Category Archives: Encryption
O’Neill Receives IACR Test-of-Time Award – UMass News and Media Relations
Adam O'Neill, assistant professor in the Manning College of Information and Computer Sciences at UMass Amherst (CICS), is one of three authors who recently received the Test-of-Time Award from the International Association for Cryptologic Research (IACR) for their paper Deterministic and Efficiently Searchable Encryption, presented at the IACR Crypto 2007 conference.
Co-authored by Mihir Bellare of University of California San Diego and Alexandra Boldyreva of Georgia Institute of Technology, who was then O'Neill's doctoral advisor, the award-winning paper has over 1000 citations, according to Google Scholar.
The paper has been lauded broadly for its lasting impact on cryptology and was cited by the IACR for placing searchable encryption on a rigorous footing, leading to a huge interest in this field in applications. Their paper's key contribution was to define and achieve strong definitions of privacy for deterministic encryption algorithms. It further showed that such algorithms are highly effective for encrypting fields in remote databases, allowing fast searching in such databases by "distinguished receivers" in a public-key setting. In public-key encryption schemes, a public key is used for encrypting data, and the data can be only decrypted by a corresponding private key. In a remote database setting, such schemes allow anyone to add encrypted data to the database, but only allow a distinguished receiver who owns the matching private key to retrieve and decrypt the data.
Deterministic encryption, which always produces the same encrypted text, or ciphertext, with the same inputs, allows fast searching for data retrieval by storing and indexing encrypted fields in a data structure. The challenge, according to the authors, is that inherent limitations of deterministic encryption can make data vulnerable to non-trusted users. While randomized encryption methods, which always produce a different ciphertext, are more secure, such ciphertexts are far slower to search, to the point of being unusable for large databases. In the paper, the authors struck a novel privacy-efficiency trade-off for the remote database setting.
The authors constructed two novel deterministic encryption schemes that were secure according to the new definitions: Encrypt-with-Hash and RSA-DOAEP. The latter functioned as the first example of a public-key cipher, which keeps the length of the ciphertext equal to the length of the plaintext--which, as the authors explained, is of great importance for reducing bandwidth cost and securing legacy security code. Additionally, they introduced the notion of efficiently searchable encryption schemes, which combine randomized encryption with deterministic "tags" that allow for fast searching.
Each year, the IACR Test-of-Time Award offers special recognition for lasting contributions of papers presented at IACR conferences at least fifteen years prior.
O'Neill joined CICS as a faculty member in 2019. Previously, he served at Georgetown University as an assistant professor in the computer science department. He also held a visiting faculty position in the cryptographic technology group at the National Institute of Standards and Technology and two postdoctoral appointments at Boston University and the University of Texas at Austin. He earned his doctorate in computer science from Georgia Institute of Technology under Professor Alexandra Boldyreva and a bachelor's degree in computer science and mathematics from the University of California San Diego.
Original post:
O'Neill Receives IACR Test-of-Time Award - UMass News and Media Relations
Are relay services the key to online privacy? – Ericsson
In the past few years, several actions to strengthen user security and privacy on the Internet have been taken. Focusing on techniques that have been developed and deployed to prevent unintended third parties from accessing and manipulating communication. The wide-scale deployment of HTTPS to provide encrypted communication for web content access is one example. Efforts to deploy new protocols that encrypt associated data like domain name system (DNS) requests is another. These techniques prevent passive observers from knowing the exact data that is exchanged, but they can still deduce which parties communicate and sometimes even which services have been requested.
More recently, focus has centered on various mechanisms that enhance user privacy by concealing even more data and metadata from Internet communications. These mechanisms often rely on a relay service that intermediates the communication between two hosts. While at first glance it seems counterintuitive to involve yet another party in the communication process to protect user privacy, the logic behind using relays is that in the end, each party can only access a limited set of information, and therefore each party knows less than before.
These relay services specifically aim to separate two important pieces of information: knowledge of the identity of the person accessing a service is separated from knowledge about the service being accessed. This requires two levels of encryption.
Simple VPN services only add one level of encryption to the link between the client and the VPN server: the VPN server can still see which services are being accessed, and by whom. In the Internet Engineering Task Force (IETF), the leading standardization body for Internet technologies, most of the activities related to these goals of separating information are indicated by using the term Oblivious, but theres also MASQUE (Multiplexed Application Substrate over QUIC Encryption) and a new to-be-chartered group called PPM (Privacy Preserving Measurements) that apply this communication pattern to different use cases.
MASQUE is a new IETF working group that extends HTTP CONNECT to initiate and manage the use of QUIC-based relays. Catch up on the background of QUIC and MASQUE in our earlier blog posts. MASQUE is a tunnel-based approach similar to VPN services. However, it sets up an encrypted connection to a relay, or so-called MASQUE server, using QUIC as a tunnel transport, then forwards traffic through that tunnel to a target server or another relay (see Figure 1).
Figure 1: Setup with two MASQUE proxies, e.g. hosted by the Mobile Network Operator (MNO) and the Content Distribution Network (CDN).
At present, the most recent example of such services being deployed is Apples new Private Relay service, which is in beta testing for iCloud+ users. When activated, Private Relay uses both the MASQUE and Oblivious DNS protocols for web traffic emitted by Safari, and for all DNS traffic.
In both cases, user traffic either for a web server or a DNS resolver is encrypted then first sent to a relay service that knows the users identity and IP but doesnt see the user request itself. This relay service then forwards the encrypted traffic to another relay, which can determine where to forward the end-to-end encrypted service request but doesnt know the users identity or IP address.
Figure 2: Apple's Private Relay setup - Only the ingress proxy can see the client's IP address and only the egress proxy knows the target server name.
Figure 3: Use of ingress and egress proxies to provide the Oblivious DNS over HTTP (DoH) service
While this approach seems straightforward, its a substantial change in communication patterns. Instead of sending traffic directly to a service, essentially all user traffic is routed to the same small set of intermediaries, and traffic received at the target server comes from a more limited set of entities as well. This significantly changes how traffic flows and is observed in the networks, as well as for the application service providers. Consequently, deploying these kinds of services on a large scale will have an impact on how we manage our networks.
