Category Archives: Encryption
A 2023 Guide to Secure Cloud Deployment for Improved Application … – Infosecurity Magazine
Authentication/authorization, data integrity and storage protection; these three pillars correspond to the current majorchallenges in application securityand are essential to ensure the confidentiality, integrity and availability of data stored in the cloud.
Through the strategies and best practices outlined in this guide, organizations can safeguard their cloud deployments against potential security breaches and protect their applications from unauthorized access and data theft.
Cloud deployment of applications introduces unique challenges to security since the infrastructure is shared among multiple tenants and accessible over the internet.
Moreover,applications are the weakest security link, so it is crucial to establish strict controls over who can access the system and how they access it. This is where identity and access management (IAM) comes in, as it allows you to manage user identities, control access to resources and enforce security policies across the entire infrastructure.
The following are some best practices to follow:
In any case, IAM cannot be viewed as a standalone security measure, as it needs to be integrated with other enterprise security processes to be effective.
For one, IAM can beintegrated with security information and event management(SIEM) systems to provide real-time monitoring and alerting of security events across the entire infrastructure. This helps identify and respond to potential security incidents before they can cause harm.
According toa report released last yearby Tripwire, 44% of organizations reported their biggest application security concern as protecting data. One of the ways breaches happen in application security is through data leakage, which can happen in a number of ways.
For example, an attacker could access the API endpoint and extract sensitive information. Alternatively, an attacker could intercept network traffic and capture sensitive data in transit.
Cloud deployments are often subject to constant change, with new services and APIs being frequently added or modified. This can make it difficult to maintain security controls and ensure all APIs are properly secured. In 2022,a report by Salt identified a 117% risein malicious API traffic over the previous year.
In addition, regarding data integrity,according to IBM, WS-Security can protect against tampering or unauthorized modification of SOAP messages transmitted between web service providers and consumers. It achieves this through digital signatures, which are created using cryptographic algorithms that ensure the authenticity and integrity of the message.
There are various ways of protecting data storage platforms.
To start with,by using homomorphic encryption, cloud applications can ensure that sensitive data is protected at all times, including when it is being processed or analyzed in the cloud.
As such, it helps to reduce the risk of data breaches and other security incidents that can occur when sensitive data is stored in the cloud. This is because homomorphic encryption allows computations to be performed on the encrypted data without revealing the underlying plaintext, which prevents tampering with the data.
In addition, when it comes to cloud deployments, secure enclaves protect the storage of critical data, such as encryption keys, digital certificates and other sensitive information that unauthorized users can access and manipulate. Notably,Apples latest devices use secure enclavesintegrated into their system on chips (SoCs).
By isolating the storage and execution of such data and operations within a secure enclave, the risk of exposure to external threats is significantly reduced, making it much harder for attackers to access and compromise the data.
Secure cloud deployment is critical to protect applications and data stored in the cloud. By following the best practices outlined in this guide, businesses can mitigate security risks and safeguard against threats such as data breaches, unauthorized access and cyber-attacks.
See the rest here:
A 2023 Guide to Secure Cloud Deployment for Improved Application ... - Infosecurity Magazine
Getting Ahead of the Ransomware Epidemic: CISAs Pre … – CISA
Over the past several years, ransomware attacks have caused extraordinary harm to American organizations: schools forced to close, hospitals required to divert patients, companies across all sectors facing operational disruption and expending untold sums on mitigation and recovery. At CISA, we are working with partners to take every possible step to reduce the prevalence and impact of ransomware attacks. We recently announced an important initiative to help organizations more quickly fix vulnerabilities that are targeted by ransomware actors. Today, were excited to announce a related effort that is already showing impact in actually reducing the harm from ransomware intrusions: our Pre-Ransomware Notification Initiative. Like our work to reduce the prevalence of vulnerabilities, this effort is coordinated as part of our interagency Joint Ransomware Task Force.
Report Ransomware
We urge organizations to report observed activity, including ransomware indicators of compromise and tactics, techniques, and procedures, to CISA or our federal law enforcement partners. You can find information on reporting at stopransomware.gov.
We know that ransomware actors often take some time after gaining initial access to a target before encrypting or stealing information, a window of time that often lasts from hours to days. This window gives us time to warn organizations that ransomware actors have gained initial access to their networks. These early warnings can enable victims to safely evict the ransomware actors from their networks before the actors have a chance to encrypt and hold critical data and systems at ransom. Early warning notifications can significantly reduce potential loss of data, impact on operations, financial ramifications, and other detrimental consequences of ransomware deployment.
