Given that context, the NBSs choice was perplexing. On the one hand, DES did deliver on its promise: after decades of analysis, there is still essentially no way to decrypt DES-encrypted data other than potentially trying every key, in whats called an exhaustive search. But on the other hand, one would expect that the 56-bit key would be nowhere near as strong as the 128-bit Lucifer.

Mounting an exhaustive search against DES was at the edge of possibility in 1975. Martin Hellman, a professor of computer science at Stanford University, and Whitfield Diffie 65, a researcher in Hellmans lab, estimated that for $20 million the US government could build a machine capable of trying all possible keys; adding just eight more key bits would increase the difficulty by a factor of 256, making a key search practically impossible. It was as if the proposed standard had been carefully designed so that DES-encrypted messages could be cracked by the US government but not by US corporations.

Feistel was born in Germany in 1915 into a middle-class Protestant family. His aunt married a wealthy German Jew named Franz Meyer, and the two fled Germany for Zrich, Switzerland, before 1931.

When Hitler came to power in 1933, Feistel was terrified that compulsory military service would be reinstated (which it was). So his uncle devised a plan to have Feistel attend summer school at Columbia University in 1934 to improve his English, then enroll at the Eidgenssische Technische Hochschule (ETH) in Zrich for college, and finally transfer to a university in the US to complete his studies and obtain permanent residence. The plan worked, and Feistel entered MIT in the fall of 1936. Meyer and his wife followed, moving to New York City before 1940.

Feistel graduated from MIT in 1937 with a degree in physics and continued as a graduate student until 1938, when he enrolled at Harvard. He became a US citizen on January 31, 1944. The following day, he told me, he was given a top secret clearance, recalls Diffie. Yet Feistel felt that he experienced discrimination because of his German heritage. Although he had been interested in codes and cryptography since he was a child, he couldnt work on them. He said something to someone during the war and was told that it was not the time for a German to be talking about cryptography, Diffie recalls.

Finally, he got his chance. After working at the MIT Radiation Laboratory, Feistel got a job at the Air Force Cambridge Research Center (AFCRC), which had been asked to evaluate an Identification Friend or Foe (IFF) system that aircraft used to identify themselves to radar systems so as not to be shot down.

Feistels group found a flaw with the system and developed a better approach based on cryptography. Its not clear whether it was ever deployed: within a few years, the AFCRC cryptography group was shut down, likely because the Department of Defense was centralizing cryptographic research at the NSA. But modern IFF systems do employ cryptography and a key that is changed regularly.

In November 1957 Feistel took a job at MIT Lincoln Laboratory, where he wrote a report summarizing the IFF work done at AFCRC. Whatever the particular application may be, any scheme of secret communication should be carefully analyzed and evaluated for its merits and faults, he concluded. It is better to know where one stands, than being SPOOFED into a false sense of security, through lack of knowledge or perhaps even inventors pride.

Lincoln didnt work out for Feistel, though, and neither did MITRE, the Bedford-based research firm, where he went in 1961. My father wasnt very happy there, recalls his daughter, Peggy Chester: again, Feistel thought colleagues discriminated against him because he was German. Feistel took pride in his German heritage and in German engineering, says Harold Mattson, PhD 55, who worked with Feistel at AFCRC. He adds that Feistel was also somewhat bitter about the postwar world order, describing the United Nations as a Victors Club on more than one occasion.

It may have been during his years at MITRE that Feistel developed his encryption approach. But if so, he didnt share it. He was very cautious about revealing his Lucifer code, his daughter says. He was afraid that other people would take it from him. Its also possible that cryptography work he wanted to do at MITRE was being stifled by the NSA.

In 1968, Feistel moved to IBM, which hired him specifically to work on cryptography for commercial applications. Its here that he likely perfected his encryption algorithm. On June 30, 1971, the company filed a patent application for his Block Cipher Cryptographic System. NSA reviewed the application and issued a secrecy order blocking publication of the patentbut NSAs order, dated October 17, 1973, was five months after the Scientific American article. NSAs order was rescinded on November 14, 1973, and US Patent 3,798,359 was published on March 19, 1974, with H. Feistel listed as the inventor.

