According to media reports, British Home Secretary Priti Patel is backing a new ad campaign that will accuse Facebook of blindfolding police investigations into child sex abuse.

What has Facebook done to warrant the attention? It has introduced the option for Facebook Messenger calls and video chats to be end-to-end encrypted just like Facebook Messenger text chats have been since 2016

and just like the chats you have on Signal, Wire, and FaceTime are too.

Priti Patel is just the latest in a long line of British politicians to rail against encrypted messaging, arguing that it makes it harder for the police and intelligence agencies to catch paedophiles, drug barons, and terrorists.

Patels predecessors have even tried to argue that real people dont want secure communications.

But if you weaken end-to-end encrypted messaging by creating backdoors for intelligence agencies or police to monitor communications, you dont make life less safe for the criminals. You make it less safe for everyone.

Indeed, all a criminal would do is use another service that does provide end-to-end encryption, or create their own service beyond the reach of the authorities and impervious to any ad campaign backed by Priti Patel.

Encryption isnt a bad thing, its a good thing. Encryption protects our privacy from hackers and organised criminals. It defends our bank accounts, our shopping, our identities. It saves the lives of human rights activists working against oppressive regimes.

Journalist James Ball summed up in a tweet the idiocy of being anti-encryption:

We shouldnt be looking for ways to weaken or outlaw encrypted communications. If anything, we should be encouraging their wider use.

Im no fan of Facebook. I think it is, in many ways, ghastly. But I welcome anything they do to harden the security and privacy of their users.

Found this article interesting? Follow Graham Cluley on Twitter to read more of the exclusive content we post.

Graham Cluley is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s when he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows. Now an independent security analyst, he regularly makes media appearances and is an international public speaker on the topic of computer security, hackers, and online privacy.Follow him on Twitter at @gcluley, or drop him an email.

More:
Priti Patel backs ad campaign that criticises Facebook's stance on end-to-end encryption - Graham Cluley Security News

Editors Note: Weekly Cybersecurity is a weekly version of POLITICO Pros daily Cybersecurity policy newsletter, Morning Cybersecurity. POLITICO Pro is a policy intelligence platform that combines the news you need with tools you can use to take action on the days biggest stories. Act on the news with POLITICO Pro.

MC has your first look at the Biden administrations new plan for protecting the government with zero-trust networking.

Two Senate committees will have to iron out their differences on cyber incident reporting soon if they want to hitch a ride on a must-pass bill.

The Biden administration and the European Union are making plans to tackle challenges posed by encryption.

HAPPY TUESDAY, and welcome back to Morning Cybersecurity! If youre reading this message, it means that we got through the long Labor Day weekend without any devastating cyberattacks. Maybe everyone really listened to Anne Neuberger after all. Sam will be back tomorrow, so send your thoughts, feedback and especially tips to [emailprotected]. Follow @POLITICOPro and @MorningCybersec. Full team contact info below.

FIRST IN MC: DONT TRUST, VERIFY The White House this morning is releasing for public comment a draft version of its strategy for implementing zero trust principles across federal networks. The Biden administration sees zero-trust networking in which a computer system is designed with the assumption that hackers have already gained access and must be constantly challenged and impeded as key to its security overhaul of decades-old networks, and its new strategy will require a raft of actions to lock down software applications, limit users access to data and protect network traffic from prying eyes.

Among the 18 steps required by the end of fiscal 2024: Every agency will have to use one single sign-on service to let employees access all of its applications; ditch multi-factor authentication systems such as codes delivered by text message that are susceptible to phishing attacks; and eliminate archaic password policies requiring special characters and regular password changes. Theyll also have to encrypt all internal traffic and develop plans to segment their networks so that hackers cant easily slip from one application to another. And theyll have to make one internal system securely accessible from the internet to reduce the use of VPNs.

