do it, but database managers wasted no time in redacting another two million base pairs surrounding the APOE gene.
This is the dilemma at the heart of precision medicine: It requires people to give up some of their privacy in service of the greater scientific good. To completely eliminate the risk of outing an individual based on their DNA records, youd have to strip it of the same identifying details that make it scientifically useful. But now, computer scientists and mathematicians are working toward an alternative solution. Instead of stripping genomic data, theyre encrypting it.
Gill Bejerano leads a developmental biology lab at Stanford that investigates the genetic roots of human disease. In 2013, when he realized he needed more genomic data, his lab joined Stanford Hospitals Pediatrics Departmentan arduous process that required extensive vetting and training of all his staff and equipment. This is how most institutions solve the privacy perils of data sharing. They limit who can access all the genomes in their possession to a trusted few, and only share obfuscated summary statistics more widely.
So when Bejerano found himself sitting in on a faculty talk given by Dan Boneh, head of the applied cryptography group at Stanford, he was struck with an idea. He scribbled down a mathematical formula for one of the genetic computations he uses often in his work. Afterward, he approached Boneh and showed it to him. Could you compute these outputs without knowing the inputs? he asked. Sure, said Boneh.
Last week, Bejerano and Boneh published a paper in Science that did just that. Using a cryptographic genome cloaking method, the scientists were able to do things like identify responsible mutations in groups of patients with rare diseases and compare groups of patients at two medical centers to find shared mutations associated with shared symptoms, all while keeping 97 percent of each participants unique genetic information completely hidden. They accomplished this by converting variations in each genome into a linear series of values. That allowed them to conduct any analyses they needed while only revealing genes relevant to that particular investigation.
Just like programs have bugs, people have bugs, says Bejerano. Finding disease-causing genetic traits is a lot like spotting flaws in computer code. You have to compare code that works to code that doesnt. But genetic data is much more sensitive, and people (rightly) worry that it might be used against them by insurers, or even stolen by hackers. If a patient held the cryptographic key to their data, they could get a valuable medical diagnosis while not exposing the rest of their genome to outside threats. You can make rules about not discriminating on the basis of genetics, or you can provide technology where you cant discriminate against people even if you wanted to, says Bejerano. Thats a much stronger statement.
The National Institutes of Health have been working toward such a technology since reidentification researchers first began connecting the dots in anonymous genomics data. In 2010, the agency founded a national center for Integrating Data for Analysis, Anonymization and Sharing housed on the campus of UC San Diego. And since 2015, iDash has been funding annual competitions to develop privacy-preserving genomics protocols. Another promising approach iDash has supported is something called fully homomorphic encryption, which allows users to run any computation they want on totally encrypted data without losing years of computing time.
Kristen Lauter, head of cryptography research at Microsoft, focuses on this form of encryption, and her team has taken home the iDash prize two years running. Critically, the method encodes the data in such a way that scientists dont lose the flexibility to perform medically useful genetic tests. Unlike previous encryption schemes, Lauters tool preserves the underlying mathematical structure of the data. That allows computers to do the math that delivers genetic diagnoses, for example, on totally encrypted data. Scientists get a key to decode the final results, but they never see the source.
This is extra important as more and more genetic data moves off local servers and into the cloud. The NIH lets users download human genomic data from its repositories, and in 2014, the agency started letting people store and analyze that data in private or commercial cloud environments. But under NIHs policy, its the scientists using the datanot the cloud service providerresponsible with ensuring its security. Cloud providers can get hacked, or subpoenaed by law enforcement, something researchers have no control over. That is, unless theres a viable encryption for data stored in the cloud.
If we dont think about it now, in five to 10 years a lot peoples genomic information will be used in ways they did not intend, says Lauter. But encryption is a funny technology to work with, she says. One that requires building trust between researchers and consumers. You can propose any crazy encryption you want and say its secure. Why should anyone believe you?
