Category Archives: Encryption
Bureau of Industry and Security
Mass Market (Section 740.17)
Hardware and software items that would otherwise be classified as 5A002 or 5D002 can be classified under 5A992.c and 5D992.c if they meet the criteria listed in Note 3 to Category 5, Part 2 ("the mass market criteria"). In other words, some 5x002 items can become 5x992.c based on the way they are sold. Mass market items are described in 740.17(b)(1) and (b)(3) but not (b)(3)(iii) e.g., digital forensics) of License Exception ENC and have classification and reporting requirements.
Although a 5A992.c and 5D992.c item does not require a license exception to go to most places (because it is only Anti-Terrorism controlled) they are described in License Exception ENC 740.17, which includes the submission requirements that need to be made to BIS. Whether an item is 5x002 or 5x992.c - mass market (per Note 3 to Cat. 5 Part 2), the submission requirements are the same and therefore described in a single place under 740.17(b)(1) (self-classifiable) and (b)(3) (requires classification request to BIS).
The mass market criteria under Note 3 to Cat. 5, Part 2 has two paragraphs:
Paragraph A describes products that are generally available to the public at retail. Mass market products are typically consumer products sold at retail stores or internet locations, but products sold only to businesses can also qualify for mass market. BIS takes into account a range of factors when determining whether something qualifies for mass market including quantity of the item sold, price, technical skill required to use the product, existing sales channels, typical customer, and any exclusionary practices of the supplier.
Paragraph B applies to components of mass market products. In order to qualify for this paragraph:1. It must be a hardware or software component of an existing mass market product, meaning it is:- The same component that is factory installed in the mass market product; or- A functionally equivalent aftermarket replacement that has the same form fit and function.
2. Information Security must not be the primary function of the component;
3. It must not change the cryptographic functionality of an existing mass market item, or add new encryption functionality to the item; and
4. The feature set of the component must be fixed and not designed or modified to customer specifications.
ITEMS NOT Eligible for Mass Market 5x992.c: Items that meet the criteria in 740.17(b)(2) (e.g., network infrastructure) and 740.17(b)(3)(iii) (e.g., digital forensics) are NOT eligible for mass market treatment.
When a mass market 5x992.c item requires a Classification Request to BIS:Mass market items described under 740.17 (b)(3)(e.g., chips, components, SDK) (except for (b)(3)(iii)(e.g., digital forensics), which are not eligible for mass market) require a classification by BIS via SNAP-R before they can be classified as 5x992.c.
When a mass market 5x992.c item can be Self-Classified:Mass market items that are described under in 740.17(b)(1) can be self-classified with an annual self-classification report. If you choose to submit a classification request for a 740.17(b)(1) item, then a self-classification report for that item is not required.
When nothing is required to export a mass market item 5x992.c:The export of Mass market items that are described in the scenarios under in 740.17(a) do not require any submission to BIS.
Read the original:
Bureau of Industry and Security
Why End-to-End Encryption May Not Be Enough – Newswire
Press Release - May 18, 2022 18:15 EDT
NEW YORK, May 18, 2022 (Newswire.com) - iQuanti: In the 21st century, data security is a key part of our daily lives. However, the sheer amount of information we regularly share across the internet leaves us vulnerable to cyberattackers and other unscrupulous actors or threats to businesses and individuals. This realization has led to a broad range of approaches to data security. Since email and other types of messaging are among the most vulnerable elements within our digital lives, there is plenty of focus on these mediums.
The bottom line is that we regularly share our most sensitive data, including identity and payment details, through these mediums, and protecting that data is paramount. Thankfully, technologies such as end-to-end encryption are helping us achieve extremely high levels of security when sending and receiving messages, protecting our data, quite literally, from end to end.
Unfortunately, however, end-to-end security protocols can never keep us 100% safe, and risks remain in several areas despite the level of protection offered by these technologies. This article explores why even end-to-end encryption may not be enough in our fight against data leaks and other security breaches.
What is End-to-End Email Encryption?
At its most basic level, end-to-end encryption works by securing data at both the source and the destination. Using public and private keys, it encrypts the data before it is sent out (sender) and then unencrypts the data at the other end (receiver). It is generally regarded as the most secure type ofencrypted email, providing robust data protection when it is in transit.
It is worth noting that this type of data protection is used for much more than encrypting emails. In fact, many instant messenger services, video communications apps, and social media platforms also use variations of end-to-end encryption to safeguard data across a broad range of communications channels.
The Limits of End-to-End Encryption
While end-to-end encryption is excellent for safeguarding data during transit, unfortunately, that's where its protection ends. In other words, while your data may be safe from man-in-the-middle attacks and other similar threats, if your computer, tablet, or cell phone is already compromised, it's possible that your data can be accessed upon receipt.
This means that anyone with backdoor access to your device can easily read and take any information received. Often, this is down to vulnerabilities within operating systems that are either unknown or unaddressed, essentially allowing a variety of malware to access your systems without your consent or knowledge.
In addition to this, end-to-end encryption is often beyond many people's skillset when it comes to email. The process of encrypting and decrypting information can be complicated and convoluted, leaving many people believing they are protected when in fact, they are not.