Without relay services, traffic effectively broadcasts cleartext information to potentially unknown third parties that may listen on-path, especially when transport information isnt otherwise encrypted. Tunnels between selected relays can empower users to control the data and metadata that could reveal privacy-sensitive information. An example is usage patterns and details of services accessed that can reveal if a user is at home or not to anybody passively listing on the network path. The challenge is to ensure that the right data, and only the right data, is shared with the right entity. Ideally, users only share their identity with an entity they already have a trusted relationship with, like the Access Network provider or service provider. A setup like this is more complicated than what we have today and may make some of the network management techniques currently deployed more complex, but there are also opportunities for better collaboration between the network and, say, the application at the endpoint.
Explicit trust relations provide the basis for more targeted information exchanges with intermediates. Today many network functions for example for performance optimization or zero rating passively listen and try to derive useful data from what is revealed. However, the details of what information is available could change anytime due to the ongoing deployment of encryption techniques, general protocol evolution, and new services like Private Relay, or simply by change of application behavior. Requesting explicit information from a relay service instead, or a relay from the endpoint, provides better guarantees that the information is correct and useful and wont suddenly break if traffic changes due to the deployment of encryption, or new end-to-end services. The latter point might even be the more important one.
The network management techniques deployed at present often rely on information that is exposed by most traffic but without any guarantees that the information is accurate. For example, zero rating today often relies on the Service Name Identifier (SNI) in TLS. However, a simple technique like domain fronting can circumvent and thereby cheat the respective network control functions. In the future, the SNI will likely be encrypted and therefore wont be usable anymore for a passive observer.
Similar challenges exist for techniques such as TCP optimizers that provide protocol specific in-network performance enhancements for unencrypted traffic. These techniques are used today as they can be deployed by the network without collaboration or coordination with other entities, and as such provide a relatively straight forward approach to improve performance under challenging network conditions. However, these techniques often rely on cleartext information from the protocol (for example, TCP header) or even unencrypted application layer data. This kind of traffic interception or traffic manipulation has caused protocol ossification in the past and therefore can hinder deployment of new protocol features. As the portion of encrypted traffic further increases (HTTPS and QUIC traffic) these techniques are less applicable. Instead, having an explicit collaboration between one or more endpoints and an in-network relay to exchange information explicitly avoids protocol ossification and ambiguity of the information provided.
A further example is parental control, which relies on DNS filtering today and therefore is also one of the functions that service providers indicated as being affected when Private Relay is used. The example perfectly illustrates the main problem of this technique: it breaks easily if, for example, another DNS server is used, or information simply becomes better protected. Using explicit relays instead of a DNS-based solution to provide this function not only makes this service less fault-prone. It also provides an opportunity for improvements by involving the content provider, or a relay that acts on behalf of the content provider, and therefore can provide much better information as input to the content control decision itself.
Finally, the cases described above show theres also an opportunity in this change. While adding relays seems technically more complex, business relations can become simpler. Whenever collaboration with a network service provider or content provider is needed, this can also be proxied by the relay hosting provider, and therefore a potentially much smaller set of entities to cooperate with. Especially this is a chance for mobile network operators to establish new, well defined business relationships, and hopefully more easily.
The deployment of relay-based services will indeed change the communication pattern and traffic flows on the Internet. Instead of direct communication between two parties that is observable by all on-path elements, intermediates will be involved, and only limited information will be distributed to an explicitly selected set of trusted parties. However, given the importance of the Internet, more user control of privacy is long overdue and explicit collaboration between these parties could be the key for better in-network support of new and emerging services. Now is the right time to focus our work on these new communication patterns and make the best use of the emerging technologies for network collaboration!
Read more about Ericssons network security solutions
Find out more about our network services, fit for todays shifting needs
Learn about the benefits of network security automation
Listen: Why 5G is the most secure platform, with our Chief Product Security Officer
Follow this link:
Are relay services the key to online privacy? - Ericsson
Turn on device encryption
Encryptionhelps protect the data on your device so itcan only be accessed by people whohave authorization. Ifdevice encryption isn't available on your device, you might be able to turn on standard BitLocker encryption instead.
Turn on device encryption
Sign in to Windows with an administrator account (you may have to sign out and back in to switch accounts). For more info, seeCreate a local or administrator account in Windows.
Select Start > Settings > Privacy& security > Device encryption. If Device encryption doesn't appear, it isn't available. You may be able to use standard BitLocker encryption instead.Open Device encryption in Settings.
If Device encryption is turned off, turn it On.
Turn on standard BitLocker encryption
Sign in to your Windows device with an administrator account (you may have to sign out and back in to switch accounts). For more info, seeCreate a local or administrator account in Windows.
In the search box on the taskbar, type Manage BitLocker and then select it from the list of results. Or,select Start > Settings > Privacy& security > Device encryption >BitLocker drive encryption.
Note:You'll only see this option if BitLocker is available for your device. Itisn't available on Windows 11Home edition.
Select Turn on BitLocker and then follow the instructions.
Want to learn more and find out if your device supports device encryption? See Device encryption in Windows.
Encryptionhelps protect the data on your device so itcan only be accessed by people whohave authorization. Ifdevice encryption isn't available on your device, you might be able to turn on standard BitLocker encryption instead. (Note that BitLocker isn't available on Windows 10 Home edition.)
Turn on device encryption
Sign in to Windows with an administrator account (you may have to sign out and back in to switch accounts). For more info, seeCreate a local or administrator account in Windows.
Select theStart button, then selectSettings > Update & Security> Device encryption. If Device encryption doesn't appear, it isn't available. You may be able to use standard BitLocker encryption instead.Open Device encryption in Settings.
If device encryption is turned off, select Turn on.
Turn on standard BitLocker encryption
Sign in to your Windows device with an administrator account (you may have to sign out and back in to switch accounts). For more info, seeCreate a local or administrator account in Windows.