Thats where federal review comes in. In July, Lauters group, along with researchers from IBM and academic institutions around the world launched a process to standardize homomorphic encryption protocols. The National Institute for Standards and Technology will now begin reviewing draft standards and collecting public comments. If all goes well, genomics researchers and privacy advocates might finally have something they can agree on.
Read the original:
To Protect Genetic Privacy, Encrypt Your DNA - WIRED
Cloud Encryption Market Worth 2401.9 Million USD by 2022 – Markets Insider
PUNE, India, August 23, 2017 /PRNewswire/ --
According to a new market research report "Cloud Encryption Market by Component (Solution and Service), Service Model (Infrastructure-as-a-Service, Software-as-a-Service, and Platform-as-a-Service), Organization Size, Vertical, and Region - Global Forecast to 2022", published by MarketsandMarkets, the market size is expected to grow from USD 645.4 Million in 2017 to USD 2,401.9 Million by 2022, at a Compound Annual Growth Rate (CAGR) of 30.1%.
(Logo: http://photos.prnewswire.com/prnh/20160303/792302 )
Browse 64 Market Data Tables and 45 Figures spread through 184 Pages and in-depth TOC on "Cloud Encryption Market"
http://www.marketsandmarkets.com/Market-Reports/cloud-encryption-market-158713019.html
Early buyers will receive 10% customization on this report
The demand for cloud encryption is majorly driven by stringent government regulations and the need to protect mission critical data residing on the cloud. With the rising demand for cloud and virtualization across different industry verticals, the adoption rate of cloud encryption among enterprises is expected to gain a major traction during the forecast period.
The Infrastructure-as-a-Service (IaaS) model is expected to hold the largest market share
The IaaS segment includes the offerings such as servers, storages, and networking infrastructure on-premises private cloud. This infrastructure is used to run the applications on the public cloud. It enables the organizations to reduce the total cost of ownership as the infrastructure is being provided by third-party vendors in the form of cloud-based data centers. However, virtualization introduces new security challenges. Thus, enterprises are adopting cloud encryption solution and services to run business-critical functions securely.
Ask for PDF Brochure @http://www.marketsandmarkets.com/pdfdownload.asp?id=158713019
The telecom and IT vertical is expected to grow at the fastest rate
The telecom and IT vertical involves high usage of cloud-based applications for their business operations and is thus frequently attacked by cybercriminals. Companies in this sector are adopting cloud encryption solutions so as to provide their customers risk-free services. The usage of cloud encryption has allowed users to save the important information on their mobile devices and use that information through the cloud without any risk. Therefore, cloud encryption solutions are helping telecom and IT companies in enhancing their services and providing secure information to customers while complying with regulations.
North America is expected to contribute to the largest market share; Asia Pacific to grow the fastest during the forecast period
North America is expected to have the largest market share and dominate the Cloud Encryption Market from 2017 to 2022, owing to the early adoption of new and emerging technologies and the presence of a large number of players in this region. APAC offers extensive growth avenues in the Cloud Encryption Market, owing to a widespread presence of SMEs that are extensively adopting cloud technology.
The major vendors providing cloud encryption solutions and services are Thales e-Security (La Defense, France), Gemalto N.V. (Amsterdam, Netherlands), Sophos Group plc (Abingdon, UK), Symantec Corporation (California, US), Skyhigh Networks (California, US), Netskope Inc. (California, US), CipherCloud (California, US), HyTrust, Inc. (California, US), Trend Micro Incorporated (Tokyo, Japan), Vaultive, Inc. (Massachusetts, US), and TWD Industries AG (Unteriberg, Switzerland).
