Category Archives: Encryption
Why BYOD Is the Favored Ransomware Backdoor – eSecurity Planet
eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
When remote workers connect bring-your-own-device (BYOD) laptops, desktops, tablets, and phones to corporate assets, risk dramatically increases. These devices exist outside of direct corporate management and provide a ransomware gang with unchecked platforms for encrypting data.
Ransomware remains just one of many different threats and as security teams eliminate key vectors of attack, adversaries will shift tactics. Of course, to cause that shift in tactics, first make sure to eliminate the easy access that these ransomware gangs currently enjoy.
Microsofts fourth annual Digital Defense Report for 2023 reveals that 80% of all ransomware compromises come from unmanaged devices and that 60% of those attacks use remote encryption. Naturally, this leads to three important questions: What are unmanaged devices? How does remote encryption work? Which unmanaged devices do attackers use?
Unmanaged devices consist of any device that connects to the network, cloud resources, or other assets without corporate-controlled security. Greg Fitzerald, co-founder of Sevco Security, disclosed to eSecurity Planet that their recent State of the Cybersecurity Attack Surface research found 11% of all IT assets are missing endpoint protection.
Some of this 11% includes the common and recurring problem of overlooked legacy endpoints such as laptops, desktops, and mobile devices. This category also includes routers, switches, and Internet of Things (IoT) devices that cant install traditional endpoint protection such as antivirus (AV) or endpoint detection and response (EDR) solutions.
BYOD devices deliver another significant source of unmanaged devices unique to our post-pandemic working environment as many remote workers connect to corporate resources using their own devices. According to the National Bureau of Economic Research, 42.8% of American employees work from home part- or full-time, which places an enormous burden on security teams to secure access across a variety of controlled and uncontrolled assets.
Remote encryption performs ransomware encryption on a device beyond the security solutions monitoring for malicious activity. Installed antivirus, EDR, extended detection and response (XDR), intrusion prevention systems (IPS), and next generation firewalls (NGFW) monitor endpoints and networks for signs of malicious activity especially types of ransomware.
As endpoint security improved, attackers realized that these security solutions only work in two conditions. Either the ransomware protection must be installed on an endpoint, or the indicators of compromise for ransomware must flow through a monitoring solution (NGFW, IPS, etc.).
Unmanaged endpoints lack installed protections and ransomware file exfiltration and replacement mimics normal data access traffic between the unmanaged endpoint and the network data resource. The Sophos X-Ops team highlighted the issue in a recent blog, which details how remote encryption evades multiple layers of network security.
Attackers probably use BYOD and the research indirectly supports this. Ransomware attackers seek access to devices with sufficient local memory to perform resource-intensive encryption.
The US Cybersecurity and Infrastructure Security Agency (CISA) estimated that 90% of all successful attacks begin with phishing, which points at users devices instead of routers, IoT, and other types of unmanaged endpoints. While attackers often navigate laterally, network devices and IoT also lack the available memory to be common platforms for high volume encryption.
The best practice for security software installation starts with the primary user devices. Users typically dont use old and slow legacy devices to check email and those devices typically lack the computing power that attackers need to perform remote encryption. Therefore, BYOD remains the most likely source for remote encryption.
To block ransomware operating on unmanaged sources, eliminate unmanaged connections or detect and block the file extraction and replacement processes. Various tools can be used for the key steps in these processes: add managed connections for BYOD devices, monitor data traffic and sources, and eliminate unmanaged corporate assets.
Add managed connections to BYOD devices to prevent completely unmonitored and unmanaged connections. Firewalls often implicitly trust virtual private network (VPN) connections and remote desktop (RD) connections, so instead choose a security solution that explicitly extends security to encompass BYOD, such as the following:
These solutions provide both indirect and direct control over BYOD devices without the need to install endpoint protections directly on the BYOD devices.
Monitor data traffic and data sources to detect the ransomware file access and replacement. Basic VPN and IPS focus on the connections between internal resources and external threats, which ignores network devices or trusted VPN connections.
However, file access and replacement generates high traffic volume that triggers detection in newer security solutions, such as the following:
Anomaly detection, often enhanced using artificial intelligence, can both improve detection and block activity, but only when traffic routes through these devices.
Additionally, some endpoint protection solutions offer file monitoring features, such as Sophos CryptoGuard, that track the status of each file on the endpoint. Instead of attempting to detect and block malicious activity, these tools monitor file integrity and detect when encrypted files replace unencrypted files.
