In cloud computing, encryption provides protection for storing and moving data. The founder ofEn|Veilsaid the startups technology can keep data encrypted when its being used, too.

The Howard County company is commercializing technology that began development at the NSA that allows encryption to remain in place while searching or analyzing data,said En|Veil founder and CEO Ellison Anne Williams.

Currently, decryption is required before performing these functions, leaving the data and the results of the operations potentially vulnerable to outsiders.The startups algorithms enable a method of encryption that protects in-use data to be used at a larger scale, said Williams.

This is the first time in over 20 years of work into homomorphic encryption that this kind of scale has been achieved, Williams said during a pitch at the RSA Conferences Innovation Sandbox event. The company won second place in the competition, which seeks to name the most innovative startup at the national security conference.

Williams offered finance as an example of one industry that would benefit from the technology, but said it could be useful wherever theres a need to protect your data as its being used.

En|Veil is seven months old, but the technology has been in development for longer. Williams worked at NSA for 12 years, and a year and a half at Johns Hopkins Applied Physics Lab. The companys head of engineering also worked at APL, and the other three team members worked at NSA.

The five-member team is now based out of DataTribe, a Fulton-based incubator that helps startups working on government-developed tech. After a year at the incubator, Williams said the company plans to find space in the area.

Stephen Babcock is the lead reporter for Technical.ly Baltimore. A graduate of Northeastern University, he moved to Baltimore following a stint in New Orleans, where he served as managing editor of online news and culture publication NOLA Defender. While there, he also wrote for NOLA.com/The Times-Picayune. He was previously a reporter for the Rio Grande Sun of Northern New Mexico.

Here is the original post:
Former NSAers are taking encryption to a new level - Technical.ly Baltimore

Encryption is still too complicated, according to businesses.

Business usage of encryption to protect sensitive data, either in their own systems or in the cloud, continues to grow -- but only at a desperately slow pace.

Despite the omnipresent risk of deliberate or accidental security breaches, less than half of companies (41 percent) said they had an encryption strategy that's consistently applied across the organization, according to a survey. One in eight enterprises (15 percent) said they had no encryption strategy.

Compliance remains the top reason for having encryption in place, followed by a desire to protect intellectual property and to defend against "specific, identified threats". Protecting customers' personal information came fourth on the list of reasons, which may be little comfort to many considering that one in five UK companies was hit by some kind of cyberattack in the last 12 months.

Adoption of encryption by businesses.

Employee data is most likely to be encrypted, followed by payment-related data and financial records, according to the survey of 5,000 business users sponsored by security company Thales.

Databases, internet communications, and datacenter storage are the most likely to be deployed (89 percent, 85 percent, and 80 percent, respectively), but in contrast, encryption for big data repositories (53 percent), public cloud services (55 percent), and private cloud infrastructure (59 percent) have much lower usage rates.

Of those that do encrypt data at rest in the cloud, two-thirds either encrypt it before they send it to the cloud, or encrypt in the cloud using keys they generate and manage on premises. The other third turn over complete control of keys and encryption processes to cloud providers.

So why does usage of encryption remain so low?

Over half of respondents said that discovering where sensitive data resides in the organization is their most difficult challenge, while nearly half said that deploying encryption technology remains a "significant challenge". Third on the list was the difficulty of deciding what data should actually be encrypted.

Continued here:
Encryption: Usage grows again, but only at snail's pace | ZDNet - ZDNet

A woman would normally produce this photo and write this caption. She is not here because of the International Womens Day strike.WIREDLeaks have plagued the Trump administration since he took office less than seven weeks ago. The presidents anger about these backchannels has grown, up to and including reported demands of an investigation into the source. Press secretary Sean Spicer has even apparently taken to doing random phone checks, supervised by White House attorneys, to see what staffers and aides are up to on their devices and whether they have secure communication apps.

In the midst of all of this, the end-to-end encrypted, disappearing messages app Confide has emerged as a popular choice among administration officials looking to discuss sensitive topics with coworkers, the press, or other groups. But in spite of Confides claims that it gives you the comfort of knowing that your private messages will now truly stay that way, researchers at security firm IOActive recently notified its developers of a number of critical vulnerabilities in the app. Those have since been resolved, but thats small consolation for White House staffers and general users who relied on Confide while it was exposed.

IOActive found vulnerabilities in numerous areas of the Confide app on Windows, macOS, and Android. By reverse-engineering the applications to see how they work and where they might have weaknesses and probing Confides public API to see what data could be accessible to anyone, the researchers discovered that they could alter messages and attachments in transit, decrypt messages, impersonate users, and reconstruct a database of all Confide users, their names, email addresses, and phone numbers. Its a concerning list of potential attacks for an app that touts security and privacy as its main offerings.

In total, the IOActive researchers laid out 11 vulnerabilities. For example, they were able to access over 7,000 records for users who joined Confide between February 22 and February 24, before Confide detected the intrusion. The database contains between 800,000 and 1 million user records in all. The app didnt have protection against brute-forcing account passwords and didnt even have strong minimum requirements for what a users password could be. It didnt notify recipients when senders sent unencrypted messages, and the system didnt require a valid web encryption certificate.