Enquiry Before Buying @http://www.marketsandmarkets.com/Enquiry_Before_Buying.asp?id=158713019
Browse Related Reports
Cloud Security Market by Service Type (IAM, DLP, IDS/IPS, SIEM, and Encryption), Security Type, Service Model (IaaS, PaaS, and SaaS), Deployment Type (Public, Private, and Hybrid), Organization Size, Vertical, and Region - Global Forecast to 2022http://www.marketsandmarkets.com/Market-Reports/cloud-security-market-100018098.html
Mobile Encryption Market by Component (Solution and Services), Application (Disk Encryption, File/Folder Encryption, Communication Encryption, and Cloud Encryption), End-User Type, Deployment Type, Vertical, and Region - Global Forecast to 2022http://www.marketsandmarkets.com/Market-Reports/mobile-encryption-market-120317676.html
Know More About our Knowledge Store @http://www.marketsandmarkets.com/Knowledgestore.asp
About MarketsandMarkets
MarketsandMarkets provides quantified B2B research on 30,000 high growth niche opportunities/threats which will impact 70% to 80% of worldwide companies' revenues. Currently servicing 5000 customers worldwide including 80% of global Fortune 1000 companies as clients. Almost 75,000 top officers across eight industries worldwide approach MarketsandMarkets for their painpoints around revenues decisions.
Our 850 fulltime analyst and SMEs at MarketsandMarkets are tracking global high growth markets following the "Growth Engagement Model - GEM". The GEM aims at proactive collaboration with the clients to identify new opportunities, identify most important customers, write "Attack, avoid and defend" strategies, identify sources of incremental revenues for both the company and its competitors. MarketsandMarkets now coming up with 1,500 MicroQuadrants (Positioning top players across leaders, emerging companies, innovators, strategic players) annually in high growth emerging segments. MarketsandMarkets is determined to benefit more than 10,000 companies this year for their revenue planning and help them take their innovations/disruptions early to the market by providing them research ahead of the curve.
MarketsandMarkets' flagship competitive intelligence and market research platform, "RT" connects over 200,000 markets and entire value chains for deeper understanding of the unmet insights along with market sizing and forecasts of niche markets.
Contact:Mr. RohanMarketsandMarkets701 Pike StreetSuite 2175, Seattle,WA 98101, United StatesTel: +1-888-600-6441Email: rel="nofollow">sales@marketsandmarkets.com
Visit Our Blog @ http://www.marketsandmarketsblog.com/market-reports/telecom-itConnect with us on LinkedIn @ http://www.linkedin.com/company/marketsandmarkets
Read the original post:
Cloud Encryption Market Worth 2401.9 Million USD by 2022 - Markets Insider
Data Encryption in OneDrive for Business and SharePoint Online
This documentation is archived and is not being maintained.
We are in the process of combining the SharePoint Server 2013 and SharePoint Server 2016 content into a single content set. We appreciate your patience while we reorganize things. See the Applies To tag at the top of each article to find out which version of SharePoint an article applies to.
Applies to: OneDrive for Business, SharePoint Online
Topic Last Modified: 2017-07-31
Summary: Learn how encryption of data security works in OneDrive for Business and SharePoint Online.
Understand the basic elements of encryption for data security in OneDrive for Business and SharePoint Online.
Office 365 is a highly secure environment that offers extensive protection in multiple layers: physical data center security, network security, access security, application security, and data security. This article specifically focuses on the in-transit and at-rest encryption side of data security for OneDrive for Business and SharePoint Online.
For a description of Office 365 security as a whole, see Security in Office 365 White Paper.
Watch how data encryption works in the following video.
In OneDrive for Business and SharePoint Online, there are two scenarios in which data enters and exits the datacenters.
Client communication with the server Communication to OneDrive for Business across the Internet uses SSL/TLS connections. All SSL connections are established using 2048-bit keys.
Data movement between datacenters The primary reason to move data between datacenters is for geo-replication to enable disaster recovery. For instance, SQL Server transaction logs and blob storage deltas travel along this pipe. While this data is already transmitted by using a private network, it is further protected with best-in-class encryption.
Encryption at rest includes two components: BitLocker disk-level encryption and per-file encryption of customer content.
BitLocker is deployed for OneDrive for Business and SharePoint Online across the service. Per-file encryption is also deployed in OneDrive for Business and SharePoint Online in Office 365 multi-tenant and new dedicated environments that are built on multi-tenant technology.