In the search box on the taskbar, type Manage BitLocker and then select it from the list of results. Or,select theStartbutton, and then under Windows System, select Control Panel. In Control Panel, select System and Security, and then under BitLocker Drive Encryption, select Manage BitLocker.
Note:You'll only see this option if BitLocker is available for your device. Itisn't available on Windows 10 Home edition.
Select Turn on BitLocker and then follow the instructions.
Want to learn more and find out if your device supports device encryption? See Device encryption in Windows.
Go here to read the rest:
Turn on device encryption
Encryption: What it is, how it can help, and what to watch out for – SecurityBrief New Zealand
Article by NortonLifeLock APAC senior director, Mark Gorrie.
Were you ever guilty of passing notes at school? If so, you'll remember all-too-well the dread of those notes being intercepted by someone not meant to read them like a bully or worse, your teacher.
Sending data over the internet is much the same. Your digital life, including bank and credit information, personally identifiable information, and even social site login details, is vulnerable when sent on unprotected networks. In fact, a recent cyber safety report showed that 33 per cent of New Zealanders experienced cybercrime in the past 12 months.
That's where VPN encryption may help.
What is encryption?
Encryption is a process that scrambles readable text so it canonly be read by the person who has the secret codeor decryption key. It helpsprovide data security for sensitive information.
Encryption takes plain text, like a text message or email, andscrambles it into an unreadable format called "ciphertext." This helpsprotect the confidentiality of digital data stored on computer systemsor transmittedthrough a network like the internet.Then, when the intended recipient accesses the message, the informationis translated back to its original form - decryption.To unlock the message, both the sender and the recipient mustuse a "secret" encryption key a collection of algorithms that scramble andunscramble data back to a readable format.
How does encryption keep the internet secure?
It's nearlyimpossible to do business of any kind without your personal data ending up inan organisation's networked computer system, which is why it's important to knowhow to help keep that dataprivate.Encryption plays an essential role in this task.
Most legitimate websites use the encryption protection called"secure sockets layer" (SSL), which is a form of encrypting data that is sentto and from a website. This keeps attackers from accessing that data while itis in transit.
Want to make sure a site is using this technology? Look for thepadlock icon in the URL bar and the "s" in the "https://". If you see thesesigns, you'll know that you are conducting secure, encrypted transactionsonline.
Whydoes encryption matter?
A 2022 cyber safety report, conducted online in partnership with The Harris Poll among 1,000 adults in New Zealand, revealed that cybercrime victims in New Zealand surveyed spent an average of 4.8 hours trying to resolve their issues, with an average loss of $135NZD from cybercrime.
Canscammers use encryption to commit cybercrimes?
Encryption is designed to protect your data but canalso be used against you. Targetedransomwareis a cybercrime that can impact organisations of all sizes,including government offices.Ransomware can also target individual computerusers.
How do ransomware attacks occur?
Attackers deploy ransomware toencrypt a victim's various devices, includingcomputers and servers. Theattackers often demand a ransom before they will provide the key to decrypt theencrypted data. The goal is to persuade victims to pay to recoveraccess to their important files,data, video and images.
Ransomware attacks against government agencies can shut downservices, making it hard to get a permit, obtaina marriage license, or pay atax bill, for instance.
Ransomware attacks aimed at large organisations and governmentagencies tend to generate the biggest headlines. But ransomware attacks canalso happen to you.
How can you protect yourself against ransomware?
Here are some tips to protect your devices against ransomware attacks and the risk of having your data encrypted and inaccessible.
What is encryption used for?
It's important to encrypt the messages,files, and data you send whenever they are personal, sensitive, orclassified. For example, you don't want hackers to intercept your doctor's emails about an illness. You don't want criminals toaccess your financial information after logging into your online bank account.And you don't want scammers to snag that confidential report you are reviewingfor your employer. So it's essential to encrypt all this data to keep it secret.
What is the strongest encryption method?
Several encryption methods are consideredeffective. Advanced Encryption Standard, better known as AES, is apopular choice among those who want to protect their data and messages. AES istrusted, effective, used worldwide, and might just be what stands between you and a cybercriminal attack.
Link:
Encryption: What it is, how it can help, and what to watch out for - SecurityBrief New Zealand
Protect and Index Sensitive Data with Polymorphic Encryption – thenewstack.io
Anshu Sharma
Anshu Sharma is the co-founder and CEO of Skyflow, a data privacy vault that allows B2C companies to secure sensitive customer data.
What if you could run real-time queries on data that remains safely encrypted? That might seem nonsensical at first doing anything with encrypted data is usually cumbersome, resource-intensive, and slow. But real-time queries on sensitive data arent just possible, theyre very practical, especially when working with sensitive personal data (PII). The key is polymorphic encryption, and it should be a part of any modern data privacy stack.
In this article, Ill discuss what polymorphic encryption offers to developers and how it balances the need to use data with the need to protect data. To understand polymorphic encryption, we should start with a look at homomorphic encryption, which also aims to address data security and data usability.
Homomorphic encryption is widely considered to be the gold standard of encryption because it supports arbitrary operations on encrypted data without first decrypting it. The idea is that you perform operations (like multiplication and addition) on two encrypted values to get an encrypted result. Then, you can decrypt that result to the same value youd get if you performed that operation on plain-text values.
With the most extensive homomorphic encryption schemes, theres a wider range of operations available that can be performed repeatedly. On the surface, it seems like this lets you both secure sensitive data and use it.
But, there are some issues with homomorphic encryption. And looking at these issues makes it clear why homomorphic encryption isnt more widely used. While its often referred to as a gold standard, it has some practical shortcomings just like the monetary gold standard has practical shortcomings in economics.
With polymorphic encryption, the data is encrypted in multiple forms, with multiple keys, with specific functions for the data associated with each encryption set.
One issue with homomorphic is that it requires too much computing power for most companies to use. The computing resources required for fully homomorphic encryption mean that even with massive computing power, user experiences relying on it are incredibly slow. How slow? Slow enough that most companies would avoid it because of latency issues. Microsoft even notes in their homomorphic encryption library docs that homomorphic encryption isnt efficient. Such performance issues make homomorphic encryption unworkable for most business applications.