Taken together, it is clear that end-to-end encryption may not be enough to keep both businesses and individuals fully protected. Therefore, it remains imperative that we explore novel ways of data protection and continue to stay vigilant in the face of ever-evolving online threats.
Source: iQuanti, Inc.
Read the original:
Why End-to-End Encryption May Not Be Enough - Newswire
Types of Encryption Algorithms – Security Boulevard
How Do Encryption Algorithms Work?
Encryption algorithms are mathematical formulas that transform plaintext into ciphertext. Plaintext is what the message looks like unaltered, but ciphertext scrambles the message to a point where its unreadableunless you have the right authorization to decrypt the code back into plaintext. Put simply, algorithms make encrypting and decrypting code possible, specifically between the correct users. These algorithms are written into software for computer systems and networks.
Before dissecting the different types of algorithms, lets review the difference between symmetric and asymmetric encryption.
When a message or file is encrypted, it can only be unscrambled and read if the receiver of the message has the correct password or code. Codes used to encrypt or decrypt are often referred to as keys, and without the proper cryptographic key, a recipient has no way of accessing an encrypted file.
With symmetric encryption, there is only one key that is used by both the owner and the recipient. Symmetric encryption uses either stream ciphers (encrypting bits of data one at a time) or block ciphers (encrypting a certain number of bits and grouping them into a single unit).
Think of it as sending someone a package thats locked. No one can open the package without the key, including hackers, but you also have to find a secure way to send or share the key. In the case of computers, both computers would need to have the key to open certain files.
One advantage of this type of encryption is how efficiently large amounts of data can be sent. Only having one key doesnt require as much mathematical computing. Symmetric encryption is also extremely secure if you have a trusted algorithm.
The issue with symmetric encryption is sharing the key with others without compromising security. If, for example, the owner of an encrypted file sends the key over email, a hacker can hack into their email and use the key to access shared information, defeating the purpose of encrypting something to begin with. The key is often shared in person to mitigate such risk, but this isnt always a realistic option for the extent of the internet. This issue calls for a key hierarchy or a way to manage the keys being used in huge bouts of data.
Asymmetric encryption, also known as public-key encryption, involves two keys. The key that encrypts a message or file is public, meaning it can be exchanged with anyone. However, the second key is private and is the only key that can decrypt the message or file.
Think of asymmetric encryption like a deposit box. Anyone can leave a letter, but only the owner of the private key can open the box to access the private information. This is most commonly used to exchange information and data on the internet.
The most obvious advantage of public-key encryption is its security and convenience. Instead of having a secret code that only two specific sources know, data can be safely exchanged with more people online. Asymmetric encryption also uses Public Key Infrastructure (PKI), which protects communications between the server and the client using digital certificates, which make it easier to verify that the recipient is coming from the correct sender.
The downside to asymmetric encryption is that the keys only go one direction, meaning a correspondence would require both parties to have their own set keys, one public and one private. In other words, every recipient needing to decrypt a message needs their own deposit box with a private key. Unlike symmetric encryption, the asymmetric encryption method is also more mathematically complex, which can slow down processing time.
With data being exchanged constantly online, both symmetric and asymmetric encryption is used today to verify, authenticate, and protect users. Depending on the level of security necessary, who needs access to data, the type of requests being made, etc., different encryption algorithms are better for certain scenarios. Some are more advanced than others, but the following systems are the most common and secure types of encryption.
One of the first main algorithms used was the Data Encryption Standard (DES), a type of symmetric encryption. It was the standard for electronic communications, but, though DES provided a solid foundation for encryption, it could be hacked in a matter of hours and couldnt keep up with modern computing.
Triple-DES was much more secure because it overcame the small keyspace of DES, and it eventually became the standard symmetric encryption algorithm for a time, specifically in the 1990s. It weaved its way into cryptographic protocols, too, such as SSH and TLS. Triple-DES (or 3DES) uses the cipher of DES three times over to encrypt data, which allows for multiple key lengths despite only using 56-bit keys.
Features
Triple-DES is one of the most efficient algorithms to implement. In its prime, 3DES changed security and helped resolve some of the biggest security leaks of DES. It still works for some hardware security encryptions.
In the face of more secure encryption algorithms, Triple-DES is becoming more and more obsolete. Though it can compute more than DES, 3DES can only work with 64-bit blocks, which doesnt keep up with most modern organizations. Most big companies and organizations use different symmetric encryption methods.
During the peak of Triple-DES use, big names like Microsoft and Firefox used Triple-DES for data security. Financial, payment, and other private services still use Triple-DES, though its unlikely they will continue using it.
The Advanced Encryption Standard (AES) is a type of symmetric encryption that is considered both the most unbreakable algorithm and the global standard of security. AES dethroned Triple-DES due to its higher computing capabilities and advanced security.
Features
There are no guarantees in the cyberworld, but to date, AES has yet to be cracked as far as anyone knows. With the ability to use a 256-bit key length, its one of the most secure forms of encryption. In fact, it would take billions of years to crack even a 128-bit encryption.