Along with the draft zero-trust strategy, CISA is also releasing a maturity model that provides a roadmap for agencies implementation of zero-trust policies, as well as a guidance document to help agencies securely migrate their applications to the cloud.

The zero-trust plan is part of President Joe Bidens cyber executive order, which also launched several other initiatives that have impending due dates. By Thursday, for example, agencies must submit progress reports on their rollout of multi-factor authentication and encryption. CISA has until Thursday to develop a cyber incident response playbook that every agency can use. And DHS and OMB have until Thursday to set up procedures to ensure that contractors report cyber incidents to the appropriate agencies.

SENATE SHOWDOWN As Congress summer recess nears its end, lawmakers face a big question: How will they reach agreement on the best way to require companies to report hacks? And more specifically, what will happen to the Senate Intelligence Committees cyber incident reporting bill now that the Senate and House homeland security panels have teamed up on more industry-friendly legislation?

Senate Intelligences bill differs widely from the Senate Homeland measure that yours truly scooped last week, especially in terms of its minimum reporting timeframe, the types of companies covered and the punishments for noncompliant companies. In letters to Congress and at last weeks hearing, industry groups criticized the Intelligence bills provisions.

There is strong industry support for the House and Senate Homeland bills approach, said Ron Bushar, an executive at the cyber firm FireEye who testified on the House bill last week. And Senate Homeland has another advantage over Senate Intelligence it has jurisdiction over any reporting bill, so it will play a significant role in shaping whatever legislation emerges. FireEye CEO Kevin Mandia will meet with Senate Homeland Security Chair Gary Peters (D-Mich.) on Wednesday, according to Stacy OMara, the companys director of government affairs.

But the Senate Intelligence bill has powerful sponsors, including perennial swing vote Susan Collins (R-Maine) and committee chair Mark Warner (D-Va.), an influential voice on national security. Warner and his colleagues are still revising their bill, and his office says its having productive meetings with interested parties.

The homeland-security panels are collaborating closely on their bills, according to an aide for the House panel. And Senate Homeland Security ranking member Rob Portman (R-Ohio) has been talking to the Senate Intelligence bills sponsors, a Senate aide said. Both aides requested anonymity to discuss legislative negotiations.

Its critical for Congress to listen to industry stakeholders and ensure whats written into law in Washington makes sense practically when implemented in the real world, House Homeland Security ranking member Andrew Garbarino (R-N.Y.) told MC.

Homeland and Intelligence face a tight deadline to resolve their differences. Multiple people tracking the process said the best hope for incident reporting legislation was to attach it to the fiscal 2022 defense policy bill, which is being marked up now. Senate Homelands outreach to industry included a request for feedback by Sept. 14.

Another reason to hurry is that implementation will take a while. You're looking at a minimum of half a year anyway between passage of a bill and standup of a reporting platform, Bushar said. The longer you delay the bill, the more time it takes before you can have a regime in place that can actually start to have an impact.

BOTH FORMS OF CRYPTO The Biden administration and the European Union have recommitted to collaboratively seeking a solution to the encryption debate, a top EU official told MC, suggesting that while this policy challenge has simmered under the surface for several years, its still top of mind for policymakers behind closed doors.

Encryption is important, but we have to always avoid a black-or-white discussion, EU Home Affairs Commissioner Ylva Johansson said in an interview after meetings in Washington with DHS Secretary Alejandro Mayorkas and Attorney General Merrick Garland. It's not like we should protect privacy or protect vulnerable children. We need to do both.

Johansson, who discussed encryption with Garland, said that while the attorney general didnt reveal the Biden administrations agenda for resolving the long-running crypto wars, the EU and the U.S. are very much close to each other on these issues. Both leaders, she said, agreed that tech companies need to take their responsibility to develop proper technical solutions for this.

Apple has received withering criticism from security experts over a proposal to identify child sexual abuse imagery on its customers phones. On Friday, the company said it was pausing the rollout of that feature to collect input and make improvements. Speaking before that news broke, Johansson applauded the companys effort. Apples solution might not be the perfect one, she said, but I welcome a company that really tries to find a balanced approach protecting both privacy and children.