Horst was key to the IBM cryptographic research effort, says Hellman, who also taught at MIT from 1969 to 1972. In 1973, when Horst published that paper, it was an eye-opener for many of us. It opened an approach to cryptography that made a lot of sense. Today the approach is so identified with Feistel that the basic design of DES and other similar algorithms is called a Feistel network.

Meanwhile, Diffie and Hellman discovered public-key cryptography in 1976. One of its primary uses is to distribute encryption keys for algorithms like DES.

Work by Don Coppersmith 72 published in the IBM Journal of Research and Development in 1994, four years after Feistels death, revealed that IBM knew by 1975 that the 128-bit Lucifer key would have been vulnerable to differential cryptanalysis, a cryptanalytic attack independently discovered by academics in the late 1980s. In the process of strengthening Lucifer, IBM shortened the key. In other words, when DES was approved for use in the 1970s, it might have been stronger than Lucifer after all.

But by the mid-1990s, computer scientists widely acknowledged that the 56-bit key was no longer secure and argued that DES should no longer be used to protect information.

To demonstrate that US policy was putting privacy at risk, in 1998 the Electronic Frontier Foundation constructed a machine called Deep Crack that cracked a DES-encrypted message in just 56 hours. The machine cost $250,000 to build, but most of that was engineering costs: EFF estimated that the second machine would cost less than $50,000.

Our research results prove that DES can be cracked quickly on a low budget, the EFF book Cracking DES concludes.

DES was replaced by a new algorithm called the Advanced Encryption Standard on May 26, 2002. As near as anyone knows, AES is still secure.

View original post here:
In praise of the Feistel network - MIT Technology Review

Understanding Ransomware

Ransomware threats have become a relevant part of any organizations risk landscape awareness in the past few years as threat actors and their TTPs become more advanced and take on a more diverse range of targets. Understanding what ransomware is, what risk it presents for your organization, and how to build an effective response and recovery plan are all crucial for implementing a strong threat intelligence program and keeping your assets, infrastructure, and personnel secure.

In this article, we:

Ransomware uses data encryption to block organizations access to their own sensitive data, demanding a ransom is paid to unlock it safely. Personnel facing a ransomware attack are denied access to internal files and programs, and ransomware actors often design their malware to spread throughout an organizations infrastructure while targeting its entire database and file servers, more effectively forcing the company to pay the ransom.

As attacks evolve to become more severe, threat actors have also adopted tactics to add external pressures, such as threatening to release confidential information, doxx executives, or inform clients that the company is not willing to pay to protect their data, to increase the likelihood of payment.

Although its become increasingly discussed in the past decade, ransomware attacks have existed for almost 40 years. One of the first recorded ransomware attacks, taking place in 1989 and released via floppy disk, was the AIDS Trojanalso called the PC Cyborg Virus. This ransomware attack demanded that victims send $189 via post to a P.O. box in Panama to restore access, although the encryption strategy used would not be effective at locking organizations out of their own systems today.

Until the 2000s it was difficult to efficiently receive ransom payments, making ransomware attacks relatively rare compared to today. Threat actors usually collected payments through money transfer services like Western Union or MoneyGram, or would request users to send prepaid debit cards through services like MoneyPak. With the advent of cryptocurrency, it has become much easier for threat actors to receive payments and quickly profit, which has led to this type of attack becoming more widespread.

Ransomwares evolution has seen a shift in the way threat actors choose their targets and tailor their attacks. In the past, general ransomware attacks were more common, and would target wider groups of victims at once to take advantage of a larger volume of lower value payments. They were fairly random, and would prey upon whoever happened to download the malware that would force them to pay.

However, extortionist sites, like the one associated with the criminals behind Maze ransomware, have given threat actors the ability to effectively target specific entities that are willing to pay higher ransoms in a single attack. Victim-shaming sites prevent targeted organizations from keeping an attack private and taking their time to pay the ransom, which makes them more willing to pay and helps the perpetrators profit quickly and with a higher success rate.