While BitLocker encrypts all data on a disk, per-file encryption goes even further by including a unique encryption key for each file. Further, every update to every file is encrypted using its own encryption key. Before theyre stored, the keys to the encrypted content are stored in a physically separate location from the content. Every step of this encryption uses Advanced Encryption Standard (AES) with 256-bit keys and is Federal Information Processing Standard (FIPS) 140-2 compliant. The encrypted content is distributed across a number of containers throughout the datacenter, and each container has unique credentials. These credentials are stored in a separate physical location from either the content or the content keys.
For additional information about FIPS 140-2 compliance, see FIPS 140-2 Compliance, and for AES with 256 bit see, Keep Your Data Secure with the New Advanced Encryption Standard.
File-level encryption at rest takes advantage of blob storage to provide for virtually unlimited storage growth and to enable unprecedented protection. All customer content in OneDrive for Business and SharePoint Online will be migrated to blob storage. Heres how that data is secured:
All content is encrypted, potentially with multiple keys, and distributed across the datacenter. Each file to be stored is broken into one or more chunks, depending its size. Then, each chunk is encrypted using its own unique key. Updates are handled similarly: the set of changes, or deltas, submitted by a user is broken into chunks, and each is encrypted with its own key.
All of these chunksfiles, pieces of files, and update deltasare stored as blobs in our blob store. They also are randomly distributed across multiple blob containers.
The map used to re-assemble the file from its components is stored in the Content Database.
Each blob container has its own unique credentials per access type (read, write, enumerate, and delete). Each set of credentials is held in the secure Key Store and is regularly refreshed.
In other words, there are three different types of stores involved in per-file encryption at rest, each with a distinct function:
Content is stored as encrypted blobs in the blob store. The key to each chunk of content is encrypted and stored separately in the content database. The content itself holds no clue as to how it can be decrypted.
The Content Database is a SQL Server database. It holds the map required to locate and reassemble all of the content blobs held in the blob store as well as the keys needed to decrypt those blobs.
Each of these three storage componentsthe blob store, the Content Database, and the Key Storeis physically separate. The information held in any one of the components is unusable on its own. This provides an unprecedented level of security. Without access to all three it is impossible to retrieve the keys to the chunks, decrypt the keys to make them usable, associate the keys with their corresponding chunks, decrypt any chunk, or reconstruct a document from its constituent chunks.
Link:
Data Encryption in OneDrive for Business and SharePoint Online
Additional proof that Lancaster County Commissioners should reconsider encrypting police transmissions – LancasterOnline
Ambulance organizations are worried that the pending encryption of police radio transmissions in Lancaster County will compromise the safety of medics racing to dangerous calls, LNP reported last Wednesday. Emergency medical service leaders asked the county commissioners to revise their June approval of police radio encryption to allow their crews to listen to police calls. The commissioners have not made a decision on the request.
Encryption is a bad idea. Words like transparency and accountability should mean something. Their significance diminishes every time we erect another barrier between government and the public.
We want our police officers to be as safe as they can possibly be. We also believe in the importance of public access to information. These values are not mutually exclusive.
Practically speaking, theres no evidence that encrypting police transmissions will make policing safer or easier. Part of the rationale for encryption is to prevent an ambush or to keep the media from reaching a crime scene before law enforcement, which, by the way, is very rare.
We know police officers would rather not have to deal with media at a crime scene. But the media has a job to do. Weather events, fires, gas leaks the media monitors police transmissions to help keep the public informed. Thats the medias job. Weve asked for proof that media or public access to police transmissions has ever compromised a crime scene or an investigation, or violated the privacy of a victim. Were still waiting.
Weve also asked the county commissioners to reconsider. Now, were not alone.
As LNPs Jeff Hawkes reported, medics need to hear what the first officers on the scene are saying to each other and dispatchers about the nature of a crash, shooting or other emergency requiring an ambulance. They can start to prepare before they arrive if they have more information. Is the crime scene secure? Are flood waters too deep? Are there downed wires?