IOActive disclosed the bugs to Confide on February 28. Confide was already aware of some of the bugs after detecting the researchers probing, and by March 3 the company told IOActive that all the vulnerabilities had been patched. IOActive says that it was satisfied with Confides reaction. When our researchers connected with Confide to disclose the vulnerabilities, they were receptive to our research, quick to move on addressing critical issues found, and worked with us to share the information, IOActive CEO Jennifer Steffens said in a statement.

Confide has been around since 2014, though, so protecting the app going forward, while crucial, doesnt mitigate the risk its users have already faced. But Confide assures its users that the bugs were never exploited. Our security team is continuously monitoring our systems to protect our users integrity, says Confide president Jon Brod. IOActives attempt to gather account information was detected and stopped in real time. Not only has this particular issue been resolved, but we also have no detection of it being exploited by any other party. In addition, weve also ensured that the same or similar approaches will not be possible going forward.

Other researchers have piled on similar findings about the state of Confides security. Experts have also been calling the app out for a while for using proprietary cryptography and offering no evidence that it has invited independent code audits to check for vulnerabilities. Encrypted communication services that are open source, like Signal, garner more trust in the security community because of their transparency.

Public review of open source code can [reveal] such flaws, says Sven Dietrich, a cryptography researcher at CUNY John Jay College of Criminal Justice. He adds that code reviews allow experts to identify programming mistakes that jeopardize user messages or credentials, and protocol mistakes like improper exchange of keys or messages. Basically, all the issues Confide ran into.

Its difficult for consumers to know which security products to choose or even how to compare the options. This puts responsibility on software makers to secure their products. Encryption software assumes such an important role today. The only way to ensure that a piece of software does not contain back doors or gaping holes is to have independent trust experts audit the code. This is best practice, says Kevin Curran, a cybersecurity researcher at Ulster University and IEEE senior member. We all know that it is unreasonable to expect vulnerability-free software, but we need to look at risk mitigation.

Now that Confide has patched its vulnerabilities, users will have more protection. But without greater transparency, users may not have confidence that other flaws arent lurking in their favorite encrypted chat app. For a White House staffer leaking information critical to United States discourse and fearing retribution from a temperamental boss, theres no room for error.

In the four tumultuous weeks since President Donald Trumps inauguration, the White House has provided a steady stream of leaks. Some are mostly innocuous, like how Trump spends his solitary hours. Others, including reports of national security adviser Michael Flynns unauthorized talks with Russia, have proven devastating. In response, Trump has launched an investigation, and expressed his displeasure in a tweet: Why are there so many illegal leaks coming out of Washington?

The answer may have to do with uncertainty and unrest inside the administration, as well as the presidents ongoing attacks against the intelligence community. But it doesnt hurt that every White House and Congressional staffer has tools to facilitate secure communication in their pocket or bag. Specifically, multiple reports indicate that Republican operatives and White House staffers are using the end-to-end encrypted messaging app Confide, which touts disappearing messages and anti-screenshot features, to chat privately without a trace.

The ability to communicate without fear of reprisal may have helped illuminate the Trump administrations darkest corners. But that same time, anonymity rings alarms for transparency advocates. The same technology that exposes secrets also enables them, a tension thats not easy to resolve.

Confide launched in 2013 as a secure app for executives looking to trade gossip and talk shop without creating a digital trail. The service uses a proprietary encryption protocol, what the company describes as military-grade end-to-end encryption. Its marquee feature, self-destructing messages, appears on similar services like Snapchat, but Confides appeal lies in its promise of more robust protections.

Its worth noting, though, that unlike other secure messaging apps, like standard-bearer Signal, Confides encryption is closed source and proprietary, meaning no one outside the company knows whats going on under the hood of the app. Company president Jon Brod says that Confide bases its encryption protocol on the widely used PGP standard, and that the apps network connection security relies on recommended best practices like Transport Socket Layer (TLS). Brod did not respond to questions, though, about whether Confide has ever opened its code base to be independently audited by a third party.

One key is always, do you make code publicly available thats been audited where features have been inspected by the security community so that it can arrive at some consensus, says Electronic Frontier Foundation legal fellow Aaron Mackey. My understanding with Confide, at least right now, is that its not clear whether thats occurred.

Confides also not the only option in play; EPA workers have reportedly turned to Signal to discuss how to cope with an antagonistic Trump administration, to the agitation of Republican representatives.

No matter what the method, though, encrypted chat appears to have become a staple among political operativeswhich happens to raise a whole host of legal questions.

Using an app like Confide for personal communications, like keeping in touch with family members or coordinating gym trips with coworkers, is within bounds. It also, according to a recent Washington Post report, has enabled vital leaks to the media.

At this point its still possible that politicos are legitimately using Confide for personal purposes. I know people who use [Confide], but I dont know anyone whos using it who shouldnt be using it, says Scott Tranter, a founder of the political data consultancy Optimus. The people who I know use it because its secure messaging.