So why does homomorphic have these performance challenges? Its because homomorphic encryption is the expression of an ideal to be able to run nearly any operation on encrypted data that is divorced from the actual needs of most developers. The actual need often faced by developers is to run a few well-known operations on sensitive data. How often do you really need to support running a wide range of computations on sensitive data? And, why should your encryption scheme perform poorly to support these unneeded operations?
For example, you might need to determine the location of a customer by running a matching operation on their encrypted phone number, examining the country code or area code. But, I cant think of a good reason to ever perform multiplication or addition on a customers phone number. So, why endure slow performance to support that operation?
The real issue with homomorphic encryption lies in its goal: to run a wide range of operations on encrypted data, while choosing which operations to support after encryption.
Homomorphic encryption borrows its first term from the mathematical idea of homomorphism, which refers to the mapping of one mathematical object to another while preserving the structure of the first object. With homomorphic encryption, only one set of encrypted data is created and only one key can be used to decrypt the data. This is powerful but inflexible and computationally slow.
Polymorphic encryption gets its name from the computer science concept of polymorphism, where a single interface or symbol represents many data types. With polymorphic encryption, the data is encrypted in multiple forms, with multiple keys, with specific functions for the data associated with each encryption set. This is equally powerful, but much more flexible, secure, and computationally much faster.
So, while its similar to homomorphic encryption in some ways, there are a few important differences with polymorphic encryption:
A few examples of how a business might use polymorphic encryption help to illuminate how you can manage what seems like the intractable conflict between the need to secure data and the need to use it:
In both of these scenarios, polymorphic encryption lets you support business workflows without decrypting data. You arent decrypting an entire field from your SSN or credit score table, let alone fetching these values for all customers.
This is great from a data security perspective because the last thing any chief information security officer wants, other than a data breach, is employees decrypting more data than they need and caching it locally because thats the path of least resistance to do their jobs.
Balancing the need for data privacy and data usability requires us to take a new approach to storing and encrypting data and acknowledge that data security that doesnt support critical workflows isnt really robust security.
Polymorphic encryption delivers what homomorphic encryption promises because its scoped to what business workflows actually need from sensitive data. It provides a better-performing solution because it doesnt support unnecessary operations on your most sensitive encrypted data. Instead, it supports and secures operations needed for key business workflows, like comparison and exact match on partial records.
Note: This article discusses polymorphic data encryption. Polymorphic data encryption is distinct from polymorphic key encryption, in which encryption keys rotate, but data is unusable unless you fully decrypt it.
Feature image via Pixabay.
Read more:
Protect and Index Sensitive Data with Polymorphic Encryption - thenewstack.io
Sheriff says no encryption unless forced by the state profile of incumbent Carlos Bolanos Palo Alto Daily Post – The Daily Post
BY EMILY MIBACHDaily Post Staff Writer
San Mateo County Sheriff Carlos Bolanos said he will not encrypt his departments police radios unless he is required to by law.
Bolanos made the comment during an interview with the Post on April 4, just hours before Palo Alto City Council voted to continue with encryption of police radios even though the state isnt requiring the secrecy.
Bolanos said it would cost his office about $1 million to encrypt, which is a lot to pay for something that seems to be working just fine. In October 2020, the state Department of Justice sent out a bulletin to all police agencies saying they need to encrypt their radios or find a suitable workaround to keep from broadcasting peoples personal information over the airwaves.
Unless the Legislature says we have to and gives me the money to do so, why would I?
Bolanos said, adding that the county has two encrypted channels one for undercover officers and the bomb squad.
Bolanos, 63, is seeking re-election to the post as the countys top cop. He was appointed by the Board of Supervisors in July 2016 upon the early retirement of then-Sheriff Greg Munks and was elected in 2018. He is running against Captian Christina Corpus, who is in charge of policing in Millbrae.
Millbrae, along with San Carlos, Half Moon Bay, Woodside, Portola Valley and the unincorporated parts of the county is policed by the sheriffs office.
Some have called for a civilian oversight committee to review the Sheriffs Office. Bolanos said he is open to the idea but is unsure what the need is, adding that his office is as transparent as it can be and has a good relationship with the Board of Supervisors. He also expressed concerns about the committee trying to overstep its charge, saying that it would not be able to discipline his employees. But said hes open to discussing the creation of such a committee after the election.
Bolanos is more open to the idea of an independent police auditor, such as Michael Gennanco, Palo Altos police auditor, reviewing his department. He said when done correctly, police auditors can provide helpful information for departments to improve.
Shortly before the pandemic, Bolanos started something called the Sheriffs Advisory Board, where people are asked for donations to join. He said the group is for people who support the sheriffs office to donate money and show their support (Individuals are $400 and corporate membership is $2,000). He called it much more of a social club rather than a place for people to advise or influence policies.
Response to psychiatric incidents
Bolanos has been working to improve the response to mental health crises that his officers respond to. One way is by having all of his deputies go through Crisis Intervention Training where they work to deescalate situations. Some deputies have also gone through Enhanced Crisis Intervention Training where they are taught to develop a plan and may even sometimes walk away from a situation where getting involved would cause violence, Bolanos explained. Bolanos said that if a person is barricaded in a home and isnt hurting anyone, why kick down the door and potentially escalate the situation?
He also has a team of two clinicians working with two detectives who respond to various mental health calls. Hes also been working on mental health treatment programs in the jail.
Additionally, Half Moon Bay now has the CARES program, where clinicians respond to nonviolent calls where a person is having a mental health crisis. Bolanos said he worries about the safety of the clinicians, but recognizes that it is something the community wanted.
Friend charged
In 2020, the Attorney General filed charges against Barbara Bonilla, a friend of Bolanos and the then director of the San Mateo County youth activities league. Bonilla was accused of stealing some $25,000 from the activities league. When asked about his offices involvement in the case, he said that once someone came forward with their concerns, they sent it to the District Attorneys office to investigate. But because DA Steve Wagstaffe is on the board of the activities league, his office sent it to the Attorney General. When the AGs office began investigating, Bolanos assigned a sergeant to help facilitate the AGs investigation.