Even though its more powerful than both DES and Triple-DES, it is a bit harder to implement. Its also slower due to the key size, which can sometimes hinder communication.
The U.S. government uses this algorithm to keep all sorts of information private and secure. From government computers to cybersecurity, AES is an essential tool for keeping data classified. AES is truthfully used everywhere: solid-state drives (SSDs), WiFi in local area networks, cloud storage, internet browsers, and more.
Rivest-Shamir-Adleman (RSA) is a public-key encryption algorithm and is the primary way data is securely sent over the internet. As an asymmetric encryption method, RSA uses two keys, one for public encryption and one for private decryption. A defining element of RSA is how the algorithm is used: by factoring prime numbers.
Features
This is the best system for communicating with others online, especially when exchanging potentially sensitive information. Its especially used to verify digital signatures. Its easy to implement and sharing public keys to online users is relatively easy.
Because RSA is an asymmetric algorithm, its notably slower in comparison to symmetric encryption. It also requires more power compared to single-key encryption. Plus, though its great for security, if the private key is lost, the data cannot be decrypted.
RSA is used all over online, including web browsers, VPNs, emails, chats, and other communication servers.
Venafi is the leader of machine identity management and works behind the scenes to secure some of the largest networks in the world. Our technology protects cryptographic keys and digital certificates so that your business can safely succeed.
The machines used to communicate, streamline and process data are immensely helpful, but also at immense risk. Leaving machine communications unprotected leaves confidential and classified information unprotected, too. Thats why you need to efficiently manage the identities of all machines, which is why Venafi exists.
Want to learn more about how you can reduce risk at your organization? Download the Machine Identity Management for dummies Guide.
Read the original here:
Types of Encryption Algorithms - Security Boulevard
An end to end-to-end encryption? – Reason
Is the European Union (EU) about to save the FBI from Going Dark by essentially outlawing end-to-end encryption? Jamil Jaffer and Nate Jones tell us that a new directive aimed at preventing child sex abuse might just do the trick. That view is backed by people who've been fighting the bureau on encryption for years.
The Biden administration is prepping to impose some of the toughest sanctions ever on Chinese camera maker Hikvision, Jordan Schneider reports. No one wants to defend Hikvision's role in enabling China's Uyghur policy, but I'm skeptical that we should spend all that ammo on a company that is far from the greatest national security threat we face. Jamil is more comfortable with the measure, and Jordan reminds me that China's economy is shaky enough that it may not pick a fight to save Hikvision. Speaking of which, Jordan schools me on the likelihood that Xi Jin Ping's hold on power will be loosened even by a combination of the Chinese tech downturn, harsh pandemic lockdowns, and the grim lesson provided by Putin's ability to move without check from tactical error to strategic blunder and then to historic disaster.
Speaking of products with more serious national security impact than Hikvision, Nate and I try to figure out why the effort to get Kaspersky software out of U.S. infrastructure is still stalled. I argue that the Commerce Department should take the blame.
In a rare triumph of common sense and science, the wave of dumb laws attacking face recognition may be receding as lawmakers finally notice what's been obvious for five years: The claim that face recognition is "racist" is false. Virginia, fresh off GOP electoral gains, has revamped its law on face recognition so it now more or less makes sense. In related news, I puzzle over why Clearview AI accepted a settlement of the ACLU's lawsuit under Illinois's biometric law.
Nate and I debate how much authority Cyber Command should have to launch actions and intrude on third country networks without going through the interagency process. A Biden White House review of that question seems to have split the difference between the laissez-faire spirit of the Trump administration and the analysis-paralysis of the Obama years.
Quelle surprise! Jamil concludes that the EU's regulation of cybersecurity is an overambitious and questionable expansion of the U.S. approach.
The EU may not be alone. Jordan notes the Defense Department's effort to keep small businesses who take its money from decamping to China once they start to succeed. Jordan and I fear that the cure may be worse than the disease.
I get to say I told you so about the unpersuasive and cursory opinion issued by United States District Judge Robert Pitman, when he enjoined Texas' social media law. The Fifth Circuit has overturned his injunction, so the bill will take effect, at least for a while. In my view some of the provisions are constitutional and others are a stretch; but Judge Pitman's refusal to do a serious severability analysis means that all of them will get a try-out over the next few weeks.
Jamil and I debate geofenced search warrants and the reasons why companies like Google, Microsoft and Yahoo want them restricted.
In quick hits,
Download the 407th Episode (mp3)
You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug!
The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.
Follow this link:
An end to end-to-end encryption? - Reason
Logarithmic Finance Might Be The Next Big Crypto In World Like Ethereum And Bnb | Mint – Mint
Problem-solving is one of the most common features of any top-tier cryptocurrency. Cryptocurrencies with this property can disrupt the cryptocurrency market. From Bitcoin (BTC) to Ethereum (ETH) and from Binance Coin (BNB) to Ripple (XRP), each of these giant cryptocurrencies ranks high in problem-solving capabilities. Logarithmic Finance (LOG) is a recently launched cryptocurrency aimed at overturning the crypto world. It has all the features that will eventually become the next big thing in the crypto market.