These advanced tools can allow legitimate local encryption. However, when the security tool cant view the entire process (e.g., remote encryption), the endpoint protection blocks the remote IP address and rolls back the file to its original, unencrypted state.
Locate unmanaged corporate devices and then either add controls or tightly restrict access to and from those devices through tools such as the following:
Although BYOD may pose a more likely risk, asset control remains fundamental to security and the risk posed by the 11% of unmanaged devices must be addressed.
Attackers eagerly exploit unmanaged devices to perform remote ransomware encryption out of the sight of otherwise-effective security tools. Every organization without effective asset discovery risks unmanaged assets within the network, but BYOD introduces the more likely risk, at least today, for both ransomware attacks and remote encryption.
Fortunately, managed connections and monitored data can meet these challenges and provide effective protection for todays most pressing threats as well as going forward as attackers change tactics. Control BYOD risks now to improve visibility and make ransomware gangs work harder to execute their attacks.
For a more comprehensive solution for access and data control, consider a zero trust security solution that performs continuous monitoring and verification.
Original post:
Why BYOD Is the Favored Ransomware Backdoor - eSecurity Planet
Qrypt’s quantum encryption joins NVIDIA’s startup nurturing hub – SecurityBrief New Zealand
Qrypt, a quantum-secure encryption company that eliminates key transmission, has been accepted into the prestigious NVIDIA Inception program.
The program is a hub for startups focused on revolutionising sectors through technological innovations. Qrypt states this membership will significantly bolster the comapny's mission to secure the AI industry and safeguard its invaluable data assets against emerging quantum threats.
As AI, particularly generative AI and large language models, continue to advance, data repositories have become increasingly precious. As such, there is an urgent requirement to ensure that such valuable data remains secure while in transit, as these technologies depend on multiple data sources.
This pressing concern is magnified due to the imminent quantum threat and the practice of 'harvest now, decrypt later'. Perpetrators store encrypted data at present, intending to decrypt it later with the advanced powers of quantum computers.
As a member of NVIDIA Inception, Qrypt is equipped to enhance data security against such immediate and pending hazards, employing quantum-secure encryption technology to defend against vulnerabilities of the 'harvest now, decrypt later' nature.
Denis Mandich, chief technology officer and co-founder of Qrypt, stated that, "Quantum computing will eventually break all the classical encryption technologies used in data transport, and potentially most of the post-quantum cryptography algorithms under review for standardisation, putting every data asset at risk of being compromised."
He further added, "Qrypt's quantum entropy sources generate perfect keys simultaneously at multiple endpoints to enable end-to-end encryption without key distribution, eliminating the risk of 'harvest now, decrypt later'. By leveraging the benefits provided through NVIDIA Inception, we can secure the AI industry and its valuable data assets against the quantum threat today."
NVIDIA Inception primarily assists startups in critical stages of product development, prototyping, and deployment. Membership comes with a customised set of continuous perks, including credits through the NVIDIA Deep Learning Institute, preferred pricing on NVIDIAs hardware and software, and technical assistance.
This suite of resources provides startups with the fundamental tools for growth. By availing of the resources offered through the program, Qrypt can support its swift growth and product innovation, positioning itself as a critical security partner for the AI industry.
Qrypt states it is focused on advancing data security with its peer-reviewed encryption technology. Its protection against the quantum threat incorporates the seamless integration of quantum entropy hardware with cryptographic key generation software. Qrypt guarantees data privacy and is available as a service, on-premises, or on any device.
Read this article:
Qrypt's quantum encryption joins NVIDIA's startup nurturing hub - SecurityBrief New Zealand
NYPD faces backlash as it prepares to encrypt radio communications – The Guardian US
New York
Critics say encryption is an attack on transparency, and that radio monitoring is one of the few ways to keep track of the police
The New York police department (NYPD) is facing serious backlash after announcing additional details about its plan to encrypt its radio communications system, which experts warn will limit transparency and accountability.
NYPD radio signals have been publicly accessible since 1932, allowing journalists and civilians to listen to police communications, Gothamist reported. The NYPD will now be encrypting its radio channels for the first time ever. Police radio encryption is already underway in several US cities, including Chicago and Denver.
Since starting in July, 10 precincts have already gone dark, or fully encrypted their radio systems. The entire upgrade to a new, encrypted radio system will be completed by December 2024 and cost an estimated $400m, a hefty price tag as several city agencies have been forced to swallow major budget cuts.
Critics of encryption say that the public radio channels are necessary for police accountability, press freedom and public safety.
Albert Fox Cahn, the executive director of the Surveillance Technology Oversight Project (Stop), a New York-based civil rights organization, called planned encryption a disturbing attack on transparency and public oversight of the police.