This remarkable effort relies on two key elements. First, our Joint Cyber Defense Collaborative (JCDC) gets tips from the cybersecurity research community, infrastructure providers, and cyber threat intelligence companies about potential early-stage ransomware activity. Without these tips, there are no notifications! Any organization or individual with information about early-stage ransomware activity is urged to contact us at Report@cisa.dhs.gov. Once we receive a notification, our field personnel across the country get to work notifying the victim organization and providing specific mitigation guidance. Where a tip relates to a company outside of the United States, we work with our international CERT partners to enable a timely notification.
Although were in the early days, were already seeing material results: since the start of 2023, weve notified over 60 entities across the energy, healthcare, water/wastewater, education, and other sectors about potential pre-ransomware intrusions, and weve confirmed that many of them identified and remediated the intrusion before encryption or exfiltration occurred.
In cases where ransomware actors have already encrypted a network and are holding data and systems for ransom, JCDC works closely with the victim organizations to provide threat actor tactics, techniques, and procedures (TTPs) as well as guidance to help reduce the impact of an attack. For example, we have provided information to help identify the data that may have been exfiltrated from an affected entitys network as well as details of the intrusion to support investigative and remediation efforts. JCDC also works with the cybersecurity research community and others to develop cybersecurity advisories on ransomware actors and variants to enable improved network defense at scale as part of our ongoing #StopRansomware campaign.
Continuing to enhance our collective cyber defense is contingent upon persistent collaboration and information sharing between partners across government and the private sector. To enable the broader cyber community to benefit from valuable threat intelligence, we urge organizations to report observed activity, including ransomware indicators of compromise and TTPs, to CISA or our federal law enforcement partners, including the FBI and the U.S. Secret Service. You can find information on ransomware reporting and view additional resources to manage ransomware risk at stopransomware.gov.
JCDC is a public-private cybersecurity collaborative that leverages new authorities granted by Congress in the 2021 National Defense Authorization Act to unite the global cyber community in the collective defense of cyberspace. CISA welcomes all critical infrastructure organizations and entities with cybersecurity expertise and visibility to participate in our collaboration efforts. If your organization is interested in participating in collaborative efforts to stop ransomware, please visit cisa.gov/JCDC-FAQs or email cisa.jcdc@cisa.dhs.gov.
Here is the original post:
Getting Ahead of the Ransomware Epidemic: CISAs Pre ... - CISA
Now you can link 4 accounts on WhatsApp & use it even when you’re offline, easily discover common groups w – The Economic Times
Meta-owned WhatsApp is often working on new updates to roll out to make user experience on the platform smoother and secure. While WhatsApp rolled out the feature to link your account on more than one device ages ago, a new update makes it possible for users to stay connected to their WhatsApp account on four different devices and one smartphone simultaneously. The instant-messaging platform will now allow users to link their WhatsApp account on four devices and a phone, making it easier to stay connected on web and desktop.
All your personal messages, media, calls will stay secure with end-to-end encryption that will work on all your linked devices. "Your personal messages, media, and calls are end-to-end encrypted. Each linked device connects to WhatsApp independently while maintaining the same level of privacy and security through end-to-end encryption that people who use WhatsApp have come to expect," WhatsApp said.
If you do not know where all you have linked your WhatsApp on, then go to your WhatsApp Settings, click on Linked Devices and then review all the devices where you have linked your WhatsApp account. In case you want to remove an account, click on the device mentioned in the list and tap on 'Log Out' option.
The new features related to Group which will start rolling out on WhatsApp globally over the coming weeks.
Read the original post:
Now you can link 4 accounts on WhatsApp & use it even when you're offline, easily discover common groups w - The Economic Times
Violation of norms on unsolicited commercial communication led to 32,032 disconnections in 2022: Ashwini V – The Economic Times
Telecom operators disconnected 15,382 and 32,032 connections during 2021 and 2022, respectively over violation of regulations, meant to curb Unsolicited Commercial Communication or pesky marketing calls and messages, Parliament was informed on Friday. Till date, TRAI has imposed financial disincentives of Rs 34.9 crore on the access service providers for failing to curb unsolicited commercial communications in their networks from Registered Telemarketers, Telecom Minister Ashwini Vaishnaw said in a written reply in Rajya Sabha. Telecom Regulatory Authority of India (TRAI) has issued Telecom Commercial Communication Customer Preference Regulation - 2018 to curb the Unsolicited Commercial Communication (UCC).
"The Access Service Providers have disconnected 15,382 and 32,032 connections during the calendar year - 2021 and 2022, respectively for violating TCCCPR-2018," Vaishnaw said.