Logarithmic Finance (LOG)
Logarithmic Finance (LOG) aims for the next generation of decentralised financial and trading protocols, enabling seamless connectivity and interaction between early blockchain innovators and investors. The raising of funds in a decentralised world has always been considered a daunting task, with several models designed for this purpose criticised for deficiencies. These disadvantages include the high cost of time to market, lack of financial security, and low-budget innovators.
Taking advantage of these shortcomings, Logarithmic Finance (LOG) delved into this market and addressed the issues that existed at both ends. It proposes the idea of a liquidity pool that fills the gap and acts as a bridge. This idea of liquidity pools enhances the purchasing power of innovators seeking first market access across open blockchain networks. The basic idea behind the creation of this cryptocurrency is an interactive community, the development of advanced features for project innovators and liquidity providers, and a true wonder of DeFi innovation at a secure and scalable cost. Lets dig deep into its attributes to identify its true potential, and if it will be able to compete with giants of the crypto industry.
Fully Homomorphic Encryption
The goal is to provide strong security for the switching mechanism available to the end-user through full homomorphic encryption, eliminating the need to decrypt packets while the computational process is taking place behind the scenes. The possibility can be understood from the fact that fully homomorphic encryption allows arbitrary computation of encrypted data.
On-chain Data
In addition to waterfall project management, DevOps best practices, and implementation of fully homomorphic encryption, the platform collects feedback on on-chain data from time to time. Logarithmic Finance (LOG) is critical because it helps engineering and UI/UX design teams make the necessary changes to the interface and other features to provide a seamless experience for users on the platform.
Multi-chain
Logarithmic Finance (LOG) is becoming a fully decentralised Layer 3 exchange protocol. In this regard, it is important to combine interoperability between heterogeneous blockchains with interchain communication. Since this is a complex implementation, these integrations should be done in a multi-step deployment before replacing the pseudo-centralised bridge with a fully distributed consensus mechanism.
Cross-chain
Cross-chain integration facilitates multiple use cases and extends the reach of innovators and investors on the platform. For example, innovators will be able to auction Ethereum (ETH) tokens to the NEO network to take advantage of low-cost transaction fees and scalability. In addition, cross-chain integration also supports P2P transactions between different blockchains.
Inexpensive Gas Fee
Its experienced development team followed a minimal approach, including a clean modular code structure, to design a robust code architecture for the platform. In addition, the platform ensures that only critical data is pinned to the blockchain, optimising the resources deployed. By combining all these practices, you can balance all transactions made in journal finance and reduce gas charges.
NFT Integration
Introduction of the NFT auction function to the platform, dedicated to LOG token owners. Various cryptocurrencies or stable coins can be exchanged for irreplaceable tokens by project innovators. After the cross-chain integration rollout is complete, more stable coins and networks will be introduced, which ultimately results in enhancing the NFT exchange experience.
Disclaimer: This article is a paid publication and does not have journalistic/ editorial involvement of Hindustan Times. Hindustan Times does not endorse/ subscribe to the contents of the article/advertisement and/or views expressed herein.
The reader is further advised that Crypto products and NFTs are unregulated and can be highly risky. There may be no regulatory recourse for any loss from such transactions.
Hindustan Times shall not in any manner, be responsible and/or liable in any manner whatsoever for all that is stated in the article and/or also with regard to the views, opinions, announcements, declarations, affirmations etc., stated/featured in the same. The decision to read hereinafter is purely a matter of choice and shall be construed as an express undertaking/guarantee in favour of Hindustan Times of being absolved from any/ all potential legal action, or enforceable claims. The content may be for information and awareness purposes and does not constitute financial advice.
Subscribe to Mint Newsletters
* Enter a valid email
* Thank you for subscribing to our newsletter.
Read more:
Logarithmic Finance Might Be The Next Big Crypto In World Like Ethereum And Bnb | Mint - Mint
Skiff is launching Skiff Mail to take on Gmail with encryption – The Verge
Skiff has spent the last couple of years developing a privacy-focused, collaborative document editing platform that you could most succinctly describe as encrypted Google Docs. Now, its coming for Gmail. The company is launching an email service called Skiff Mail that aims to be, well, encrypted Gmail and eventually much more than that.
Ultimately, Skiff co-founder and CEO Andrew Milich says Skiff wants to build a complete workspace, something as sweeping and broad as Microsoft 365 or Google Workspace. But the only way to do that is to solve email, which is, in so many ways, the core of both platforms. Its the most private corpus of our lives, you know? Milich says. In an effort to keep peoples most important information safe which includes doctors notes, confirmation numbers, work emails, family chats, and everything else he says email felt like a logical and critical next step.
Emails also a potential growth hack for Skiff. Its really, really hard to move off of a service youre using today when your main identity, Milich says, your main communication layer, the way youre actually living on the internet, is outside of that. In other words, for every user going to Skiff Mail instead of Gmail, thats another person for whom Skiffs other products are just a click away. Right now, Skiff is free for personal use and makes money through business subscriptions; Milich didnt say what Skiffs plans are for email but said that advanced features will likely be paid ones down the road.