As ransomware attacks become more advanced, many threat actors have also begun leveraging other tactics in addition to holding confidential data hostage to further encourage organizations to pay up quickly. One of the most common secondary threats is to release the private information theyve captured, either to the general public or to a companys board, further damaging an organizations reputation in the wake of an attack.

Flashpoint has observed up to four tactics used in a single attack, often progressing from the aforementioned data encryption and theft to DDoS attacks, which shut down the victims sites so customers cannot get service, and harassment, which involves the threat actors directly contacting customers, investors, and the media to publicize the attack.

As a result, ransomware attacks often disable organizations and leave them unable to move forward without giving into demands, which is why ransomware has become a growing issue for companies as more threat actors attempt to profit from this lucrative threat vector.

This cybercrime industry is expected to grow to over $265 billion by 2031, and has become a risk for organizations across categories that must be considered as organizations build their threat intelligence and risk remediation programs.

Essentially, ransomware is built to infiltrate an organizations system, encrypt the files so theyre inaccessible to other users, and send a ransom demand to the victim. There are several ways threat actors accomplish these steps, but they are most often broken into the following components:

In order to gain initial access to a system, threat actors leverage a variety of infiltration vectors to help them infect an organizations database. Some of the most common include:

Recommended: Where Do Cybercriminals Stand on Ransomware Now?

Ransomware attacks often make use of multiple tactics to achieve the required level of access necessary to execute a large-scale attack.

Once an organizations infrastructure has been compromised, ransomware actors must encrypt the data so it is inaccessible to others and can be used to leverage payment for its unlocking.

This part of an attack is often the most straightforward, since encryption functionality is built into an operating system. It involves accessing the fileswhich is possible with the previously-installed malwareand then encrypting them with a unique attacker-controlled key. These new files replace the old ones, and the organization is no longer able to access their data, leaving them paralyzed and vulnerable to further breaches.

After an organization is locked out of their systems, a ransom is demanded via the ransomware to make organizations pay as quickly as possible. This is normally communicated to the victim via a ransom note, which is either programmed to be set as the display background of the device victims are trying to access their files from, or is contained in each of the encrypted directories so it is found as victims attempt to open their files.

These notes inform the victim of the price they must pay to regain control of their infrastructure, which are often demanded in cryptocurrency. If and when the ransom is paid, the victim receives either the encryption key or a copy of the encryption key that can be entered into the decryptor program (also provided by the attacker), which restores organizational access to the files and data.

These three components make up the framework for any ransomware attack, although their implementation can vary based on threat actor group.

Ransomware comes in many forms, including:

Tracking Ransomware: Understanding your Exposure and Taking Action

Ransomware-as-a-service: RaaS has become more popular in recent years, and refers to anonymous threat actors that act on behalf of another party to carry out an attack. From infiltrating a system to collecting the ransom, these anonymous hackers receive part of the payment in exchange for their assistance.

The WannaCry ransomware attack of May 2017 affected Microsoft Windows users worldwide, encrypting data and demanding Bitcoin ransom payments. This mass attack targeted organizations around the globe, using EternalBlue, a Microsoft exploit developed by the NSA for older Windows systems. This exploit was stolen by hacker group The Shadow Brokers and subsequently leaked roughly a month before the attack, which allowed for the ransomwares rapid propagation to a large number of countries across industries.

Related Reading: Linguistic Analysis of WannaCry Ransomware Messages Suggests Chinese-Speaking Authors

Petya is a strain of ransomware that targets Microsoft systems, encrypting data and preventing the operating system from starting. First observed in March 2016, it demands ransom payments in Bitcoin and was initially propagated via email attachments, although there have since been attacks using Petya malware that use a variety of TTPs to do damage.

One of its most notable variants, dubbed NotPetya, emerged in June 2017 and was used to carry out a widespread ransomware attack around Europe and the US. These attacks primarily targeted Russia and Ukraine, and are believed to be politically-motivated attacks against Ukraine that took place on its Constitution Day.