To a separate question in Rajya Sabha, on whether 5G technology increases the risk of hacking due to lack of encryption during the connection process, making such devices easy targets for cyber-attacks, Chauhan replied in negative.
Also, as per the license conditions, the licensee is completely responsible for the security of its network, Chauhan added.
"BSNL sold one land of area 1.48 acres to Directorate General of Lighthouses and Lightships in Goa. Further, BSNL has leased out two properties that is a land of area 0.56 acres in Patna to Gas Authority of India Ltd (GAIL) and a land of area 24.29 acres at Gopalpur, West Bengal to Rail Vikas Nigam Limited (RVNL). MTNL has not sold or leased out any property till date," Chauhan said.
Continue reading here:
Violation of norms on unsolicited commercial communication led to 32,032 disconnections in 2022: Ashwini V - The Economic Times
How to Deal with Security Vulnerabilities – PIA VPN – Privacy News Online
Security breaches have become increasingly common, with businesses and individuals alike falling victim to cybercriminals. In 2022, there were 1802 data compromises in the US, affecting 422 million individuals through data breaches, leakage, and exposure, all resulting in unauthorized access to sensitive data by threat actors.
Third-party audits have revealed that many of these breaches are the result of common security vulnerabilities that could have been prevented with proper security controls and testing. These vulnerabilities include outdated software, weak passwords, and misconfigured servers, among others.
With so much of our sensitive data being stored and transmitted online, its crucial to follow proper cyber hygiene to minimize the risk of data breaches and cyber attacks.
In this article, well explore some practical tips for dealing with security exploits and vulnerabilities, as well as ways to verify that the services and apps we use are secure.
A security vulnerability refers to a software or system flaw that attackers can exploit for various reasons to gain unauthorized access, disrupt operations, steal data, or inflict other forms of harm. These vulnerabilities can occur at any level of a system, from the operating system and network protocols to individual applications.
Exploits are attacks that take advantage of security vulnerabilities to gain unauthorized access or perform other malicious actions. An exploit is a specific technique or method that an attacker uses to take advantage of a vulnerability.
Exploits can be created for known vulnerabilities, but they can also be zero-day exploits, which are exploits that take advantage of vulnerabilities that are not yet known to the vendor or the public. Zero-day exploits are particularly dangerous because there is no patch or fix available to prevent the attack.
Some of the most dangerous vulnerabilities in companies and organizations that operate in the US include:
Overall, security vulnerabilities represent a significant menace to individuals, organizations, and society at large. It is vital to keep an eye out for possible vulnerabilities and to take proactive measures to prevent their exploitation.
The known vulnerabilities catalog is a comprehensive database with all the known flaws of various software and hardware products. It serves as a critical tool for cybersecurity professionals because it helps them identify, assess, and mitigate vulnerabilities in their organizations.
By referencing the catalog, cybersecurity professionals can identify potential security weaknesses in their organizations software and hardware products.
The catalog is developed and maintained by the Cybersecurity and Infrastructure Security Agency (CISA), a government agency responsible for safeguarding the nations critical infrastructure against cyber threats.
It provides details such as vulnerability descriptions, CVSS scores, and the impact of the vulnerabilities. Finally, the catalog is updated as new vulnerabilities are discovered.
Organizations can utilize third-party audits to identify security vulnerabilities in their systems. Some of the most common security vulnerabilities found by third-party audits include:
Regarding VPN audits, some of the most common security vulnerabilities found by third-party audits include:
Overall, it is important for organizations to conduct regular third-party audits to identify and mitigate security vulnerabilities and to ensure that their systems and applications are secure.
Security vulnerabilities can be spotted through a variety of methods.
Penetration testing, which involves hiring ethical hackers to try and exploit vulnerabilities in a system is one of the best ways to spot security flaws. The results of the testing can reveal any weaknesses in the system.
Vulnerability scanning relies on software to check the system for known vulnerabilities, but its not always as reliable as an expert, so its often used in conjunction with pen testing.
Next up we have code reviews, which just means examining the source code of a system to identify any potential vulnerabilities that could be exploited. This can help identify areas of the system that need to be hardened to prevent attacks.
Bug bounty programs are incentivized programs that reward researchers for finding and reporting security vulnerabilities in a system.
User reports can also report security vulnerabilities they come across while using a system. This can be done through support channels or dedicated security reporting mechanisms.
In general, a combination of these methods is often used to ensure that vulnerabilities are identified and addressed before they can be exploited by attackers.