Its sometimes not easy, though, to separate personal conversations from those that are work-related. Where those lines blur, legal concerns arise.

If these apps are being used by White House staff, it raises very disturbing questions about compliance with the Presidential Records Act specifically, and more broadly the Federal Records Act, says David Vladeck, a communications and technology law researcher at Georgetown Law School. The whole point of these statutes is to assure that our nations history is neither lost nor manufactured, and the kinds of apps that obliterate the messages are completely incompatible with that and at odds with the law.

Confide puts the onus on its users to walk a legal line. We expect people to use Confide in a way that complies with any regulation that may be relevant to their particular situation, says Brod.

Encryption itself isnt the issue. End-to-end encrypted communication can coexist with the goals of public disclosure laws, so long as someone retains the decryption key. Using strong security for sensitive government communications makes sense and is appropriate if the parties sending and receiving the communications can still archive them.

But disappearing messages are definitionally communications that are difficult, if not impossible, to record. Plus, its hard to assess how people are using a communication service like Confide if theres no record of anything they ever sent. Since Confide is explicitly designed to eliminate a paper trail, its use creates at least the appearance of misconduct, if not the reality, says Allison Stanger, a cybersecurity fellow at the New America Foundation. Those who wanted to lock up Hillary Clinton for the use of a private email server should be very concerned about this practice.

Its a tough act to balance. Encryption-enabled leaks help hold administrations accountable, a clear public good. The challenge is preserving that level of secrecy without creating black holes where public records should be.

Read more:
Judicial Watch Can FOIA the EPA Over Signal Chat, But They May ... - WIRED

How secure are your private messages?

At a time when data breaches are at an all-time high, thats a question worth thinking about. Hackers, particularly state-sponsored hackers, have shown a willingness to go after big, established tech companies like Yahoo and Google. These big platforms often hold users personal information or in some cases, users private correspondence on their servers.

But there are ways to protect your private communications, and many consumer tech companies are starting to offer better encryption so that your personal messages wont fall into the wrong hands. Whether youre concerned about your messages being read by hackers, advertisers or even the police, encryption can protect you.

What products should you be using to enhance your privacy? We took a look at more than a dozen consumer messaging services to give you a better idea.

The key here is whether or not a service is end-to-end encrypted. Messages sent with that level of encryption are only readable in two places: The senders and recipients devices most likely their smartphones. These messages arent stored on company servers, and as a result, cant be mined to help advertisers or read by law enforcement officials, even with a proper warrant.

(That has created controversy for both Apple and WhatsApp in the past.)

Which app is right for you? Here are some additional details on some of the more popular apps to help you decide.

Link:
The apps to use if you want to keep your messages private - Recode

(TNS)-- State employees would be required to use encryption to guard work material containing sensitive data under legislation being offered by Rep. Rob Matzie.

Matzies Protecting Commonwealth Data bill, House Bill 1325, would protect Pennsylvanians by requiring that state employees use encryption when transmitting Social Security numbers, drivers license numbers, financial information and other sensitive data, he said in a statement Thursday.

My common-sense measure would help make transactions with the state safer by curtailing the use of nonsecure internet connections, said Matzie, D-16, Ambridge.

Matzies bill joins others introduced by House Democrats, including Washington County state Rep. Brandon Neuman, after the Republican-controlled Congress recently rolled back internet privacy regulations.

Currently, Pennsylvania does not require state employees to use encryption, said Matzie, who warned that this lax defensive programming could create a security gap that could be exploited.

Matzie introduced similar legislation in 2014, but it failed to receive a House floor vote after unanimously being moved out of the House Consumer Affairs Committee.

In his statement, Matzie referred to hacking cases involving government bodies, including the state Senate, that make it clear that Pennsylvania must take measures to protect consumers privacy.

The recent federal action has forced states to push for safeguards, and a host of bills are being crafted or introduced all over the country to solidify consumer protections, he said.

Neuman, D-48, North Strabane Township, also announced Thursday that he is drafting legislation to require internet service providers to obtain permission from customers before storing, sharing or selling sensitive personal information.

His soon-to-be House Bill 1321 would restore those protections by the Federal Communications Commission that were eliminated by Congress.

Citizens deserve a say on if, when and how their personal, online information, such as Social Security numbers and health information, is used or sold, Neuman said in a prepared release. Citizens are not cyber-serfs whose online privacy is available for the taking by the highest bidder.

Neumans bill would require internet service providers receive permission to sell consumers information, such as minute-to-minute locations, health and financial data, and web browsing and app usage histories.

It would also allow consumers to opt-out of having their nonsensitive information shared and prohibit internet service providers, commonly referred to as ISPs, from denying service to customers who choose not to have their information sold.

2017 the Beaver County Times (Beaver, Pa.) Distributed by Tribune Content Agency, LLC.

Read the original:
Lawmaker Pushes Bill That Requires Encryption by Pennsylvania State Employees - Government Technology