A suspected variant of Petya, Bad Rabbit ransomware was first observed in 2017 and disguised itself as an Adobe Flash installer, exposing those who unknowingly visited compromised websites via drive-by downloads. Once infected, a victims display would demand a Bitcoin ransom payment within 48 hours, although it was reported that payment did unlock the device, which does not always happen during ransomware attacks.

REvil was a Russian-language RaaS group that executed ransomware attacks by threatening to release sensitive organization information to the public unless a ransom was paid. In one of its most high-profile cases, it obtained confidential schematics for unreleased tech products. An announcement was made in January 2022 by the Russian Federal Security Service that it had dismantled REvil and arrested several of its members.

In one of its most noteworthy attacks, REvil targeted global IT infrastructure provider Kaseya in July 2021 by hacking its Virtual Systems Administrator software, spreading REvil ransomware to its users. The attack affected thousands of organizations, either directly or indirectly, and was carried out by exploiting an unpatched vulnerability that was fixed by Kaseya nine days after the incident took place.

Conti ransomware, which has existed since 2020, utilizes a number of TTPs to distribute the malware, including spear phishing campaigns, weak RDP credentials, and the exploitation of vulnerabilities in external assets. In February 2022, Conti chats were leaked, identifying individuals involved with the ransomware group and exposing other details of how it is run. However, there is evidence that Conti is still operating despite the leaks, and is still an active threat in the ransomware space.

Related Reading: Conti Affiliate Leaks Ransomware Documents

Carried out by criminal hacking group DarkSide, a ransomware attack was leveraged against American oil pipeline system Colonial Pipeline in May 2021 that led to the suspension of all pipeline operations in an effort to contain the attack. Working with the FBI, the organization made a payment of 75 bitcoin, approximately $4.4 million, to DarkSide, making it the largest attack on an oil infrastructure target in American history. They were subsequently provided an IT tool by the threat actor group to restore the system. It was announced in June 2021 that 63.7 of the bitcoin, or $2.3 million of the total payment, had been recovered.

Related Reading: DarkSide Ransomware Links to REvil Group Difficult to Dismiss

In December 2020 a ransomware attack against workforce management company Ultimate Kronos Group left many organizations, including some major enterprise companies, unable to process payrolls and consequently in violation of their obligations to employees. UKG was subsequently sued by several of its customers for alleged negligence in security practices and data protection, highlighting the importance of organizations implementing best practices to protect their and their users data.

Recommended: The Great Cyber Exit: Why the Number of Illicit Marketplaces Is Dwindling

As ransomware evolves to become more aggressive to organizations, there are developments that organizations should be aware of to better protect themselves from these types of threats.

2021 saw an increase in the number of ransomware attacks executed against organizations, growing by 105 percent compared to 2020. Although they make up just a small portion of total victim numbers, governments and healthcare organizations saw particularly steep growth in attacks, with the former seeing a 1,885 percent increase in the number of attacks and the latter experiencing a 755 percent increase. Especially with the rise of remote work, threat actors have taken advantage of heightened vulnerabilities that leave organizations more susceptible to a breach in their infrastructure.

Not only has the quantity of ransomware events proliferated, but ransomware actors have also evolved their tactics to make for more severe attacks that are meant to increase the likelihood of victims sending payment.

Coordinating attacks with major organization events like an IPO, sharing confidential information on victim-shaming sites, and threatening to sell stolen data to outside parties that are willing to pay for it have all been observed by Flashpoint as methods being used to put pressure on companies to submit to ransom demands.

With ransomware a firmly established part of the threat landscape across sectors, more responsibility is now placed on the board of an organization to ensure that their security teams have a solid plan to prevent and deal with ransomware breaches effectively and legally. As attacks become more severe, several factors are making it even more important for boards to take on an active role in defending their organizations against ransomware.

Ransomware attacks made up 75 percent of claims reported to cyber insurance companies in 2021, marking the rapid growth in both volume of attacks and the demand from organizations to have a safety net to protect their assets in the event of such an attack. This boost has become unsustainable for cyber insurers, leading to some, like AXA, announcing that ransomware attacks will no longer be covered under their policies.