Disclosure of cybersecurity vulnerabilities is a complex issue and requires a careful consideration of various factors. Here are some general guidelines on when security vulnerabilities should be disclosed:
In general, disclosure of cybersecurity vulnerabilities can help improve the security of the affected software or system, but it should be done in a responsible and coordinated manner to avoid exposing users to unnecessary risks.
Yes, Private Internet Access (PIA) has undergone a third-party audit by Deloitte, one of the Big Four accounting firms. The audit was conducted in 2022 and included a review of PIAs infrastructure, policies, and procedures.
Deloittes audit found that PIAs security controls were suitably designed and implemented to protect user data and maintain the confidentiality, integrity, and availability of its services. The audit also found that PIA had implemented appropriate measures to prevent unauthorized access to user data, such as multi-factor authentication and strong encryption.
Overall, the audit by Deloitte demonstrates our commitment to transparency and accountability of our security practices.
Here are some reasons why a security audit is crucial for a VPN, and for service that handles personal information, for that matter:
A security audit can demonstrate to customers that the service provider takes security seriously and has implemented appropriate security measures to protect their personal information. This can help build trust and confidence in the service.
Security vulnerabilities are a serious threat to individuals, businesses, and society as a whole. With the increasing number of data breaches and cyber attacks, it is crucial to identify and address security vulnerabilities to prevent them from being exploited by attackers.
Using strong passwords, updating software regularly, properly configuring servers, and conducting regular security audits are best practices for cyber hygiene.
Always use services from reputable vendors who prioritize security and are transparent about their security practices. Regular security audits and compliance with industry standards, such as ISO 27001, can also provide assurance that a service provider is committed to security best practices.
A security vulnerability refers to a weakness or flaw in a computer network, application, or system that can be utilized by attackers to gain access without authorization, steal confidential information, or cause damage.
Vulnerabilities may arise due to various factors such as software code errors, incorrect configurations, or inadequate security practices.
There are several factors that can cause security vulnerabilities, including:
Programming errors or bugs in software code Misconfigured or poorly secured systems Failure to apply software patches or updates Human error or negligence Malicious software, such as viruses or malware Weak or easily guessable passwords Lack of security awareness and training
Security vulnerabilities can come in many different forms and their prevalence may depend on the specific situation. Some examples of commonly occurring security vulnerabilities include:
Cross-site scripting (XSS) SQL injection Misconfigured or unsecured servers Insecure passwords or authentication mechanisms Buffer overflows Missing security patches or updates
Managing security vulnerabilities involves a proactive approach to identify, prioritize, and address vulnerabilities in a timely and effective manner.
There are several recommended best practices for managing security vulnerabilities, such as conducting regular vulnerability assessments,penetration testing and monitoring system logs and network traffic for any signs of suspicious activity.
Yes, PIA has undergone a security audit by Deloitte, which reviewed its infrastructure, policies, and procedures to ensure compliance with industry standards for security and privacy.
Deloittes report found that PIAs security controls were appropriately designed and implemented, and that it had measures in place to prevent unauthorized access to user data.
This independent audit demonstrates PIAs commitment to transparency and accountability in its security practices, and its dedication to protecting user privacy and security online.
Read the original post:
How to Deal with Security Vulnerabilities - PIA VPN - Privacy News Online
Everything You Need to Know About the Encryption on Zoog’s Free VPN – MUO – MakeUseOf
Zoog's free VPN service can provide you with elevated privacy and security online, but what's its encryption standards like? What encryption cipher does Zoog use, and is it safe enough for you to trust?
Zoog was founded in 2013 by a group of tech enthusiasts, and is based in Greece. The service offers premium and paid plans to users, with the former having more features and server accessibility. But we'll be focusing on Zoog's free version today.
Zoog is a no-log VPN service, meaning it doesn't record or share the data it encrypts for you. This is a big plus in terms of security and privacy.
The free Zoog plan offers you six different server locations (with the other 63 available servers only being available to premium members). For a basic, free VPN, six options isn't too bad. You can connect to servers in Germany, the Netherlands, Singapore (of which there are two), London, and Washington. The two Singapore servers technically takes the location choice down to five, so keep this in mind.
The Zoog app is easy to use, and doesn't require much getting used to.
The interface itself is basic, with a simple main screen that allows you to activate or deactivate the VPN, as well as see how much of your monthly data limit you've used. The free Zoog plan gives users 10 GB of data monthly. This isn't an awful lot, but is enough for browsing and the odd video.
You can also switch VPN protocols in Zoog's app settings and enable the auto-reconnect feature, connect-on-start feature, and VPN shadowing (which lets you overcome censored firewalls).