Charges were brought in 2020 and the case was resolved in September with Bonilla pleading no contest to one count of felony grand theft. She was sentenced to two years of probation, 170 hours of community service, and must pay restitution to the league of $13,706.
Bolanos acknowledged that Bonilla made some mistakes and paid for them.
The way it was resolved was similar to how these sorts of cases resolve, not with prison time, Bolanos said.
View original post here:
Sheriff says no encryption unless forced by the state profile of incumbent Carlos Bolanos Palo Alto Daily Post - The Daily Post
The Role of Cryptography in the Supply Chain and Procurement – EPS News
by
Cryptography is the technology that powers online encryption, digital authentication, credit card processing, and online banking. Even if youre not familiar with the technology, you likely rely on cryptography on a daily basis.
Now, with the rise of cryptocurrencies and blockchain technology, cryptography may become even more important in the supply chain.
In procurement and logistics, cryptography and blockchain technology could help to improve transparency and build trust between third parties.
New challenges in logistics and procurement
Transparency and trust are more important than ever for supply chain professionals. Customers want more information about the goods they buy, including where they come from and how they were transported. As the supply chain becomes more complex, establishing trust between parties responsible for different aspects of logistics can become more challenging.
At the same time, supply chain operations of all kinds face a range of emerging cybersecurity threats. Cyberattacks are on the rise and hackers seem to be targeting companies that manage logistics and procurement more and more often.
A successful attack can have serious consequences. Already, major businesses, like Expeditors, have fallen victim to cyberattacks that took key company systems offline slowing global operations and likely costing millions of dollars.
These challenges are likely to become more severe in the future as consumer expectations rise and cybercrime becomes more common. Cryptography and related technologies like blockchain could help logistics and procurement experts manage these developing challenges.
Cryptography and blockchain
For most businesses, cryptography will be most important in improving network security. A variety of critical business security tools rely on cryptography to function. One example is email encryption, which uses cryptography to protect the contents of important emails. Only authorized users, who have the right decryption key, are able to unencrypt the email and access its contents.
In practice, the technology can help companies protect the information contained in confidential emails or similar communications. Encryption also plays an important role in authenticating log-ins, protecting remote or cloud storage, and peer-to-peer secured messaging. Businesses that want to keep important resources and communications safe from unauthorized third parties can use platforms that offer encryption to protect this information.
In the near future, cryptography may also support physical devices that could help businesses track the authenticity of goods. Cryptographic ID tags small enough to fit on almost any product could be used to verify the identity and authenticity of products. The ID tags could help prevent the counterfeiting of goods and ensure customers that they have received a legitimate product.
Using blockchain to manage transparency
Blockchain the digital record-keeping technology best known for powering cryptocurrencies like Bitcoin is another technology that relies on cryptography and may provide significant benefits for the supply chain.
Experts believe the blockchain may help businesses accelerate deliveries, enhance traceability, improve coordination between supply chain partners, and streamline access to financing.
Blockchain is effectively a distributed ledger a digital system for recording transactions in a way that makes altering existing records extremely difficult. As a result, the system is more tamperproof than the average ledger tool, which should help stakeholders remain confident that blockchain transaction records are accurate.
For example, stakeholders could use a blockchain ledger to centralize information about their shipping operations and provide a single source of truth on partnered logistics.
The technology could be used alone or in combination with other tools for managing transparency and traceability in the supply chain like audits or the use of RFID and GPS tracking solutions that can monitor goods as they move through the supply chain.
A number of major businesses, including MasterCard, IBM, Hayward, and Emerson, are currently working with blockchain technology in the supply chain.
Preparing for the future
Most businesses already use cryptography on a daily basis for purposes like encryption and identity authentication. In the near future, cryptography could play a bigger role in supply chain management.
Tools like cryptographic tags and the blockchain could improve transparency and traceability in the supply chain. With these tools, businesses could manage some of the most significant challenges the supply chain faces right now.
Shannon Flynn is a technology writer and the Managing Editor at ReHack.com. Shannon's written for sites like TechDayHQ, Re-Work, and Innovation & Tech Today. Follow ReHack on Twitter to read more of her work.
Originally posted here:
The Role of Cryptography in the Supply Chain and Procurement - EPS News
Could technology companies have warned authorities about Texas gunmans ominous messages? – OregonLive
Could technology companies have monitored ominous messages made by a gunman who Texas authorities say massacred 19 children and two teachers at an elementary school? Could they have warned the authorities?
Answers to these questions remain unclear, in part because official descriptions of the shooting and the gunmans social media activity have continued to evolve. For instance, on Thursday Texas officials made significant revisions to their timeline of events for the shooting.
But if nothing else, the shooting in Uvalde, Texas, seems highly likely to focus additional attention on how social platforms monitor what users are saying to and showing each other.
A day after the Tuesday shooting, Texas Gov. Greg Abbott said this: There was no meaningful forewarning of this crime other than what Im about to tell you: As of this time the only information that was known in advance was posted by the gunman on Facebook approximately 30 minutes before reaching the school.
Facebook posts are typically distributed to a wide audience. Shortly thereafter, Facebook stepped in to note that the gunman sent one-to-one direct messages, not public posts, and that they werent discovered until after the terrible tragedy.
How was social media used?
By Thursday, new questions arose as to which and how many tech platforms the gunman used in the days before the shooting. The governors office referred questions about the gunmans online messages to the Texas Department of Public Safety, which didnt respond to emailed requests for comment.
Some reports appear to show that at least some of the gunmans communications used Apples encrypted iPhone messaging services, which makes messages almost impossible for anyone else to read when sent to another iPhone user. Facebook parent company Meta, which also owns Instagram, says it is working with law enforcement but declined to provide details. Apple didnt respond to requests for comment.
The latest mass shootings in the U.S. by active social-media users may bring more pressure on technology companies to heighten their scrutiny of online communications, even though conservative politicians Abbott among them are also pushing social platforms to relax their restrictions on some speech.