Rather than reinvent the wheel and come up with some Hey-level new paradigm for how email works, Skiff is starting fairly simple. The app right now, which works on web, Android, and iOS, looks like Gmail minus all the color and UI cruft. Its almost all text, with folders on the left and a reading view for your current message on the right. In other words, its an email app a pretty barebones one at that. Right now, theres no support for custom domains. You cant check your Gmail in Skiff, and theres not even much in the way of automation or organization tools. Milich says the simplicity is mostly by design: We didnt go super-ambitious and say, like, Were going to reinvent email with a new set of inboxes, a new set of filter rules, a new set of templates. The goal instead was to make all the important stuff text editing, search, managing attachments work really well.
Thats not to say theres no ambition to Skiff Mail. Its just that Milichs whole theory is that this privacy-first app strategy only works if people actually like using the apps. So many apps and services focused on privacy and security practically scream their values at you. The apps are harder to use, force you to manage more systems or click through a thousand warning messages, or just look like they were built by cryptographers rather than designers. (Because usually, they were!) One Skiff advisor told me many of these products look more like advocacy campaigns than competitive products. Skiffs trying to live all those same values: the company often publishes its research, and much of its code is open source but in a much more user-friendly package.
Get Milich talking long enough, though, and hell start to veer into much funkier territory. One of Skiffs recent projects has been to integrate its document platform with the IPFS protocol, a decentralized networking layer that users can now choose to use to store their data. Milich also has ideas about bringing Skiff Mail to the Web3 community. He imagines users with .ETH domain names using those addresses for totally encrypted and decentralized messaging, for instance, or maybe enabling wallet-to-wallet communication via MetaMask integration. Encryption and public key/private keys are so much about what identity means at Skiff, Milich says, and its also what were seeing identity become in web3.
Theres increasing evidence that Gmail but private is a compelling offer for many. Proton, the maker of ProtonMail, said last year that it has more than 50 million users, while platforms like Fastmail and Librem Mail continue to grow as well. Gmail remains the behemoth in the market, effectively the only company that actually matters in email, but those looking for something different have more choices than ever.
Still, even if Skiff could figure out how to build the greatest and most private email system ever conceived, getting people to switch email providers is a nearly impossible task. The inertia is enormous. Switching email accounts is like changing phone or credit card numbers, the kind of thing you only do when absolutely necessary. Thats why most companies dont even try to take on Gmail. Even the majority of email apps that do exist are mostly front-ends on Gmail, not wholesale rethinks of the system. Milich says Skiff has some ideas about how to ease the transition but acknowledged that its a huge hurdle.
One of the tricky things about the idea of private email is that, by design, nobody can actually control email. It would be easy enough for Skiff to build an encrypted email platform if it was just Skiff users emailing other Skiff users, but thats not how email works. Instead, the team has tried to build a tool that scales up and down the security spectrum. When Skiff users do email other Skiff users, everything is encrypted by default and easy for senders to revoke or verify, but when youre emailing outside the ecosystem, the SMTP protocols still work.
Milich hopes that as more providers embrace privacy, theyll build tools to match and, by extension, improve the whole ecosystem. But he figures that, even for now, if the least Skiff can do is say well keep your most important communication safe, even from us, that counts for something.
Read more here:
Skiff is launching Skiff Mail to take on Gmail with encryption - The Verge
Data exposure at the Texas Department of Insurance. ICCL report details RTB ad tracking. Credit card scraping operation. – The CyberWire
At a glance.
A state audit has determined that the personal information of nearly 2 million individuals who filed compensation claims with the Texas Department of Insurance (TDI), an agency that oversees the states insurance industry, was exposed for nearly three years. According to the audit, released this week, the compromised data includes Social Security numbers, addresses, dates of birth, phone numbers, and employee injury info and was publicly accessible online from March 2019 to January 2022. The Texas Tribune reports the leak was the result of a flaw in the programming code in the web application used by TDI to manage workers compensation data. TDI spokesperson Ben Gonzalez explained, We found the issue was due to programming code that allowed internet access to a protected area of the application. We fixed the programming code issue and put the TDI web application back online. We began an investigation to find the nature and scope of the issue. Gonzalez added that the investigation did not uncover any evidence that the data had been misused. Nonetheless, Insurance Business America adds, TDI will send notification letters to the impacted individuals including instructions on how they can enroll for free credit monitoring.
Amit Shaked, CEO, Laminar, finds the kind of error implicated in this incident regrettable. He wrote, "This event is truly unfortunate as it is not due to an attack or malicious activity. It was due to a missed code glitch that left personal data exposed for years. Todays digital world requires layering on data-centric security where policies are at the data object level, like detecting excessive exposure in this case. To combat the growing threat to data protection in the cloud, data security teams require a set of cloud native tools that are automated and always continuously monitoring. These automated solutions will transform security teams from gatekeepers to enablers of data democratization."