But when it comes to VPNs, it's the security that matters above all else. So, what kind of encryption is Zoog offering its customers to keep their internet traffic safe?
Many popular VPN providers out there today use AES-256 encryption to secure user data. This is a symmetric key cipher that uses a 256-bit key to encrypt data. AES stands for Advanced Encryption Standard (or Rijndael), and is used by numerous world governments, security agencies, and, VPN providers to keep data inaccessible to unauthorized parties.
ExpressVPN, SurfShark, NordVPN, Windscribe, ProtonVPN, and Zoog's premium plan all use AES-256. However, Zoog doesn't use AES-256 encryption on its free version. Rather, it uses AES-128 encryption. As you may have guessed, the difference between these two encryption ciphers is the number of bits used in the key. While the former uses 256 bits, the latter uses 128.
But this doesn't mean Zoog is not secure. AES-128 encryption is still very tough to overcome. In fact, AES encryption has never been cracked, be it the 128-bit or 256-bit cipher. There's also a 192-bit AES cipher, which has also never been cracked. Overall, this encryption standard is very good at what it does.
As said on the Zoog website, "If the most powerful computer on the Earth was trying to crack a 128-bit key, it would still take approximately 139 trillion years." So, you've not got much to worry about there.
In fact, AES-128 encryption can outshine AES-256 in some ways. For starters, AES-128 is faster and more efficient.
If you want to use Zoog and enjoy the benefits of AES-256, you'll need to upgrade to the premium plan. You can pay for Zoog monthly, or buy a year or two years' worth of membership in bulk. The pricing for this is as follows:
Though Zoog uses two different encryption ciphers on its free and premium plans, both ciphers are still highly secure, meaning Zoog is safe to use either way.
But if AES-128 encryption isn't for you, don't worry. There are so many free VPN services that use 256-bit encryption (including TunnelBear and PrivadoVPN), you'll have no trouble finding a provider with a more secure encryption cipher.
While Zoog's free and premium plans use two different AES encryption ciphers, both are highly secure, meaning your data will be sufficiently encrypted on both versions. So, if you're looking to save money and don't mind missing out on certain features, Zoog's free VPN service could suit you well.
Go here to read the rest:
Everything You Need to Know About the Encryption on Zoog's Free VPN - MUO - MakeUseOf
Data Encryption Methods and their Advantages and Disadvantages – Security Boulevard
Protecting data has become a critical part of every organizations operation. However, choosing the best method of data encryption can be difficult with all the available options. Here we discuss the various encryption methods available, the strengths and weaknesses of each, and approaches to simplify data encryption.
Encryption is the transformation of sensitive data (plaintext) into obfuscated data (ciphertext) using a mathematical algorithm and a key. The key is a random set of bits of a given length. To protect the data, the key must be kept secure.
Data encryption can be further broken down into two types, Symmetric and Asymmetric encryption.
In symmetric encryption, the same encryption key is used to both encrypt and decrypt the data. Therefore this single key must be kept confidential by all parties using it.
The most common symmetric encryption algorithm today is advanced encryption standard (AES), known for its security and being widely available.
AES can be deterministic or random. Deterministic means that for a given key and plaintext, the ciphertext is always the same, whereas random means the ciphertext is different every time. Random ciphertext values provide additional security when there are a small number of plaintext inputs, also known as low-cardinality. For example, a persons age is between 0 and 1221 so the cardinality is 123 possible inputs. At one extreme, the cardinality could be two, say the answer to, Has patient been diagnosed with Type II Diabetes, true/false. In that case, a deterministic system is not going to work well because a bad actor would only have to verify one person with or without diabetes and know everybodys situation. However, a random system will have different values for every person providing additional security.
Asymmetric encryption, also known as public key encryption, is a type of encryption that uses two different keys for encrypting and decrypting data. One key, known as the public key, is used for encryption and can be freely shared with anyone, while the other key, the private key, is kept secret and used for decryption. Alternately for digital signatures and authentication use cases, the private key is used to encrypt and the public key decrypts to validate the identity of the key holder.
Asymmetric encryption solves a major challenge with symmetric encryption in that it provides a secure way of exchanging sensitive information over insecure channels, such as the internet, without the need for a shared secret key. This is because only the person with the private key can decrypt the data, even though the public key used to encrypt the data is widely known.
One of the most commonly used examples of asymmetric encryption is the RSA algorithm, named after its inventors Ron Rivest, Adi Shamir, and Leonard Adleman.