Meanwhile, judicial bodies are tightening the standards organizations are held to to disclose attacks, and limiting the circumstances under which it is legally permissible to pay the ransom. As a result, these changes stand to put companies in an even more difficult position if a ransomware attack does occur, which means prevention must be prioritized over reaction.

As your organization takes steps to strengthen its defense against ransomware attacks, its helpful to identify things that make your personnel and infrastructure more susceptible to being targeted by threat actors. This knowledge can assist you in understanding what steps to take to better protect your organization from a successful ransomware attack.

Some of the key weaknesses that are in your control that threat actors look for to make for an easier attack include:

Additionally, there are other elements that may make certain companies more susceptible to ransomware attacks that are not necessarily changeable, but are important to be aware of to emphasize the importance of a strong ransomware prevention and defense plan.

Many companies targeted by ransomware attacks:

With all of these factors in mind, its important to have a realistic view on how ransomware risk fits into your organizations broader threat landscape analysis. Having a strong threat intelligence program in place is a good start to protecting your assets and infrastructure from an attack, but it is only one part of building a good defensive strategy.

A robust cyber awareness training program is one of the most impactful ways you can preempt potential threats. An effective program educates all of your employees about best cybersecurity practices and teaches them how they can contribute to a more secure organization, minimizing the risk of successful ransomware distribution through methods like email phishing. Best practices for individuals include:

In addition to these steps each employee should take to help prevent a successful breach, there are broader organizational measures that can be enacted to further impede threat actors from executing a successful ransomware attack. These include:

In the event that a ransomware attack does impact your organization, mapping out how to respond quickly and effectively can greatly minimize the damage afterwards. Planning ahead is key, as it saves your entire team valuable time in the moment when its most impactful, and ensures that everyone knows how to proceed so all efforts are aligned.

Among the most important aspects to include in your response plan are clear definitions of roles and responsibilities for involved teams and individuals, business continuity plans to minimize an attacks impact on your customers and users, communication plans, and vendor partnerships.

The basic steps of a ransomware response can usually be broken into the following parts:

After validating that an attack is taking place, its important to determine its scopehow widespread has it become? Understanding this will help you stop it as quickly as possible by taking the affected devices off of organization networks theyre connected to, preventing the ransomware from spreading to shared drives and other devices. It is also best practice to take your backups and other systems offline to prevent the ransomware from infecting them as well.

After you have secured your organization from further damage, your response teams can begin to investigate the scope of the attack and determine how much of your system has been impacted. Determining the strain of ransomware that was used, what specific files and data have been encrypted, and whether your backups are secure and functioning are also considerations to make as you evaluate the incident.

Once you have a clear view of what has been impacted, you can move forward with recovering your data and finding a solution to restore system access to your personnel. In addition to disclosing the attack to all involved parties, possible solutions to consider include:

Its important to note that submitting to a ransom demand is not always legal, so its crucial to include law enforcement and a knowledgeable party from your own organization to verify that ransom payment is allowed. Since some threat actors are tied to sanctioned entities, or are sanctioned themselves, a due diligence investigation may be needed.

It has historically been in the threat actors best interest to follow through on restoring access to your files and data once they receive a payment, since failing to do so can damage their reputation and decrease the likelihood that future victims will pay. However, it should be noted that there have been cases where threat actors do not follow through on their promise to decrypt your data, so paying the ransom should be carefully considered.

After you have restored access and retrieved your data, your security teams must perform an audit to determine which vulnerabilities were exploited that allowed for a successful ransomware attack and make the necessary changes to prevent it from happening again.

It is not uncommon for the same organization to experience a ransomware attack multiple times, usually because they do not fix the underlying causes of the vulnerabilities, allowing threat actors repeat access. Implementing new and improved measures to secure your infrastructure will make its recovery smoother and more stable.

Your organizations data, infrastructure, and personnel are valuabledont let threat actors take advantage of them. Sign up for a free trial and see firsthand how Flashpoint cybersecurity technology can help your organization access critical information and insight into ransomware actors and their tactics, techniques, and procedures (TTPs).