It's also another case of abused privileged credentials, Arti Raman, CEO and Founder of Titaniam, wrote. As this incident proved, information can be accessed using privileged credentials, or strictly from a code glitch, allowing not only the general public to see this information, but hackers to steal underlying data. To keep customer PII safe and minimize the risk of extortion, encryption, specifically data-in-use encryption, also referred to as encryption-in-use, is recommended. Data-in-use encryption provides unmatched immunity. Should adversaries break through perimeter security infrastructure and access measures, or simply gain access through a technical error, data-in-use encryption keeps the data and IP encrypted and protected even when it is being actively utilized. This helps neutralize all possible data-related leverage and limits the need for breach disclosure.
Neil Jones, director of cybersecurity evangelism at Egnyte, notes that the data maintained by this agency inevitably includes a great deal of PII. "The recent data breach at the Texas Department of Insurance is especially concerning because worker's compensation data inherently includes PII (Personally Identifiable Information) and PHI (Protected Health Information), which are potential treasure troves for cyberattackers. Although there's no current evidence that the breached information has been used maliciously, it is not uncommon for attackers to wait for just the right time to post their breached data to the Dark Web," he writes. "There are several key lessons that can be learned from this incident:
Erfan Shadabi, cybersecurity expert with data security specialists comforte AG, notes the special responsibility of state agencies: We depend on the state agencies to provide us with a basic level of security against all threats. The recent incident with the Texas Department of Insurance in which the personal information of 1.8 million workers has been exposed should underscore the need for data-centric security such as tokenization or format-preserving encryption to be applied to sensitive data wherever it resides in order to render that data incomprehensible and thus worthless for exploitation if bad actors get ahold of it. Preventing attacks and breaches is not 100% foolproof, so we can only hope that governmental agencies have instituted the mitigating measures of data-centric security applied directly to data in case sensitive information falls into the wrong hands.
On Tuesday the Irish Council for Civil Liberties (ICCL) released a report including new data on what its calling the biggest data breach ever recorded: the real-time-bidding (RTB) systems abuse of web users info for tracking and ad targeting. According to the report, through the use of RTB, a surveillance-based ad auction system, Google and other tech giants have been processing and sharing user data billions of times per day. The ICCL explains, [RTB] tracks and shares what people view online and their real-world location 294 billion times in the U.S. and 197 billion times in Europe every day.
Figures in the ICCLs report, obtained from a confidential source, show that users in the US state of Colorado and the UK are among the most exposed by the system, with 987 and 462 RTB broadcasts respectively per person per day. Americans have their online activity and real-world location exposed 57% more often than Europeans, likely due to differences in privacy regulations across the two regions. The biggest culprit, Google, allows 4,698 companies to receive RTB data about US users, while Microsoft says it may send data to 1,647 companies. Questions have been raised about how RTB could be exposing sensitive data individuals share online, from womens fertility cycles stored in period tracking apps, to Black Lives Matter protestors locations, to the romantic histories of users of Grindr and other dating apps.
The report could have repercussions for European regulators in particular, given that the General Data Protection Regulation (GDPR) has been in place since May 2018 but regulators have been seemingly reluctant to penalize the adtech industry. Johnny Ryan, senior fellow at the ICCL, told TechCrunch, As we approach the four year anniversary of the GDPR we release data on the biggest data breach of all time. And it is an indictment of the European Commission, and in particular commissioner [Didier] Reynders, that this data breach is repeated every day.
An FBI Flash noticewarns that unidentified threat actors were scraping credit card data from an unnamed US business by injecting malicious PHP Hypertext Preprocessor code into the business online checkout page. The scraped data was being sent to an actor-controlled server spoofing a legitimate card processing server. The attackers also established backdoor access to the victims system by modifying two files within the checkout page. The notice details new indicators of compromise for e-commerce sites and lists recommended mitigations, which include updating and patching all systems, change default login credential, monitor e-commerce environment requests for possible malicious activity, segregating network systems, and secure all websites transferring sensitive information by using secure socket layer (SSL) protocol.
Read more here:
Data exposure at the Texas Department of Insurance. ICCL report details RTB ad tracking. Credit card scraping operation. - The CyberWire
How the Online Safety Bill jeopardises the foundation of security online – PoliticsHome
Sheetal Kumar, Head of Global Engagement and Advocacy| Global Partners Digital
Undermining encryption means the Online Safety Bill in its current form is not fit for purpose.
On the heels of the UK's signature on a declaration to protect human rights, fundamental freedoms, and the free flow of information online, the UK Online Safety Bill does the opposite by undermining a critical part of the equation: encryption.
The UKs Online Safety Bill was introduced into the House of Commons on the 17th of March. Despite its stated aim to make the UK the safest place online, it would create serious security and privacy vulnerabilities by introducing a new surveillance power that would disproportionately impact those that need it most - especially vulnerable groups, including children. Clause 103(2) is particularly worrisome because it gives OfCom the power to undermine the same human rights the UK recently committed to uphold in the Declaration for the Future of the Internet.
The bill is lengthy and clause 103(2) b has not received much attention. However, this is a dangerous measure that puts the lives and rights of so many at risk by undermining encryption - and it must be stopped.