Johansson and her U.S. counterparts also agreed on the scope for a common working group on ransomware, she said. The new group will focus on investigative cooperation, tracing ransom payments (which Johansson identified as a particular priority) and building digital resilience against hackers. The group will present its initial report at the next EU-U.S. Ministerial Meeting on Justice and Home Affairs later this year.

STILL EVADING The U.S. government continues to brush off suggestions that it was involved in firewall maker Juniper Networks use of an encryption algorithm backdoored by the NSA, despite a Bloomberg story saying the Pentagon leaned on the company to adopt the code. Asked about Bloombergs reporting during Thursdays White House press briefing, Anne Neuberger, the deputy national security adviser for cyber and emerging technology, described the Juniper/NSA saga as an old story thats been reported, and I think weve continuously noted that there isnt substantiation for it.

Security experts first proposed a link between the NSA and the backdoored Juniper code in 2015, several months after the company announced that sophisticated hackers had breached its systems by modifying that code. But until last weeks Bloomberg story, it remained unclear why Juniper had used the widely criticized code in the first place. NIST told companies to stop using it in 2014, one year after leaked documents revealed that the NSA had secretly tampered with it and paid a leading vendor $10 million to use it.

During MCs break, yours truly conducted the first in-depth interview with inaugural National Cyber Director Chris Inglis. Pros can read the story about his priorities and the full Q&A. He also revealed that the Biden administration is pushing Microsoft to make full log data free for all customers.

University of California, Berkeley computer science professor Nicholas Weaver with some real talk: The Ivermectin of Computer Science is Blockchain

How Kuwait punished a security expert for revealing a major banks embarrassing hack. (CyberScoop)

Nextgov interviewed Allan Friedman, the man behind the governments software bill of materials campaign, as he moves from NTIA to CISA to bring SBOMs to life.

The Justice Department launched a cyber fellowship program for prosecutors.

NIST wants feedback on its proposed criteria for an internet of things security labeling program.

Chat soon.

Stay in touch with the whole team: Eric Geller ([emailprotected]); Bob King ([emailprotected]); Sam Sabin ([emailprotected]); and Heidi Vogt ([emailprotected]).

Visit link:
EXCLUSIVE: What's in the new zero-trust strategy - Politico

Apple is a company that has always made much of its commitment to privacy, and has succeeded in turning it into a unique selling point of its products. That proud history made a recent announcement all the more shocking. Nobody could deny that Apples Expanded Protections for Children are motivated by the best intentions, and are tackling a terrible problem. But as commentator after commentator pointed out, in this case, in its eagerness to come up with new ways of protecting children from harmful content and online predators, Apple seems to have missed the bigger picture.

There are three elements to the Apples new initiative. One updates to Siri and Search provide parents and children expanded information and help if they encounter unsafe situations is unproblematic. The other two are not. Heres what Apple intends to do to ensure communication safety in Messages:

The Messages app will add new tools to warn children and their parents when receiving or sending sexually explicit photos.

When receiving this type of content, the photo will be blurred and the child will be warned, presented with helpful resources, and reassured it is okay if they do not want to view this photo. As an additional precaution, the child can also be told that, to make sure they are safe, their parents will get a message if they do view it. Similar protections are available if a child attempts to send sexually explicit photos. The child will be warned before the photo is sent, and the parents can receive a message if the child chooses to send it.

As over 90 organizations wrote in an open letter to Apples CEO, the problem here is that this assumes a benevolent relationship between parents and child. Clearly, thats not always true, in which case Apples new alert system could enhance the abusive power of adults over a child. LGBTQ+ youths on family accounts with unsympathetic parents are particularly at risk, the letter pointed out. But it is the third element that has rightly caused most concern in privacy and security circles. It tries to address undoubtedly one of the worst problems online today: the spread of Child Sexual Abuse Material (CSAM). Apple wants to detect CSAM images stored in iCloud Photos. Heres how:

Apples method of detecting known CSAM is designed with user privacy in mind. Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC [National Center for Missing and Exploited Children] and other child safety organizations. Apple further transforms this database into an unreadable set of hashes that is securely stored on users devices.