Format Preserving Encryption (FPE) is a type of encryption that allows for the encryption of data while preserving its original format. Unlike traditional encryption, which typically produces ciphertext of fixed length, FPE produces ciphertext that retains the original length and format of the plaintext.
FPE is commonly used in situations where the format of the plaintext data is important, such as credit card numbers, social security numbers, and other types of sensitive data. By preserving the original format, FPE allows for encrypted data to be used in systems and applications that require the same format as the original plaintext data.
In 2016 NIST published SP 800-38G defining FPE. It uses industry standard AES, along with the advantages of performance and security that brings, but the process is modified such that the ciphertext is the same length and format as the plaintext.
FPE has proven to be highly secure and performant with any cardinality of a million or more. This translates to any numerical data (0-9) with six or more digits; so phone numbers, social security numbers, national IDs, drivers licenses, and credit cards easily meet this. Accordingly, most alpha-numeric (0-9, A-Z, a-z) data meets this need with shorter possible length, such as names and addresses. FPE output libraries can consist of numbers (0-9), letters (A-Z, a-z) or both.
Partial FPE is also possible. For example, the social security number 111-22-3333 could be partially obfuscated to 532-58-3333 so that the last four digits can be used by customer support personnel to identify a client.
FPE has recently become the favorite algorithm of choice for most organizations migrating their data to the cloud. It provides assurances that the data will be protected while outside of their network boundaries, but also that it will not break any applications that expect data to be formatted in specific ways.
The one downfall common to traditional data encryption methods is that operations doing math, searches, or sorts cant be done on the ciphertext data. If an organization must do this type of operation but cant allow the sensitive data itself to be decrypted, this is where privacy enhanced computation (PEC) comes into play. Privacy preserving analytics is another term. There are three competing versions.
Homomorphic Encryption is complex math done on the encrypted data to enable mathematical operations. The security has been called into question on this method, but the biggest issue is that it requires so much processing power that performance is slowed by orders of magnitude. As of today, it is mostly impractical.
Secure Multi-party Computation (SMPC) is a procedure where the sensitive data is broken into pieces and shared amongst several parties. The keys or secrets are also broken and distributed amongst the parties. The keys are combined using one of several methods and then the computations are done on all the data pieces in such a way that the results are calculated, but the individual inputs are meaningless. The downside to SMPC is it requires separate functions to act as the parties and do the computations resulting in some additional delay.
Private Enclave applies the concept of performing all memory and processing in a separate and highly secure portion of a computer processor. Intel processors provide this capability, and they call it SGX. The encrypted data goes in, it is decrypted and processed, then only the results are sent out. One downside to SGX is that distributed computing cant be done since everything is confined to a single enclave. Additionally, your database processors all have to be Intel with SGX capabilities. Finally, several vulnerabilities in SGX have been found. Though this is true of every computing device and application and it is why patching and updates are part of all security practices.
Baffle implements PEC in database user-defined functions (UDF). Similar to SGX, UDFs allow operations on encrypted data by processing it within the UDF. Even the DBA isnt able to access the decrypted data with this method. This has proven to be the best combination of security and performance.
Data encryption has become essential in safeguarding sensitive information for organizations of all sizes. The available encryption types include symmetric and asymmetric encryption, each with its own strengths and limitations. Symmetric encryption is faster and more efficient than asymmetric encryption, but it requires secure key management, while asymmetric encryption provides secure key distribution, making it highly scalable. Format Preserving Encryption (FPE) is a new type of encryption that preserves the original format of the plaintext, making it ideal for sensitive data like credit card numbers and social security numbers. With FPE, organizations can now protect their data in the cloud without compromising their applications data format, making it the algorithm of choice for most organizations migrating their data to the cloud.
Ideally, organizations should look for data encryption solutions that provide simplicity in deployment and management. Baffles solution uses a unique approach that does not require any application code to be modified, and simplifies management from a centralized console. Learn more here.
The post Data Encryption Methods and their Advantages and Disadvantages appeared first on Baffle.
*** This is a Security Bloggers Network syndicated blog from Baffle authored by Billy VanCannon, Director of Product Management. Read the original post at: https://baffle.io/blog/data-encryption-methods-and-their-advantages-and-disadvantages/
Read more:
Data Encryption Methods and their Advantages and Disadvantages - Security Boulevard
Legislator revives effort to address police radio encryption – Pleasanton Weekly
After falling just short in the final days of last year's legislative session, Sen. Josh Becker is renewing his push for a law that would require law enforcement agencies to make radio communications accessible to the media.