Crime scene tape surrounds Robb Elementary School in Uvalde, Texas, Wednesday, May 25, 2022. Desperation turned to heart-wrenching sorrow for families of grade schoolers killed after an 18-year-old gunman barricaded himself in their Texas classroom and began shooting, killing at least 19 fourth-graders and their two teachers.AP
Could tech companies caught the messages
It would depend on which services Salvador Ramos used. A series of posts appeared on his Instagram in the days leading up to the shooting, including photos of a gun magazine in hand and two AR-style semi-automatic rifles. An Instagram user who was tagged in one post shared parts of what appears to be a chilling exchange on Instagram with Ramos, asking her to share his gun pictures with her more than 10,000 followers.
Meta has said it monitors peoples private messages for some kinds of harmful content, such as links to malware or images of child sexual exploitation. But copied images can be detected using unique identifiers a kind of digital signature which makes them relatively easy for computer systems to flag. Trying to interpret a string of threatening words which can resemble a joke, satire or song lyrics is a far more difficult task for artificial intelligence systems.
Facebook could, for instance, flag certain phrases such as going to kill or going to shoot, but without context something AI in general has a lot of trouble with there would be too many false positives for the company to analyze. So Facebook and other platforms rely on user reports to catch threats, harassment and other violations of the law or their own policies.
Platforms lock up their messages
Even this kind of monitoring could soon be obsolete, since Meta plans to roll out end-to-end-encryption on its Facebook and Instagram messaging systems next year. Such encryption means that no one other than the sender and the recipient not even Meta can decipher peoples messages. WhatsApp, also owned by Meta, already uses such encryption.
A recent Meta-commissioned report emphasized the benefits of such privacy but also noted some risks -- including users who could abuse the encryption to sexually exploit children, facilitate human trafficking and spread hate speech.
Apple has long had end-to-end encryption on its messaging system. That has brought the iPhone maker into conflict with the Justice Department over messaging privacy. After the deadly shooting of three U.S. sailors at a Navy installation in December 2019, the Justice Department insisted that investigators needed access to data from two locked and encrypted iPhones that belonged to the alleged gunman, a Saudi aviation student.
Security experts say this could be done if Apple were to engineer a backdoor to allow access to messages sent by alleged criminals. Such a secret key would let them decipher encrypted information with a court order.
But the same experts warned that such backdoors into encryption systems make them inherently insecure. Just knowing that a backdoor exists is enough to focus the worlds spies and criminals on discovering the mathematical keys that could unlock it. And when they do, everyones information is essentially vulnerable to anyone with the secret key.
Business VPN: What Is It and Which One Should You Consider? – TechGenix
VPNs help you stay in business!
As working remotely continues to set a new working practice, business VPNs are even more in demand. In brief, a virtual private network (VPN) helps establish security through traffic encryption in a private network. Essentially, you can use this to allow remote users to connect to a businesss local network. They can even join two private networks between business sites. The end-user can then access corporate services and software as if they were onsite. Business VPNs are also useful for encrypting site-to-site traffic. These are the two powerful functions of a business VPN.
Many companies fear the uncontrolled nature of remotely connecting to an organizations network. Often, businesses demand users to use a VPN solution that works with an integrated policy control system. That way, admins can regulate access. Some companies even set up SMS or email push notifications for their business VPN to notify the administrator of a connection request.
In this article, Ill go through what a business VPN is, and what makes it different from other VPNs. Ill also talk about some of the best ones on the market as of this writing. Lets get started with what a business VPN is.
A business VPN works in the exact same way as a personal VPN. To clarify, it has two different connection methods. The first method will only encrypt your end-user data up to the VPN server. In most cases of Wi-Fi MITM attacks, this is good enough to stop the hacker. This is because MITM attacks have to occur near the Wi-Fi router, as it needs to intercept the Wi-Fi connection between the router and the user. The issue with this method is that some people fear the VPN service provider has access to unencrypted traffic at the VPN server.
To add to those fears, if the VPN server is ever compromised by cybercriminals, theyll have access to your data. For this reason, many prefer VPNs with end-point protection. This is the connection method, and in essence, it revolves around encrypting data between the end-user and the final recipient. This connection is a VPN tunnel, where your data packets arent visible until it reaches the recipient.
Now, lets have a look at some key features that you can find in VPNs. After that, well see how different a business VPN is when compared to a consumer VPN through these features.
VPNs include many features that you should consider before choosing one:
Now that you know some of the key features found in VPNs, how can you use these to compare and contrast business and consumer VPNs? Read on to find out!
In recent years, the difference between home and business VPN offerings has become smaller due to a highly competitive marketplace. To this end, you can expect to have many VPN providers that meet your needs. Heres a handy comparison table of features you can expect consumer VPNs to have compared to business VPNs, and vice versa.
Now that you know what features to look out for, lets have a look at the 5 best business VPNs out there!
Price: $7 per user per month on a one year contract
Features:
NordVPN is a robust solution for many businesses and home users. One of its advantages is the two-factor authentication feature that many administrators look for. It lets them ensure remote connections are really coming from the user stated in server transaction logs. NordVPN also has a good pricing model and site-to-site functionality.
That said, it doesnt offer a centralized administrative solution. It could be useful for SMBs where the lower number of users is easier to monitor. This puts into question the point of having site-to-site functionality when this is only useful in larger businesses where administrative VPN tools could be desirable.
In addition, the installation doesnt have automatic firewall optimization. This means you could be tinkering with firewalls and leaving holes by mistake if not fully integrated.
Price: $7 per user per month on a one year contract
Features:
One advantage of this business VPN offering is that you can use it to connect to many server locations worldwide. In turn, this reduces your likelihood of having VPN connections drop from an overused VPN server.
ExpressVPN has many useful features including a no-log policy to help hide who youre doing business with. It also supports routers and connected devices. That means all networked traffic gets encrypted. This is important for companies that use IoT devices that are normally produced to meet price points, not security. Hackers can easily gain access to an IoT device using an unencrypted Wi-Fi connection, as firmware and installation passwords are normally standardized.