To its credit, Apple has built in a number of features designed to ensure that the company does not know anything about the images that apparently match, unless a certain threshold number of matches is reached. At this point Apple will then manually review each match, and if confirmed, disable the users account and send a report to the NCMEC. The company has provided a more detailed technical summary of the process.

However, a FAQ reveals some serious flaws in the approach. First, the new technology only applies to photos stored in iCloud Photos. This means people can avoid scrutiny quite easily: When iCloud Photos is deactivated, no images are processed. CSAM detection is applied only as part of the process for storing images in iCloud Photos. Another problem is the following: The system uses image hashes that are based on images acquired and validated to be CSAM by at least two child safety organizations. It is not designed for images that contain child nudity that are not known CSAM images. This could have the terrible effect of encouraging pedophiles to create new abusive images, rather than sharing old ones. Apples approach to fighting CSAM might actually make things worse.

The biggest problem concerns how Apple has implemented its idea. The approach discussed above involves client-side scanning of images to detect CSAM. This will happen whether or not the phones user wishes it. In other words, for the first time, Apple is explicitly taking control of peoples phones, which are therefore no longer truly theirs.

This is an incredibly shortsighted move, for reasons that top experts like Edward Snowden, Bruce Schneier, and the EFF have been quick to point out. One of the most important battles being fought in the world of privacy is the attempt by governments around the world to gain access to end-to-end encrypted communications using backdoors. As they have been repeatedly told, this is not possible without undermining the security of encryption. But there is a different way to gain access to the contents of encrypted communications to spy on them before they are encrypted. That is precisely what Apple proposes with its new plans.

By presenting client-side surveillance in a positive light, Apple has just given permission for every government to demand the same approach to be applied outside CSAM. Apple tries to address that point in its FAQ: Apple would refuse such demands and our system has been designed to prevent that from happening. This is an extraordinarily naive statement. How will a company even a trillion-dollar company be able to refuse such a demand from repressive authoritarian states like China, or intrusive democratic ones like the UK? It will clearly be a matter of comply or stop selling products in that country.

Even if Apple backtracks on its plans, the first signs of which have already appeared, it may be too late. Politicians who understand little about the finer points of technology will simply say to every online service operating in their country: See? Apple has found a way to scan for illegal material while preserving encrypted communications just do the same for us voluntarily, or we will pass a law making it compulsory.

Featured image by Sally V.

Original post:
Apple Has Betrayed Its Privacy Legacy and Will Undermine End-to-end Encryption Everywhere - Privacy News Online

Enterprise adoption of multiple cloud platforms continues in earnest, whether its aimed at improving collaboration, reducing data center footprint, increasing customer response times, or any number of other business goals. As organizations advance their multi-cloud strategies, they are tasked with applying consistent security configurations across workloads and applications. They must also implement data protection that addresses todays threat vectors and aligns with stringent compliance and audit requirements.

Encrypting cloud data is essential to protecting sensitive information and workloads but it needs to be done correctly to be effective and meet compliance mandates. A recent report from Forrester, Best Practices: Cloud Data Encryption, articulates several important recommendations, notably:

These security measures are critical to protecting your cloud data and workloads, and its vital to get them right from the outset.

Multi-cloud computing is here to stay and so are the complexities associated with protecting your data and workloads.

Administrative challenges of managing cloud environments

While cloud service providers continue to enhance their built-in security capabilities, the teams tasked with managing cloud environments face a constant battle to fine-tune their configurations and permissions. As exemplified by numerous data breaches over the past few years, misconfigured cloud storage settings are a common, yet often unidentified, trouble spot.