Becker, D-San Mateo, has recently introduced Senate Bill 719, a bill that would require all police departments to grant access to real-time radio communications to media representatives or organizations. The bill, which he calls the Law Enforcement Communications Transparency Act, is similar in its intent to last year's Senate Bill 1000, which faltered last August when the powerful Assembly Appropriations Committee opted not to advance it for a full Assembly vote.
There are, however, some differences between the two bills. While last year's proposal would have required law enforcement agencies to grant access to the broader public, the current one would ensure access for "duly authorized media representatives or organizations." If SB 719 passes, police departments would have 30 days to comply with a media request for access to real-life radio communications.
The bill is a response to a recent trend across California of police and sheriff departments encrypting radio communications, a move that blocks news organizations from using scanners to track police activities. Many of these agencies, including Palo Alto and Mountain View, were responding to an October 2020 directive from the state Department of Justice, requiring them to enact procedures that protect sensitive personal information such as an individual's Social Security number and criminal history from being broadcast over publicly accessible frequencies. The state DOJ allowed departments to either encrypt communications or adopt policies that protect personal information.
News organizations, including Embarcadero Media, had opposed law enforcement's switch to encryption, arguing that it reduces transparency and impedes their ability to provide information to the public during emergencies. Numerous law enforcement agencies opposed the bill and claimed that undoing their recent efforts to encrypt radio communications would be costly. A spokesperson for the Riverside County Sheriff's Office told an Assembly committee that removing encryption would cost the department "several millions of dollars" and thousands of hours.
That argument did not hold true in Palo Alto, where the police department encrypted radio communications in January 2021 but then reversed that decision last August, when Andrew Binder took over as police chief. Instead of encryption, the department adopted a new radio policy that gives officers various options for securely transmitting personally identifiable information. These include using their cellphones for that purpose or using multiple broadcasts to relay bits of information that, if considered together, could be used to identify an individual.
Former Palo Alto Police Chief Bob Jonsen, who opted to encrypt the city's radio communications, has since been elected to serve as sheriff at Santa Clara County, where encryption remains in place.
Becker said the goal of the new bill is to "restore access the media and the public had to police radio communications for nearly a century up until three years ago when law enforcement agencies were given the option to shut it down."
Becker said that since the DOJ directive, about 100 law enforcement agencies across the state have gone with full encryption, a number that he noted is climbing. The list includes large countywide agencies such as the sheriff's departments in Santa Clara, Riverside, Orange and San Bernardino counties.
SB 719 would not apply to tactical operations, undercover operations or "other communications that would unreasonably jeopardize public safety or the safety of officers or dispatchers if made public," according to the bill's text.
"Encryption of public safety radio communications has largely focused on its impact to public safety officers without consideration of the public's vested interest," the bill states. "This bill seeks to correct that imbalance by continuing to protect sensitive information from public distribution while also ensuring the transparency of non-sensitive communications that Californians have come to expect."
Becker said in a statement that the ability to hear how officers talk to one another over the radio helps make police departments more accountable.
"On a practical level, it also makes it easier for the media to report on public safety activities such as accidents or shootings, so the public can be told about areas to avoid."
The bill is scheduled for a hearing in front of the Senate Public Safety Committee on March 28.
Read more:
Legislator revives effort to address police radio encryption - Pleasanton Weekly
WhatsApp Tells UK Government It’s Still Not Willing To Undermine … – Techdirt
from the don't-make-me-tap-the-sign dept
The UK government is entertaining even more plans to undermine (or actually outlaw) end-to-end encryption. And its not gaining any support from the multiple services (and multiple people) these efforts would harm.
Both Signal and Proton have made it clear theyll pull their services rather than weaken their encryption to comply with UK government demands. WhatsApp is saying the same thing telling the UK government something it has already told it at least twice.
In 2017, WhatsApp made an unofficial announcement of its policies when UK law enforcement showed up with a demand to compel decryption of a targeted account. WhatsApp refused to comply and the UK government apparently decided not to press the issue. At least not directly.
Five years later, the UK government is still hammering away at encryption, adding more mandates to its steadily simmering Online Safety Bill. And WhatsApp told the UK government what it told it back in 2017: breaking encryption just isnt an option. (In the form of a lawsuit challenging an Indian law, WhatsApp said the same thing to the Modi administration and its series of rights-violating internet-related laws.)
Another year has passed and the UK government still wants to get the Online Safety Bill passed. And, once again, Meta has surfaced to tell the government that it can pass all the laws it want, but none of them will force WhatsApp to undermine its encryption.
WhatsApp would refuse to comply with requirements in the online safety bill that attempted to outlaw end-to-end encryption, the chat apps boss has said, casting the future of the service in the UK in doubt.