Radio monitoring is one of the few ways that we can get an unfiltered look at how the NYPD is policing, Cahn said.
Several police-involved killings have been uncovered by the press after listening to police radios, Cahn said. Video of an NYPD officer killing Eric Garner in 2014 was obtained due to a call on the police radio, Gothamist reported. The police killings of Amadou Diallo in 1999 and Sean Bell in 2006 were also uncovered due to police radio communications.
Without public radio, we will simply be at the mercy of police to tell us when they killed someone. Therell be no one else who knows, Cahn said.
Press freedom advocates have also argued that encrypting police radios will prevent journalists from accurately reporting or covering police misconduct, ultimately allowing the NYPD to decide what should be considered news.
Todd Maisel, founder of New York Media Consortium, a group of eight media organizations against radio encryption, says: Having the NYPD controlling the narrative is the worst possible scenario.
Theyre not going to tell you stories about anything that didnt go well, he added.
Public access to radio is also necessary to keep the public safe during citywide emergencies and major events.
Maisel said that during Hurricane Sandy in 2012, when more than 200 people died, he was able to provide public safety updates on social media by listening to the police radio.
The NYPD will put out a tweet or an email when they feel like it, Maisel said, referring to the NYPDs lackluster communication with the public.
Daniel Schwarz, senior privacy and technology strategist with the New York Civil Liberties Union, said access to police radio also kept protestors safe during 2020 protests for George Floyd in New York.
[The radio] was crucial for protesters to understand how law enforcement [was] responding to their protests, and [to] sometimes avoid dangerous interactions, Schwarz said.
The NYPD has already paid out millions of dollars in settlements over its use of force against protesters.
The NYPD has argued that encrypting its radio system is necessary to prevent criminals from gaining information. The encryption plans also have support from Mayor Eric Adams, who said during a July press conference that bad guys are listening to the police radios, the New York Times reported.
But the NYPD already has the ability to encrypt tactical radio channels, Cahn said, calling the NYPDs reasons for encrypting citywide communications completely groundless.
Cahn added that police have been unable to provide concrete examples of criminals abusing the radio system, especially to justify citywide encryption.
The idea that you need to hide every aspect of [every] police deployment in the city to prevent this fever dream scenario is ludicrous, he said.
The NYPD has said during the latest hearing on encryption that it may offer access to journalists or a time-delayed access for the public. But Schwarz noted that such plans have been vague and rushed.
They started to roll out [and] it seems totally rushed without already being prepared to offer that access to members of the media or delayed broadcasts for the public, Schwarz said.
Schwarz also criticized the idea of the NYPD only granting certain members of the media access to the channel, noting that such designation could keep out media that arent seen as legitimate or that have been overly critical of the police.
Who will count as a representative of the media? What [will] that process look like, and who could potentially [be] locked out? he asked.
Cahn added that Adamss support of encryption follows a pattern of the mayor not working to keep NYPD transparent.
I really do think that we have a fundamental rule-of-law issue under Eric Adams, where the NYPD continues to be enabled to lawlessly pursue this surveillance agenda without abiding by the protections that already exist under law, Cahn said.
As of now, New York state legislators have introduced a bill that would offer members of the media a radio channel, and give the general public access to a time-delayed radio.
But critics say more must be done by the city council and other legislators to ensure that radio communications stay public, not just available to a select few.
Were dealing with human beings who are armed with guns, and wield extraordinary power with the public, Maisel said. Without checks and balances, the public is going to be at a great loss.
{{topLeft}}
{{bottomLeft}}
{{topRight}}
{{bottomRight}}
{{.}}
One-timeMonthlyAnnual
Other
Go here to see the original:
NYPD faces backlash as it prepares to encrypt radio communications - The Guardian US
Russia and China successfully test quantum communication over satellite 3800-kilometer test explores possible … – Tom’s Hardware
Following recent demos of quantum communication using undersea fiber optics, scientists from Russia and China have successfully demonstrated quantum communication over satellite, using China's quantum satellite (dubbed "Mozi"), as the two countries lay the groundwork for advanced encrypted communication networks that are safe from prying Western eyes possibly for BRICS-aligned countries.The test was conducted using the satellite from a ground station close to Moscow, Russia, to another station based near Urumqi, China, over 3,800 kilometers, according to the South China Morning Post.
The satellite used to achieve this quantum communication, Mozi (also called Micius), has been in orbit since 2016 and is managed primarily by the Chinese Academy of Science. The collaboration with Russian scientists started in 2020. Then, in March 2023, a full quantum communication experiment was conducted between two ground stations, using encryption keys from Mozi to distribute two coded messages.