Encryption is a critical technology that helps Internet users keep information and communications confidential between the sender and intended receiver. Forty-five technologists, security experts, and NGOs, including members of the Global Encryption Coalition, recently published an open letter highlighting how the Online Safety Bill threatens end-to-end encryption, the strongest form of this security tool. The letter notes that clause 103(2) b could result in notices that would require that providers of such services introduce scanning capabilities into their platforms to scan all user content. The global technology company Apple made a similar proposal for its messaging services last year and, following outcry from security experts, withdrew the plan. It was unworkable then and it remains unworkable now.
Millions of people worldwide rely on encryption for their personal security in times of crisis. For instance, the UKs efforts to try to get people in conflict zones like Afghanistan and Ukraine to safety would be significantly hindered without the security assured by private messaging apps and communications. Moreover, the legislation poses a serious threat to the health of our national economy by creating high costs to comply with the legislation, and the associated costs of leaving all businesses at greater risk of cyber crime with backdoors to encrypted messages. This has already happened in Australia, as a result of the Telecommunications and other Legislation Amendment (Assistance & Access) Act (TOLA) law.
Such scanning cannot be accomplished on end-to-end encrypted services because no one, including the provider, has access to the content carried on that service except for the sender and the intended recipient(s). As a result, such a requirement would require service providers to compromise or abandon end-to-end encryption, and would set a dangerous precedent of introducing new surveillance technologies into the devices we use everyday. These technologies could be exploited by criminals and hostile governments, thereby undermining personal and national security. Beyond these concerns, such an approach could be replicated by other governments, including in countries with weak democratic institutions. It also marks a stark departure from the EUs prohibition on member states to oblige general monitoring of communications. As a result, it risks misalignment with one of the UKs largest trading partners.
Strong encryption protects private information and is integral to the ability to do business, work securely, and build and maintain relationships that are vital to everyday life. Fighting crime is critical, but there are ways to do it without putting our personal safety, human rights, and digital economy at risk of harm. In a world where we increasingly rely on digital technology, users need these everyday digital tools to be secure. Clause 103 (2) b of the Online Safety Bill would have a detrimental impact on the UK and Internet users around the world, and for that reason it should be dropped.
For more information about why the Online Safety Bill needs to change, please click here.
PoliticsHome Newsletters
Get the inside track on what MPs and Peers are talking about. Sign up to The House's morning email for the latest insight and reaction from Parliamentarians, policy-makers and organisations.
Originally posted here:
How the Online Safety Bill jeopardises the foundation of security online - PoliticsHome
Take a Diversified Approach to Encryption – DARKReading
Quantum computers may one day break encryption. So might stochastic magnetic tunnel junction machines, also known as spintronics. But we don't need next-generation computing power to break encryption. Its successfully happening right here and now.
Why Does Encryption Fail?There are many factors that contribute to encryption weaknesses and create vulnerabilities ready for exploitation by cybercriminals or state-sponsored actors. Chief among them is poorly implemented cryptography in terms of both the crypto libraries themselves and the way they are used. Bugs such as Heartbleed or the recent implementation error of the Elliptic Curve Digital Signature (ECDS) algorithm in Java versions 15 and above, undermine all programs based on them. The incorrect use of a library, insufficient entropy, or use of weak ciphers is a daily occurrence that impacts specific applications, making bugs even harder to find. Other encryption failings include weak passwords and certificates taken from compromised machines. Combine these techniques with harvest-now-decrypt-later attacks, and encryption technology is no longer what it used to be.
Mathematics, the Cornerstone of Encryption Extremely difficult mathematics underlie our encryption. RSA, the gold standard for public key encryption, is based on the complexity of breaking down a large number into its constituent primes. The forward problem is easy and quick to solve: Take some primes and multiply. But the reverse problem is much harder: Given an integer, which primes were multiplied to make it? Attempts to solve the problem of prime factorization dates back centuries, with Euclid of Alexandria working on specific properties of prime numbers more than 2,000 years ago.
Although no solutions have been found that work on conventional binary computers, that does not mean none exist. After more than 2,000 years of work, most mathematicians agree a prime-factorization algorithm used by a classic computer wont be here anytime soon. Peter Shor proposed an algorithm that could do composite number decomposition in polynomial time on a quantum computer breaking RSA and Diffie-Hellman ciphers but a quantum computer of this kind has not been publicly demonstrated at sufficient scale. Yet.
To prepare for the day when Shors algorithm is in play, the National Institute for Standards and Technology (NIST) has sponsored a post-quantum cryptography (PQC) competition. Now in its sixth year, the competition that began with 82 submissions is expected to announce its four finalists this year.
The remaining candidates are asymmetric-key algorithms (similar in concept to RSA) believed to be capable of withstanding the computational power of a stochastic algorithm that might run on a scalable quantum computer. The mathematical problems upon which these newer algorithms are based are much younger and have not been studied extensively.
In the field of complex mathematics centuries are common time frames. For example, Fermats last theorem took 358 years to be proven. By that logic, its no wonder we have already seen a previously unknown or unforeseen weakness revealed in Rainbow what had been the most peer-reviewed quantum-resistant algorithm now deemed unsuitable for use by NIST. Its only a matter of time, then, before new encryption standards are weakened or outright broken. This is why NIST is encouraging organizations to embrace crypto agility in their post-quantum preparedness planning.