Read more:
Definitive Guide to Ransomware: What It Is and How Your Organization Can Prevent, Detect, and Respond to a Ransomware Attack - Flashpoint

This comprehensive Report on Hardware-based Full Disk Encryption Market provides real information about the statistics and state of the global and regional market. Its scope study extends from the market situation to comparative pricing between the main players, spending in specific market areas, and profits. It represents a comprehensive and succinct analysis report of the main competitor and price statistics with a view to helping beginners establish their place and survive in the market. In addition, it also focuses on the market overview for the coming period from 2022 to 2028. This proved to be a great help for entrepreneurs. This detailed market research is heavily based on information received during interviews with key leaders, research, and innovative resources.

Download Sample Copy with TOC, Graphs & List of Figures @https://www.stratagemmarketinsights.com/sample/86871

In addition to the information presented in this report on the Hardware-based Full Disk Encryption Market, it includes financial losses incurred as a result of COVID-19. It also explains how the most important business sectors in the market are coping with the epidemic and how to get out of it. This market report is a way to present accurate information on company profiles and competitiveness analyses in an orderly manner. It anticipates competition in the market for the planned period from 2022 to 2028. This Hardware-based Full Disk Encryption Market study also looks at industry channels and performance rates to help key players stay ahead of the competition.

The major players covered in Hardware-based Full Disk Encryption Market:

Ethicon Endo-Surgery, Olympus, Medtronic(Covidien ), Stryker, Smith & Nephew, Karl Storz, Boston Scientific, Richard Wolf, Aesculap(B. Braun), Intuitive Surgical, Apollo Endosurgery (Allergan), Tiansong, Medical Optical, Shenda, Shikonghou, HAWK, xinxing

The Regional analysis covers:

North America (U.S. and Canada)Latin America (Mexico, Brazil, Peru, Chile, and others)Western Europe (Germany, U.K., France, Spain, Italy, Nordic countries, Belgium, Netherlands, and Luxembourg)Eastern Europe (Poland and Russia)Asia Pacific (China, India, Japan, ASEAN, Australia, and New Zealand) The Middle East and Africa (GCC, Southern Africa, and North Africa)

The study accurately predicts the size and volume of the market in the present and future. The report offers a comprehensive study of the Hardware-based Full Disk Encryption Market industry and information on foreseeable future trends that will have a significant impact on the development of the market. The weekly then looks at the key global players in the industry.

Introduction

The report highlights the latest trends in revenue and market progress, and all realistic statistics on ventures. It provides prevention and pre-planned management and highlights a summary of the global Hardware-based Full Disk Encryption Market, along with classification, definition, and market chain structure. The Global Report highlights issues affecting the global Hardware-based Full Disk Encryption Market, including gross margin, cost, market share, capacity utilization, income, capacity, and supply. It also highlights the future scope of the global Hardware-based Full Disk Encryption Market during the upcoming period.

Marketing Statistics

The Global Hardware-based Full Disk Encryption Market Report estimates upfront data and statistics that make the report a very valuable guide for individuals dealing with advertising, advisors, and industry decision-making processes in the global Hardware-based Full Disk Encryption market. Provides regional analysis for the market. This report provides essential data from the Hardware-based Full Disk Encryption Market industry to guide new entrants in the global Hardware-based Full Disk Encryption market.

Dont miss out on business opportunities in Hardware-based Full Disk Encryption Market. Speak to our analyst and gain crucial industry insights that will help your business grow @https://www.stratagemmarketinsights.com/speakanalyst/86871

Market Dynamics

The global report shows details related to the most dominant players in the global Hardware-based Full Disk Encryption market, along with contact details, sales, and accurate figures for the worldwide market. Various data and detailed analyses collected from various trusted institutions of the global Hardware-based Full Disk Encryption Market are presented in the Global Hardware-based Full Disk Encryption Market Research Report.