These are legitimate concerns and questions. And how were the EMS officials received when they spoke up at a meeting with the commissioners last week? Not well.
Police departments, I dont think, would ever come in here and ask you to put some regulation on the fire departments, said Chief Kevin McCarthy of East Earl Township, representing a county police chiefs group. We actually thought the matter was finished.
Its not. Nor should it be. And McCarthys comment misses the point by a wide margin.
The entities that rely on police transmissions should be working together to keep the public safe and informed. Radio transmissions help the media communicate to the public. EMTs use the information to get to people who need help. This is a debate about openness in government and access to information. Once it degenerates into an argument over stepping on toes or whos dictating policy to whom, were in real trouble.
As we wrote when the decision to encrypt was announced, if a lack of public trust and faith in government institutions is a real problem, this law only serves to exacerbate mistrust.
And now you have a group of first responders saying it makes no practical sense either and will make their jobs more difficult.
To lose that ability to communicate or at least monitor (police transmissions) is a real danger to people in EMS, Dr. Michael Reihart, the medical director of a regional emergency health services federation, told LNP.
This should be more than enough for the commissioners to reconsider.
It should be, but apparently, it isnt.
Commissioners Chairman Dennis Stuckey, after hearing from EMS officials, said that hes not inclined to change anything.
Darrell Fisher, president of the Lancaster County EMS Council, told LNP that he will continue to push this issue, and we commend him for doing so.
Its pretty clear that the commissioners and everyone else who favors encryption want Reihart and Fisher to lose interest and go away. We hope they dont.
Commissioner Craig Lehman may represent the last hope for preserving transparency and public accessibility. Lehman opposed blocking media access to police radio, and told LNP that hes sensitive to the medics request and worries about other unintended consequences of encryption that could put police at risk.
We hope the police who requested encryption and the commissioners who voted for it will reopen this discussion. We still believe a compromise can be reached. As LNP Executive Editor Barbara Hough Roda wrote in July, we seek a compromise that will allow law enforcement to do its work, and enable those of us in the news media to do ours.
That doesnt seem like too much to ask. And its the least the public has a right to expect.
Go here to read the rest:
Additional proof that Lancaster County Commissioners should reconsider encrypting police transmissions - LancasterOnline
Researchers use encryption to keep patients’ DNA private – Engadget
When trying to figure out which genetic mutations cause disease and which are associated with healthy individuals, researchers have in the past had to compare whole genomes of thousands of people. But with this work, scientists have shown that a whole genome isn't necessary and there are ways of keeping all of the irrelevant genetic data private. "There is a general conception that we can only find meaningful differences by surveying the entire genome," said Gill Bejerano, an author of the study, in a statement. "But these meaningful differences make up only a very tiny proportion of our DNA. There are now amazing tools in computer science and cryptography that allow researchers to pinpoint only these differences while keeping the remainder of the genome completely private."
What the research team did was create a way for patients to encrypt their genome and report whether their genome analysis showed the presence of particular gene variants. That information was then uploaded to the cloud and researchers were able to reveal only the gene variants that were pertinent to their study. Around 97 percent of the participants' genomes were kept hidden and were only ever viewed in full by the participants themselves. "These are techniques that the cryptography community has been developing for some time," said Dan Boneh, another author of the study. "Now we are applying them to biology."
Ultimately, this means that patients' genetic data can remain private while also being used for study. "We now have the tools in hand to make certain that genomic discrimination doesn't happen," said Bejerano. "There are ways to simultaneously share and protect this information."
Read the original:
Researchers use encryption to keep patients' DNA private - Engadget
iPhone Secure Enclave firmware encryption key leaked – TechTarget
Despite early reports, experts agree that the leak of the iPhone Secure Enclave Processor firmware encryption key should not pose a security risk and may even ultimately improve user security.