What complicates this matter further is that we don't and won't know which methods are bearing fruit and which techniques are being used, and by whom, to break the encryption we rely on to secure our digital universe. For all we know, large-scale quantum computers are already in use. If you were a nation state or criminal mastermind and had the ability to factor large numbers into their primes, would you tell the world? This is the fundamental problem with modern encryption: We often dont know which, when, or how ciphers are compromised. However, we can say with certainty that encryption is being broken and will be broken.
Look to Wall Street and Diversify To harden IT environments and digital assets in the face of such uncertainty, we can look to Wall Street for strategic advice. To combat the uncertainties and risks associated with loans and stocks go bad, financial institutions embrace diversification. By diversifying investments across multiple asset classes, geographies, and industries, the risks of an entire portfolio imploding are minimized.
This approach can, and should, be applied by enterprise IT and SOC teams when it comes to encryption. Using and mixing/stacking multiple encryption techniques helps to keep data traveling securely even if a flaw is uncovered in one of the encryption layers. We wont always know which part of a crypto stack has been defeated and how, but it wont matter if the cryptography is sufficiently diversified.
As an industry, we need to support the simultaneous use of multiple approaches, anticipating that new crypto methods will come and go. We must mix asymmetric key technology with symmetric key technology, and transmit keys through out-of-band channels. Most importantly, we must develop agreed-on metrics and industrywide benchmarks to measure exactly how diversified our crypto strategy is.
Go here to see the original:
Take a Diversified Approach to Encryption - DARKReading
The SEM’s Email Encryption Market Is Estimated To Reach US$ 24.8 Billion By 2032 – Digital Journal
250 PagesSEMs Email EncryptionMarket Survey by Fact MR, A Leading Business and Competitive Intelligence Provider
ICT companies areextensively adopting technologies such as cloud computing and artificial intelligence toensure seamless operations as teams continue working from home.Focus on fast automation, use of real-time operation within various end-use sectors such as automotive, food & beverage and others will provide stimulus to the growth.
The report offers actionable and valuable market insights ofSEMs Email Encryption. The latest report by Fact.MR provides details on the present scenario of the market across various regions along with the historic data and forecast of the market. The report also includes information on the sales and demand ofSEMs Email EncryptionMarket across various industries and regions.
To remain ahead of your competitors, request for a sample https://www.factmr.com/connectus/sample?flag=S&rep_id=7254
The market study done by Fact.MR gives exclusive information about how the market will grow. The study identifies crucial trends that are determining the growth ofSEMs Email Encryptionmarket. This newly published report sheds light on vital dynamics, such as the drivers, restraints, and opportunities for key market players as well as emerging players associated with the production and supply. The latest report by Fact.MR provides detailed Market Analysis ofSEMs Email Encryption
This newly published and insightful report sheds light on Market Insights ofSEMs Email Encryption, key dynamics, their impact on the overall value chain from suppliers to end-users and Growth ofSEMs Email EncryptionMarket.
Need more information about Report Methodology? Click here-https://www.factmr.com/connectus/sample?flag=RM&rep_id=7254
Full Access of this Exclusive Report is Available at-https://www.factmr.com/checkout/7254
Read More Trending Reports of Fact.MR-https://www.einpresswire.com/article/557048856/demand-for-consumer-appliances-spearheading-sales-electronics-and-electrical-ceramics-says-fact-mr-s-study
Key Question answered in the survey ofSEMs Email Encryption market report:
More Valuable Insights onSEMs Email EncryptionMarket
Fact.MR, in its new report, offers an unbiased Market Analysis ofSEMs Email Encryption, Sales and Demand ofSEMs Email Encryption, analyzing forecast statistics through 2019 and beyond. The study reveals growth projections on the basis of various criteria.Explore Fact.MRs Comprehensive Coverage on Technology Domain:
Portable Audio Amplifier MarketForecast, Trend Analysis & Competition Tracking Global Review 2021 to 2031
Air Conditioner Remote Control MarketForecast, Trend Analysis & Competition Tracking Global Review 2021 to 2031
Learning Remote Controls MarketForecast, Trend Analysis & Competition Tracking Global Review 2021 to 2031
About Us:
Market research and consulting agency with a difference! Thats why 80% of Fortune 1,000 companies trust us for making their most critical decisions. While our experienced consultants employ the latest technologies to extract hard-to-find insights, we believe our USP is the trust clients have on our expertise. Spanning a wide range from automotive & industry 4.0 to healthcare & retail, our coverage is expansive, but we ensure even the most niche categories are analyzed. Our sales offices in United States and Dublin, Ireland. Headquarter based in Dubai, UAE. Reach out to us with your goals, and well be an able research partner.
Contact:US Sales Office :11140 Rockville PikeSuite 400Rockville, MD 20852United StatesTel: +1 (628) 251-1583E-Mail:[emailprotected]
Corporate Headquarter:Unit No: AU-01-H Gold Tower (AU),Plot No: JLT-PH1-I3A,Jumeirah Lakes Towers,Dubai, United Arab Emirates
View post:
The SEM's Email Encryption Market Is Estimated To Reach US$ 24.8 Billion By 2032 - Digital Journal