Market Segmentation of Hardware-based Full Disk Encryption Market:

Hardware-based Full Disk Encryption Market is divided by type and application. For the period 2022-2028, cross-segment growth provides accurate calculations and forecasts of sales by Type and Application in terms of volume and value. This analysis can help you grow your business by targeting qualified niche markets.

Industry analysis can be an effective tool to help an organization devise strategies and policies for a business. Stratagem Market Insights investigates gaps in the existing market space and aligns clients outlook of the market by providing advanced data, research, and analytics. These research outcomes may offer valuable insights to our clients, thereby aiding them to project long-term and short-term future industry trends, consumer needs, cutting overall costs, etc. Stratagem Market Insights has skilled research analysts who leverage their knowledge perfected with years of expertise and that adopt advanced analytical tools to offer an unbiased competitive research analysis to assist our invaluable clients to align their strategies with their long-term growth targets.

WHY CHOOSE STRATAGEM MARKET INSIGHTS INDUSTRY ANALYSIS SERVICE?

Buy-Now this Premium Reporthttps://www.stratagemmarketinsights.com/cart/86871

This Hardware-based Full Disk Encryption Market reports themarket status and outlook of global and major regions, from angles of players, countries, product types, and end industries; this report analyzes the top players in the global industry and splits by product type and applications/end industries. This report also includes the impact of COVID-19 on the Hardware-based Full Disk Encryption Market industry. Global Hardware-based Full Disk Encryption Market Industry 2022 Market Research Report is spread across120+ pagesand provides exclusive vital statistics, data, information, market trends, and competitive landscape details in this niche sector.

Contact Us:

Mr. ShahStratagem Market InsightsTel: US +1 415 871 0703 / JAPAN +81-50-5539-1737Email:sales@stratagemmarketinsights.com

AJ

See the original post here:
Hardware-Based Full Disk Encryption Market Insight By Business Growth, Development Factors, Current And Future Trends Till 2028 themobility.club -...

This year's recipient of the $10,000 prize forsignificant advances in the practice of cryptography and its use in real-world systems, is Let's Encrypt. ItsExecutive Director, Josh Aasaccepted the award at this month's 2022 Real-World Crypto conference.

Since 2016, the Levchin Prize has been awarded annually to celebrate recent advances that have had a major impact on the practice of cryptography and its use in real-world systems. Established by the Ukrainian-AmericanInternet entrepreneur Max Levchin, founder and CEO of financial services technology company,Affirm and one of the original co-founders of PayPal, the only stipulation for the prize is the winner's attendance at theReal World Cryptography (RWC) conference for its presentation ceremony.

This year's RWC Symposium was held in Amsterdam on April 1315, 2022 as a hybrid event with remote attendance possible both for presenters and attendees. Anybody can be nominated for the prize and members of the RWC Steering Committee select up to two winners from among those nominated.

We first covered the Levchin Prize in 2018 when there were two recipients,Hugo Krawczykof the IBM T.J. Watson Research Center and theOpenSSLteam. See our report for more details of the award, including a video in which Max Levchin explains its background and rationale.

Let's Encrypt isa non-profit certificate authority run by Internet Security Research Group that provides X.509 certificates for Transport Layer Security encryption at no charge. It is these certificates that are required for a website to be deemed safe and hosting services typically charge upwards of $100 per annum. Being able toset up encryption on websites easily and without the usual hassleusing Let's Encrypt enabled websites to overcome the obstacles that threatened to curtail their operation when the switch to htpps was moreorless mandated.

Dan Boneh,Professor in Applied Cryptography and Computer Security at Stanford University and a member of the RWC Steering Committee stated:

"We are thrilled to award theLevchin Prize to Let's Encrypt. Thanks to Let's Encryptnearly every person browsing the Web experiences the benefits of cryptography."

In response Josh Aas thanked the RWC Steering Committee and Max Levchin for this recognition and went on to reveal thatLets Encrypt is currently used by more than 280 million websites, issuing between two and three million certificates per day. He also explained that the team behind it started working on it in 2013 saying:

Lets Encrypt ultimately came from a group of people thinking about a pretty daunting challenge. The billions of people living increasingly large portions of their lives online deserved better privacy and security, but in order to do that we needed to convince hundreds of millions of websites to switch to HTTPS. Not only did we want them to make that change, we wanted most of them to make the change within the next three to five years.