Unfortunately, ExpressVPN isnt ideal for companies larger than an SMB. That said, this is a tempting VPN offering at a great price point for any small business.
Price: $3.24 (70% discount) or $10 (without discount) per user per month on a one year contract
Features:
PureVPN has a whole host of features not present in NordVPN or ExpressVPN. Its a better option in general as a business VPN. For instance, port forwarding can be useful to allow remote workers to leverage server solutions or access file archives. If you work with large media files, CAD software, or anything else that needs more power than a desktop, then this can be a cost-effective solution.
DDoS protection is also useful if you have public-facing servers that host websites. Often, you wont see this as part of a business VPN offering; the same goes for peer-to-peer (P2P) file sharing.
It seems that PureVPN is trying to give you one integrated enterprise solution. Where PureVPN falls short, though, is site-to-site connectivity and a centralized control system. This may be a problem for anything other than SMBs that reside on a single site. If youre in a mid-sized business, this may hinder your growth. Then, youll eventually have to look for a more complete multi-site business VPN solution that offers centralized VPN administrative tools.
Another downside to PureVPN is that it doesnt have a two-factor authentication feature, which youll need as your users grow with the business.
Price: $10 per user per month
Features:
Twingate is one of the best VPNs on this list for integration purposes. It also has administrative tools that youd expect from a business VPN. The price for this solution is sensible for what it offers.
Yet, it lacks user authentication. If Twingate adds more enterprise features similar to PureVPN, then itll be an administrators dream to implement.
Price: $26.83 per user per year
Features:
KerioControl is the last on our list, but its one of the best business VPNs around. Somehow, it has managed to get the centralized administration tool right, along with automating installation and firewall capabilities.
Youre bound to like this business VPN as the risk of leaving holes in your firewall during the implementation process gets reduced. As a result, you wont have to spend all day tinkering with various settings.
KerioControl promises high availability and traffic optimization, meaning your business will likely not suffer extensive service downtime. This allows you to perform efficiently without tinkering with settings. Any drawback would be the price point for the solution, but its more than justified for what you get for your money. All in all, its a hassle-free enterprise-class VPN.
And thats the list! Those were the 5 best business VPNs available as of me writing this article. Lets have a quick recap.
To conclude, youre now knowledgeable on the 5 best business VPNs out there. Out of these, KerioControl and Twingate appear to be more intuitive to integrate into a business environment. This is mostly either due to them having an integrated firewall, or the ability to modify existing firewalls to ensure the VPN works well together.
In addition, these two, especially KerioControl, provide enterprise administrative tools that allow you to do things like changing device postures.
That said, if youre just starting out, any of the first three VPNs discussed will do just fine. Feel free to refer back to this article in the future should you need to!
Do you have any more questions about business VPNs? Check out the FAQ and Resources sections below!
A business virtual private network (VPN) works exactly the same way as a consumer VPN. However, it has additional enterprise tools, better support, and higher uptime. You can use a business VPN to connect different sites together or connect end-users working remotely. Business VPNs encrypt traffic, making it difficult for packet interception to occur between the user and destination through man-in-the-middle (MITM) attacks. This protects your businesss intellectual property, improves cybersecurity, and allows users to work as if they were onsite.
Split tunneling allows VPN users to decide what data gets encrypted and what doesnt. This can be useful for large data transfers that arent sensitive to the operations of a business. An example would be moving a promotional video between locations that would otherwise be publicly available.
Not really, unless youre up to something nefarious or worried about the service provider. VPN servers, unless stated otherwise, log connections for auditing or regulatory compliance. Governments also have the legal power and tools to monitor VPN connections, either with or without logs. If youre worried about the VPN service provider keeping logs of your traffic, use a VPN service provider that doesnt log access. Many providers offer this feature including ExpressVPN and PureVPN.
You can use two-factor authentication (2FA) with some VPN service providers. That ensures the user is establishing the VPN connection, and not a cyber attacker. When a user starts their VPN, a prompt to enter a pin from the authentication method used will appear. You can use many different authentication methods including email, SMS, and security keys. Of these, security keys are the most secure. However, if lost or if it stops working, your user might need a new one issued.
Its a great idea to use two-factor authentication (2FA). Many businesses use two-factor authentication to help secure their network. Ideally, use a security key as these are the most secure; SMS and email are easier to hack.
Learn about Azures virtual network gateway.
Find out why VPNs are still needed in the modern world.
Discover WARP and DNS obfuscation compared to VPN security measures.
Get information about the latest trend of using double VPNs.
Understand the differences between Tor and VPN for security.
Excerpt from:
Business VPN: What Is It and Which One Should You Consider? - TechGenix
Asymmetric Encryption: What It Is & Why Your Security Depends on It – Hashed Out by The SSL Store
From securing websites to signing software, youll find asymmetric cryptography (including encryption) in use virtually everywhere online. Heres what you need to know about the cryptographic process that helps keep your data secure online
Asymmetric encryption is the backbone of internet security. Without it, stealing your critically sensitive data is as easy as taking candy from a baby for most cybercriminals. Weve seen plenty of the painful reminders over the last few years in data breaches that resulted from expired SSL/TLS certificates. (Hence why we always talk about the importance of certificate management to avoid these issues.)
But what is asymmetric encryption? Well start with a quick public key encryption definition before moving on to explore this more technical topic at length. Dont worry, well try to keep this briefer than our usual tome-style explanatory posts.
Lets hash it out.
To put it simply, asymmetric encryption encrypts and decrypts the data shared between two parties in public, insecure channels (like the internet). This process involves using two separate but related keys. In a nutshell, its all about securing your sensitive information to keep it out of the hands of unauthorized users or entities (e.g., cybercriminals) when you need to upload it to a website, send it via email, etc.