Speaking during a UK visit in which he will meet legislators to discuss the governments flagship internet regulation, Will Cathcart, Metas head of WhatsApp, described the bill as the most concerning piece of legislation currently being discussed in the western world.
The UK government doesnt have any leverage here. WhatsApp will simply stop offering its service in the UK. As Cathcart points out, 98% of its users reside in other countries. And theres no reason it should put all of its users at risk, just because the home to 2% of its user base is being stupid about end-to-end encryption.
Now, that 2% would probably like to have access to an encrypted messaging service, whether its WhatsApp, Signal, or Protons offering. Unfortunately for them, supporters of the bill dont want them to have these options. But thats not going to work out well for the government. Angering constituents tends to shift the leverage back their way, which means legislators are pushing a terrible bill from a position of weakness.
The potential for hefty fines only makes it more likely service providers will exit this market rather than give the government what it wants.
Under the bill, the government orOfcomcould require WhatsApp to apply content moderation policies that would be impossible to comply with without removing end-to-end encryption. If the company refused to do, it could face fines of up to 4% of its parent company Metas annual turnover unless it pulled out of the UK market entirely.
If the options are providing a weakened service that harms all users or shelling out 4% of its income on a regular basis, the option these legislators failed to consider is really the only intelligent option: exiting the market.
And when that starts happening, the government is going to get an earful from the people it never bothered to listen to in the first place: domestic users of services these legislators are actively trying to destroy.
Filed Under: encryption, online safety bill, ukCompanies: meta, whatsapp
See the rest here:
WhatsApp Tells UK Government It's Still Not Willing To Undermine ... - Techdirt
What is the CIA Triad? – Check Point Software
The Components of the CIA Triad
The CIA triads three main components confidentiality, integrity, and security are fundamental to a successful IT security program.
Confidentiality refers to the ability to keep sensitive data secret. This is a cornerstone of a data security policy and involves controlling access to sensitive data to ensure that unauthorized parties do not have access to it.
One of the most widely-used and powerful tools for protecting confidentiality is encryption. Modern encryption algorithms can ensure that only someone with access to the decryption key for data has the ability to read it. If an attacker or other unauthorized user gains access to the encrypted data, then it is unusable and does not pose a risk to data security.
However, with data encryption, data security and confidentiality boils down to managing control over the private keys used for data encryption and decryption. An organization can help to ensure data confidentiality by using strong encryption and defining access controls that control access to these encryption keys.
Data integrity refers to ensuring that data is authentic and has not been tampered with. This involves both ensuring that data was generated by the alleged creator and that it has not been modified since creation by an unauthorized party.
An organization has a variety of different tools that can help to ensure the integrity of its data. Some examples include the following:
Availability is the final part of the CIA triad because data is only useful to the organization if it is accessible for legitimate use. If security measures or cyberattacks render data or systems inaccessible, then the business suffers. Organizations face a variety of natural and human-driven threats to data and system availability. Power and internet outages or natural disasters could knock systems offline. Distributed denial-of-service (DDoS), ransomware, and other attacks could render systems and data inaccessible.
Companies can use a variety of countermeasures to help to protect the availability of data and systems. Resiliency and redundancy can reduce the potential risks of single points of failure. Strong patch management, anti-DDoS mitigations, and other security protections can help to block cyberattacks that could knock systems offline. Endpoint security solutions and backups can protect against ransomware and other malware that poses a threat to data availability.
The CIA triad is important because it clearly and simply lays out the main goals of data security and cybersecurity. If an organizations systems ensure confidentiality, integrity, and availability, then the potential cyber threats to those systems are limited. By making it easy to think about and remember these key goals, the CIA triad helps in secure design and security reviews.
The CIA triad is a general-purpose tool for secure design. Every system should have data confidentiality and integrity, and software and data should always be available for legitimate use. This means that the CIA triad should be used whenever making or evaluating cybersecurity decisions. It can also be useful for performing post-mortems after security incidents and training employees on IT security policies, security best practices, and common security threats.
The CIA triad is a theoretical framework that defines the main goals of a cybersecurity program. However, it is only useful if it is actually implemented within an organizations systems. Doing so requires the use of a range of cybersecurity solutions.
Check Point helps companies to achieve the CIA triad via an all-in-one security platform. To learn more about simplifying security through integration, check out this eBook. Then, sign up for a free demo of Check Points Quantum Network Security to see the capabilities of Check Points solutions for yourself.
Read the rest here:
What is the CIA Triad? - Check Point Software