When a hacker/researcher going by the handle "xerub" released the firmware encryption key, the initial reaction was one of panic because the iPhone Secure Enclave is responsible for storing and processing highly sensitive data, as described by Mike Ash, software engineer and fellow at Plausible Labs, in response to the debate around the FBI wanting backdoor access to Apple's encryption:
"The Secure Enclave contains its own [unique ID] and hardware AES engine. The passcode verification process takes place here, separated from the rest of the system. The Secure Enclave also handles Touch ID fingerprint processing and matching, and authorizing payments for Apple Pay," Ash wrote in a blog post about iPhone Secure Enclave last year. "The Secure Enclave performs all key management for encrypted files. File encryption applies to nearly all user data."
While most iPhone system apps use Secure Enclave, and all third-party apps use it by default since iOS 7, Ash wrote, "The main CPU can't read encrypted files on its own. It must request the file's keys from the Secure Enclave, which in turn is unable to provide them without the user's passcode."
While this sounds bad, David Schuetz, senior security consultant at NCC Group, said in his own analysis that the encryption key xerub released was specific to the GSM model of the iPhone 5S -- the first Apple device with the Secure Enclave Processor -- running iOS 10.3.3.
Apple reportedly told TechRepublic that decrypting the iPhone Secure Enclave firmware "in no way provides access" to user data and that Apple does not have plans to patch affected devices.
Xerub also told TechRepublic the encryption key would not impact user security but said the "public scrutiny" around the release could improve the security of the iPhone Secure Enclave.
Schuetz added that modifying the iPhone Secure Enclave firmware would not be possible because "the firmware is also signed by Apple, and the attacker would need to be able to forge the signature to get the phone to install the hacked firmware."
"I think this is a good thing, in the long run. This should have very little practical effect on the security of individual iOS devices, unless a very significant flaw is uncovered. Even then, the potential scope of the finding may be limited to only older devices," Schuetz wrote. "If the security of the Secure Enclave is in any way directly reduced by the disclosure of the firmware, then it wasn't truly secure in the first place."
Read the original here:
iPhone Secure Enclave firmware encryption key leaked - TechTarget
Encryption Technology Could Protect the Privacy of Your DNA – Gizmodo
Your DNA is some of the most intimate information out thereencoded in it is information about your health, your personality, your family history. Its not hard to imagine how such sensitive details could be damaging should they fall into the wrong hands. And yet, the privacy practices of the people and programs handling that information isnt exactly up to snuff.
Researchers at Stanford, though, say they may have a fix for the lagging privacy protocols putting anyone whos ever done a DNA test at risk of indecent exposure. In a study published Friday in Science, researchers say that they have developed a genome cloaking technique that makes it possible to study the human genome for the presence of disease-associated genes without revealing genetic information not directly associated with the information being sought.
The hope, they wrote, is to lessen the concerns of genomic privacy violations and genetic discrimination that taint DNA testing.
Applying the principals of cryptography to human biology, researchers were able to correctly identify gene mutations in groups of patients responsible for causing four different rare diseases, as well as the likely cause of a genetic disease in a baby by comparing his DNA to his parents. They could also determine which out of hundreds of patients shared gene mutations. In doing all this, though, they also managed to keep 97 percent or more of the participants unique genetic information completely hidden from anyone other than the owners of the DNA.
To do this, they had each participant encrypt their genome using a simple algorithm on their computer or smart phone. The encrypted information was then uploaded into the cloud, and the researchers used a secure, multi-party computation to analyze it, revealing only the genetic information important to the investigation. They were able to do so within a matter of minutes.
In 2008, Congress passed the Genetic Information and Nondiscrimination Act, but both loopholes in the law and multipleCongressional actions threaten to erode protections that already exist, making people wary of the consequences of genetic testing. The protections of GINA, for example, do not apply to life insurance, long-term care, or disability insurance, meaning those companies are free to ask for genetic information and reject people deemed too risky. Some scientists have said that fears of genetic discrimination could impact the health of patients, if they refuse testing that could help doctors treat them, and could stymy medical research if patients wary of testing opt not to participate in studies.