Each cloud platform is unique and, even if you manage to get a handle on who has access to which data and workloads, keeping up with providers updates and new controls requires constant vigilance. And as the shortage of skilled security professional persists including those with expertise working across multiple cloud platforms these challenges arent going away.

Demonstrating compliance

Identifying and implementing the right security controls is one challenge, while demonstrating compliance with data privacy regulations and industry mandates is another. Security teams cite specific concerns about being able to verify controls and how to report compliance in an auditor-approved format.

As compliance and audit requirements continue to get more stringent, nearly every enterprise is now subject to at least one mandate that calls for the use of data encryption. And as the Forrester report discusses, data encryption is a must-have for cloud workloads. This necessary security measure comes with its own administrative upkeep that can be difficult to handle without the right tools in place.

Cloud data encryption: Getting it right

Workloads go through many lifecycles, from staging to deployment to backup, and eventually have to be securely decommissioned. Each stage poses different risks of potential data theft or other misuse. Managing workload encryption from each clouds management platform is complex and further increases the risk of inconsistent policies and mistakes.

Additionally, an encryption strategy that aligns with compliance mandates requires robust key management. Unfortunately, key management is not universal across cloud platforms so the security team must contend with key storage, distribution, rotation, and revocation in multiple environments.

Whats more, when encryption keys are not completely separated from the workloads and data they protect, the potential exists for a security incident that compromises both, leaving data exposed to a breach. Best practices call for the use of certified HSMs to protect your encryption keys.

Entrust can help

Entrust offers a robust set of security solutions to help you protect workloads and data across your multi-cloud infrastructure, including enhanced protection of your encryption keys that supports compliance with data privacy mandates.

The post The adoption of multi-cloud drives the need for better data protection and management of encryption keys and policy controls appeared first on Entrust Blog.

*** This is a Security Bloggers Network syndicated blog from Entrust Blog authored by Jim Delorenzo. Read the original post at: https://blog2.entrust.com/blog/2021/08/the-adoption-of-multi-cloud-drives-the-need-for-better-data-protection-and-management-of-encryption-keys-and-policy-controls/

View post:
The adoption of multi-cloud drives the need for better data protection and management of encryption keys an... - Security Boulevard

In the face of identity theft, online threats related to viruses and other ransomware, it is important to protect your personal data on your computer. The most effective way to do this is to encrypt the data, which is easy to do on both Windows and MacOS.

Data encryption: essential...

Encrypting your data is essential if you dont want a third party to get their hands on it. Hackers can indeed copy your data and even block access to it remotely. And keep in mind that even data that has been deleted can be recovered by ill-intentioned people.

Whether its sensitive (administrative documents, medical files, private photos, etc) or not, data must be encrypted to prevent it from falling into the wrong hands one day. A properly encrypted hard disk is completely unreadable by anyone who does not have the decryption key, usually the administrators password. Once encrypted, the data becomes truly private and cannot be read properly.

... and easy!

Encrypting your computer is relatively simple, whether you have a PC running Windows or a Mac running macOS. If not proposed by default, encryption is relatively simple to activate on a recent machine.

Under Windows, you have to connect to your Windows administrator account then go to the Settings of your computer. Then you have to select Update & Security and activate Device encryption. If this feature does not appear, you have to type Manage BitLocker in the search field of the taskbar, open it, then Enable BitLocker.

On a Mac, you need to go to System Preferences and then go to the FireVault tab in Security & Privacy. To activate this option, click on the lock icon and enter your administrator name and password. From then on, the encryption operation will take place in the background, without the user noticing anything. Note that Apple provides you with a backup key if you ever lose your password.

Check out our other tips on how to choose the right password, boost your WiFi connection and secure your connected devices. AFP Relaxnews

See the original post:
Why you should encrypt your data on your computer and how to do it - The Star Online