The coded messages used in the March 2023 test were fairly innocuous, before you get too excited just a quote from Chinese philosopher Mozi and an equation from Soviet physicist Lev Landau. The more recent "full cycle" quantum communication test on December 14th, 2023, also used a few (presumably harmless) quantum key-encoded images.
For those unfamiliar, "quantum communication" refers to communication using "qubits". Qubits, like traditional "bits," can contain binary information. However, qubits are also incredibly fragile to outside interference, which means that it's very easy for a quantum computer to tell if qubits have been intercepted or interfered with in some way.
Quantum communications are in theory, at least the most secure possible form of data transmission, exploiting quantum mechanics to be unbreakable without detection. The main drawbacks are the limited adoption/evolution of quantum computing and fundamental range weaknesses in current qubit transmission technologies reportedly about 1,000 kilometers due to photon loss over long-distance wiring.
While we can freely send regular old bits or bytes worldwide, it's much harder to do that with more fragile qubits since they're generally more prone to degradation. Advancements like this (satellites boost the effective range by as much as 3,800 kilometers) may start pushing us closer to a future of quantum communication networks, though, since international ranges are now clearly within the range of possibility.
However, the communication test was ultimately just two regular old static images. How well quantum communication may fare in real-time video calling isn't currently known. However, a 2017 voice calling test was done between China and Austria, which could make high-bandwidth quantum communication feasible one day.
While quantum communications finally being achievable over undersea fiber optics and satellite communications is impressive, it isn't likely to become a dominant form of communication for any consumer, business, or state for quite some time. The rapidly approaching future of quantum computing may still be full of surprises, though, so who knows?
Alexey Fedorov of Russia's National University of Science and Technology and the Russian Quantum Center states, "Quantum communication networks could have many uses, but for now, quantum systems would ideally be suited to scientific research."
While the technology is developing, it still seems there will be some time before it's used on a large scale for any real purpose. But Fedorov did speak of interest in quantum computing from the Russian finance sector and even alluded to the possibility of a quantum communication network between BRICS nations (Brazil, Russia, India, China, and South Africa) in the future.
Quantum Quandary: Navigating the Path to Unbreakable Encryption – Security Boulevard
The rise of quantum computing presents a profound challenge to data security. Termed Q-Day, the point at which quantum computers could break existing encryption algorithms looms on the horizon. This quantum threat, now considered imminent rather than distant, necessitates a strategic shift towards quantum-safe solutions.
Quantum computing, with its potential to unravel established encryption standards, poses a dual dilemma. Grovers algorithm targets symmetric key cryptosystems, while Shors algorithm jeopardizes public key cryptosystems. The quantum threat extends beyond theoretical frameworks, as threat actors exploit quantum capabilities in harvest now, decrypt later attacks.
Governments and the tech industry collaborate on initiatives to usher in post-quantum cryptography (PQC), a quantum-resistant alternative. PQC algorithms, grounded in lattice problems and codes, offer resilience against quantum attacks. The US National Institute of Standards and Technology (NIST) plays a pivotal role, outlining draft PQC standards expected to become global benchmarks in 2024.
Preparing for the quantum threat demands a proactive approach. Large organizations are urged to identify priority systems, assess their susceptibility, and initiate an incremental transition to PQC for key exchange. The deployment of cryptographic agility, incorporating both traditional and PQC algorithms, emerges as a pragmatic strategy. However, transitioning to full PQC requires meticulous planning, considering security risks and potential business continuity disruptions.
NIST and the UK National Cyber Security Centre (NCSC) guide the way with evolving standards for quantum-safe cryptography. The UK emphasizes a wait-and-watch approach, endorsing quantum-safe solutions once standardized and interoperable algorithms emerge. Legislation and guidelines further reinforce the urgency of preparing for a quantum-safe future.
Key players like SSH Communications Security contribute to the quantum-safe journey. Their NQX solution and accompanying tools facilitate a seamless transition, ensuring critical data remains protected during the shift to quantum-safe cryptography.
As the quantum threat inches closer, businesses stand at a crossroads. Adapting to post-quantum cryptography is a technological upgrade and a strategic imperative. The roadmap involves embracing PQC, understanding global standards, and integrating quantum-safe technologies. Safeguarding the digital future hinges on navigating the quantum threat landscape with foresight and agility, ensuring data security endures the quantum revolution.
The post Quantum Quandary: Navigating the Path to Unbreakable Encryption appeared first on Centraleyes.