His speech also disclosed the remarkably small scale of the operation:

Today there are just 11 engineers working on Lets Encrypt, as well as a small team handling fundraising, communication, and administrative tasks. Thats not a lot of people for an organization serving hundreds of millions of websites in every country on the globe, subject to a fairly intense set of industry rules, audits, and high expectations for security and reliability. The team is preparing to serve as many as 1 billion websites. When that day comes to pass the team will be larger, but probably not much larger. Efficiency is important to us, for a couple of reasons. The first is principle - we believe its our obligation to do the most good we can with every dollar entrusted to us. The second reason is necessity - its not easy to raise money, and we need to do our best to accomplish our mission with whats available to us.

Lets Encrypt Receives the Levchin Prize for Real-World Cryptography

Levchin Prize website

Nomination Form

Levchin Prize for Real-World Cryptography

Let's Encrypt Now In Public Beta (2015)

To be informed about new articles on IProgrammer,sign up for ourweekly newsletter,subscribe to theRSSfeedandfollow us on Twitter,Facebook orLinkedin.

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info

See the rest here:
Let's Encrypt Awarded the Levchin Prize - iProgrammer

A bill authored by Sen. Josh Becker, D-Menlo Park, that would require law enforcement agencies throughout California to find alternatives to encrypting their radio communications cleared its first hurdle Tuesday when the Senate Public Safety Committee voted to advance the legislation.

Becker's legislation, Senate Bill 1000, responds to a recent trend of police departments throughout the state moving to encrypted radio communications, a switch that makes it impossible for journalists and other residents to monitor police activities. Palo Alto, which switched to an encrypted channel in January 2021, was among the early adopters. Almost every other police department in Santa Clara County has since made the switch.

Becker's bill aims to reverse the trend and force law enforcement agencies to find alternatives to encrypted radios. If approved by the Legislature and signed into law, police departments would have to adopt policies that allow radio communications to be monitored while protecting personally identifiable information such as Social Security numbers, driver's license numbers and criminal records of individuals.

Like other departments, Palo Alto police said their switch to encryption was prompted by an October 2020 directive from the state Department of Justice requiring all police agencies that rely on the California Law Enforcement Telecommunications System (CLETS), a database used by law enforcement agencies across the state, to protect personal information. Under the directive, agencies were allowed to do so either by encrypting their radio communications or by adopting policies that protect the personal information, which could mean relaying this information by cellphone, computer or other means.

At a hearing Monday, Becker said that his bill is consistent with that order because it will require law enforcement agencies to protect personally identifiable information, as required by the Department of Justice. He argued, however, that full encryption is both unnecessary and harmful when it comes to protecting the residents' right to know what is happening in their communities.

"For 70-plus years, news outlets, journalists and the public have had access to this information, and it's critically important for transparency and accountability and for reporting public safety activities to the public," Becker said.

The committee voted 4-1 to advance the bill, with only state Sen. Rosilicie Ochoa Bogh, R-Yucaipa, dissenting. While she said she agreed with Becker that journalists play an important role in society, she argued that many police departments had already spent significant funds on encryption technology. Switching back would be "extremely costly and difficult for our police department to implement," she said.

She also argued that making police communication available to the public would allow "nefarious actors" to track police activities.

Other committee members Chair Steven Bradford and Sens. Sydney Kamlager, Nancy Skinner and Scott Wiener all supported the Becker bill, which will next go to the Senate Appropriations Committee.

Jennifer Seelig, director of news and programming at KCBS and board member at the Radio Television Digital News Association, testified on Monday that having access to the police scanner is critical for news organizations.

"We need to know what first responders are doing in real time," Seelig said. "The decision by a number of law enforcement agencies to fully encrypt communication greatly limits the ability of journalists to serve the public."

Excerpt from:
Becker bill to remove police radio encryption picks up support - The Almanac Online