Ultimately, we will have to strike a balance: A way to share the secrets of our biology with doctors and scientists, while also protecting our privacy.
See original here:
Encryption Technology Could Protect the Privacy of Your DNA - Gizmodo
Hardware encryption vs software encryption: the simple guide – Kroll Ontrack UK (press release) (blog)
Encryption is an incredibly important tool for keeping your data safe. When your files are encrypted, they are completely unreadable without the correct encryption key so if someone steals your encrypted files, they cant actually do anything with them.
But there are actually two types of encryption hardware and software both of which offer different advantages. So what these two encryption methods. And why do they matter?
As the name implies, software encryption uses software tools to encrypt your data. Some examples of these tools include the BitLocker drive encryption feature of Microsoft Windows, or the 1Password password manager. Both use encryption tools to protect information on your PC, smartphone, or tablet.
Software encryption typically relies on a password; give the right password, and your files will be decrypted, otherwise they remain locked. With encryption enabled, it is passed through a special algorithm that scrambles your data as it is written to disk. The same software then unscrambles data as it is read from the disk for an authenticated user.
Software encryption is typically quite cheap to implement, making it very popular with developers. Software-based encryption routines do not typically require any additional software or hardware either they just work.
Software encryption is only as secure as the rest of your computer or smartphone. If a hacker can crack your password, the encryption is immediately undone.
Software encryption tools also share the processing resources of your computer, which can cause the whole machine to slow down as data is encrypted/decrypted. You will also find that opening and closing encrypted files is much slower than normal because the process is relatively resource intensive, particularly for higher levels of encryption.
At the heart of hardware encryption is a separate processor dedicated to the task of authentication and encryption. Hardware encryption is increasingly common on mobile devices the TouchID fingerprint scanner on Apple iPhones is a good example.
The technology still relies on a special key to encrypt and decrypt data, but this is randomly generated by the encryption processor. Often hardware encryption devices replace traditional passwords with biometric logons (like fingerprints), or a PIN number that is entered on an attached keypad.
Hardware encryption is considered to be safer than software encryption because the encryption process is kept separate from the rest of the machine. This makes it much harder to intercept or break.
The use of a dedicated processor also relieves the burden on the rest of your device, making the encryption/decryption process much faster.
Typically hardware-based encrypted storage is much more expensive than a software tool. BitLocker is included as free with all new versions of Microsoft Windows for instance, but an encrypted USB thumb drive is quite expensive especially when compared to an unencrypted alternative.
If the hardware decryption processor fails, it becomes extremely hard to access your information.
Encrypted data is extremely hard to recover. Even if the raw sectors are recovered from a failed drive, it is still encrypted which means it is still unreadable. Some software encryption systems, like BitLocker, have built-in recovery mechanisms but you need to have set up your recovery options in advance.
Hardware encrypted devices dont typically have these additional recovery options. Many are designed to prevent decryption in the event of a component failure, stopping determined hackers from disassembling them.
The fastestand most effective way to deal with data loss on an encrypted device is to ensure you have a complete backup stored somewhere safe. For your PC, this may mean copying data to another encrypted device. For other devices, like your smartphone, backing up to the Cloud provides a quick and simple economy copy that you can restore from. As an added bonus, most Cloud services now encrypt their users data too.
Im normally loathed to put in a call us sign off to a blog post, but in the event that you dont have a current backup, you will need to seek professional assistance. Our engineers can provide advice and guidance, but depending on the complexity of the encryption algorithm used, they may not be able to guarantee successful recovery. That said, what we would do is ask you to send in the entire laptop/computer as there may be hardware components not held within the hard drive itself but is critical to decrypting the data.
If you are having problems with an encrypted device, and would like to discuss your options, please get in touch.
Read this article:
Hardware encryption vs software encryption: the simple guide - Kroll Ontrack UK (press release) (blog)