Asymmetric encryption is also part of whats known as asymmetric key cryptography and public key cryptography because the two keys used are mathematically related but unique (hence, asymmetric):
Heres a basic look at how this process occurs using the two keys:
Frankly, asymmetric encryption is a term that sounds more complex and intimidating than it actually is. Once you understand the basics, the whole thing will make a lot more sense. But if all of this is a bit hard to grasp, lets imagine that you have a special safe that uses two locks one key locks the safe and the other opens it. Likewise with asymmetric encryption, anyone who has access to the public key can use it to encrypt data, but only the person who has access to the private key can decrypt that information.
Asymmetric encryption is at the heart of a framework known as public key infrastructure. We arent going to get into the specifics of how PKI works because, frankly, describing it in every article is a bit of a time suck and gets monotonous. So, well just give you a quick summary before moving on: PKI is the foundation of technologies, policies, and processes that enables us to send sensitive data securely across the internet. It relies on a combination of public- and private-key algorithms, digital certificates, and policies.
The purpose of encryption is to ensure that any sensitive data you want to share with a specific person is kept secret to everyone except your intended recipient. This is necessary because we live in a time when we share and transmit data via multiple ISPs and routers, and many miles of cables beneath the oceans.
Historically, you used to have to meet up with someone face to face to exchange messages or secret keys to unlock future communications. (This is known as key distribution.) This process typically required taking a horse, boat or train to meet up with the other party to give them a copy of your secret key. But with the internet, these time-consuming rendezvous needed to exchange communications have been replaced with near-instant digital communications via the internet.
This is all fine and dandy except for one (not so teensy) little issue: the internet is incredibly insecure. Without a way for users to securely exchange keys to encrypt their data, then anyone could intercept the communications in transit. Asymmetric encryption solves this key distribution issue by creating a way to securely exchange keys (or key-related data) without ever having to meet the other party in person.
Encryption works by applying a complex mathematical formula to your original plain text (readable) data to convert it into a long, indecipherable data string. So, if you took the message I cant wait for season 4 of Stranger Things! and encrypted it using a 2048-bit RSA public key (more on RSA later), youd wind up with a gibberish message that looks like this:
Clearly, this isnt something that any human being can make heads or tails of in terms of deciphering the message thats a good thing when it comes to keeping your sensitive information secret. The good news is that computers allow us to use encryption keys this size and larger to encrypt data in a secure way so that unauthorized users cant access it.
What makes this even better news is that even if a bad guy tried using a modern supercomputer to try to crack the key, theyd still be out of luck. This is because the sheer computational processing resources and time required would span far longer than their entire lifetime and the lifetimes of many generations of family members that follow i.e., were talking millions of years here.
Well talk you through the process of how asymmetric key encryption works later in the article. But for now, we want to point out that asymmetric key encryption isnt the only tool we have up our sleeves when it comes to PKI
Technically, asymmetric encryption could be used on its own as a way to send and receive data. But why would you want to do that? Its just too bulky and resource-intensive to be used for that purpose at scale. (Not good for large businesses that handle a lot of connections to their websites and services.) This is why, in many cases, asymmetric encryption is used initially as a way to securely exchange sensitive data between two parties before they switch to using symmetric encryption for the rest of the exchange.
Symmetric encryption, or whats sometimes called symmetric key encryption, uses just one key for both for data encryption and decryption. This means that theres only a single key that must be kept secure hence, why this method of encryption is known as private key encryption or secret key encryption.
Symmetric encryption is faster and also is thought to be more secure than asymmetric encryption when the parties are using smaller key sizes. (When using large key sizes, asymmetric encryption wipes the floor with symmetric encryption but does so at the cost of speed.) But each cryptographic approach has its uses and applications. Check out our other article to learn more about the difference between asymmetric vs symmetric encryption.
So now that we know what asymmetric key encryption is and have a basic idea of what it does, lets explore a few examples of how you can use it to improve your organizations data security:
Algorithms are, basically, the instructions that computers use to solve a problem. Asymmetric key encryption algorithms come in different flavors or varieties for you to choose from. But you cant take a one-size-fits-all approach when it comes to selecting the right asymmetric encryption algorithms to meet your needs.
Of course, there are clear differences between many of these asymmetric key algorithms how they operate, what their specific key lengths and security strengths are, etc. You have to choose the right one based on your needs or use cases. Lets quickly explore two of the most common public key encryption algorithms:
Of course, RSA isnt the only asymmetric key exchange algorithm. Here are a few other notable algorithms worth mentioning for secure remote key distribution as well:
To learn more about each of the different types of asymmetric algorithms, be sure to check back with us over the next few months. Well publish an article that will focus on that exact topic (much like what we did with symmetric encryption algorithms).
Asymmetric encryption between two parties works by using a public key to encrypt data and a private key to decrypt it. The process looks something like this:
If you were to break down what this process looks like, lets consider the Stranger Things example from earlier. Lets say I want to send you the following message: I cant wait for season 4 of Stranger Things! (Not sure why this message would be sensitive enough to require encryption, but lets just run with it.) In this case, Ill use your public key (which looks something like this when using a 2048-bit RSA key) to decrypt the data:
When you apply it to the message, youll wind up with the data string we showed you earlier:
Obviously, you wont know what Im saying with the message still encrypted. Youll then use your private key, which is considerably longer to decrypt the data string:
This will then decrypt the data and allow you to read the original plain text message.
Dont worry, well cover all of this more in depth in a future article. Stay tuned for that!
Alright, weve droned on enough about asymmetric cryptography and its corresponding encryption and key exchange algorithms. Hopefully, youll leave this article with greater knowledge of asymmetric cryptosystems than you started with.
Asymmetric encryption and key exchange algorithms are the cornerstones of modern public key infrastructure. Without them, there would be no way to remotely exchange sensitive or otherwise secret information via public channels like the internet. Wed still be using clandestine face-to-face meetings like stereotypical spies from Hollywood films.
Understanding what asymmetric encryption is and how it all works is the first step to helping strengthen your organizations cyber defenses. When you realize the importance of managing your certificates and protecting your cryptographic keys, itll help you avoid many of the pitfalls that help companies make unflattering headlines due to data breaches and other security incidents.
See the rest here:
Asymmetric Encryption: What It Is & Why Your Security Depends on It - Hashed Out by The SSL Store