*** This is a Security Bloggers Network syndicated blog from Centraleyes authored by Rebecca Kappel. Read the original post at: https://www.centraleyes.com/quantum-quandary-navigating-the-path-to-unbreakable-encryption/
See the article here:
Quantum Quandary: Navigating the Path to Unbreakable Encryption - Security Boulevard
Fighting European Threats to Encryption: 2023 Year in Review – EFF
Private communication is a fundamental human right. In the online world, the best tool we have to defend this right is end-to-end encryption. Yet throughout 2023, politicians across Europe attempted to undermine encryption, seeking to access and scan our private messages and pictures.
But we pushed back in the EU, and so far, weve succeeded. EFF spent this year fighting hard against an EU proposal (text) that, if it became law, would have been a disaster for online privacy in the EU and throughout the world. In the name of fighting online child abuse, the European Commission, the EUs executive body, put forward a draft bill that would allow EU authorities to compel online services to scan user data and check it against law enforcement databases. The proposal would have pressured online services to abandon end-to-end encryption. The Commission even suggested using AI to rifle through peoples text messages, leading some opponents to call the proposal chat control.
EFF has been opposed to this proposal since it was unveiled last year. We joined together with EU allies and urged people to sign the Dont Scan Me petition. We lobbied EU lawmakers and urged them to protect their constituents human right to have a private conversationbacked up by strong encryption.
Our message broke through. In November, a key EU committee adopted a position that bars mass scanning of messages and protects end-to-end encryption. It also bars mandatory age verification, which would have amounted to a mandate to show ID before you get online; age verification can erode a free and anonymous internet for both kids and adults.
Well continue to monitor the EU proposal as attention shifts to the Council of the EU, the second decision-making body of the EU. Despite several Member States still supporting widespread surveillance of citizens, there are promising signs that such a measure wont get majority support in the Council.
Make no mistakethe hard-fought compromise in the European Parliament is a big victory for EFF and our supporters. The governments of the world should understand clearly: mass scanning of peoples messages is wrong, and at odds with human rights.
EFF also opposed the U.K.s Online Safety Bill (OSB), which passed and became the Online Safety Act (OSA) this October, after more than four years on the British legislative agenda. The stated goal of the OSB was to make the U.K. the worlds safest place to use the internet, but the bills more than 260 pages actually outline a variety of ways to undermine our privacy and speech.
The OSA requires platforms to take action to prevent individuals from encountering certain illegal content, which will likely mandate the use of intrusive scanning systems. Even worse, it empowers the British government, in certain situations, to demand that online platforms use government-approved software to scan for illegal content. The U.K. government said that content will only be scanned to check for specific categories of content. In one of the final OSB debates, a representative of the government noted that orders to scan user files can be issued only where technically feasible, as determined by the U.K. communications regulator, Ofcom.
But as weve said many times, there is no middle ground to content scanning and no safe backdoor if the internet is to remain free and private. Either all content is scanned and all actorsincluding authoritarian governments and rogue criminalshave access, or no one does.
Despite our opposition, working closely with civil society groups in the UK, the bill passed in September, with anti-encryption measures intact. But the story doesn't end here. The OSA remains vague about what exactly it requires of platforms and users alike. Ofcom must now take the OSA and, over the coming year, draft regulations to operationalize the legislation.
The public understands better than ever that government efforts to scan it all will always undermine encryption, and prevent us from having a safe and secure internet. EFF will monitor Ofcoms drafting of the regulation, and we will continue to hold the UK government accountable to the international and European human rights protections that they are signatories to.
Go here to see the original:
Fighting European Threats to Encryption: 2023 Year in Review - EFF
SandboxAQ Partners with Carahsoft to Expand Distribution of Cybersecurity And AI-Enabled Quantum Solutions in The … – The Quantum Insider
By Jen Sovada, President of Global Public Sector
Robert E. Williams, Head of Global Channels
Today, were announcing a partnership with Carahsoft Technology Corp., The Trusted Government IT Solutions Provider. As part of the agreement, Carahsoft will provide our modern cryptography management platform, Security Suite, and other AI and Quantum technology (AQ) solutions to the Public Sector via its existing contracts and network of resellers, integrators, and consultants. This builds on our early success with the U.S. Air Force, the Defense Information Systems Agency and the U.S. Dept. of Health & Human Services and will enable us to expand distribution of our solutions to help government agencies achieve their missions of today and the future.
Were starting with cybersecurity due to the predicted ability of fault-tolerant quantum computers to break todays public-key encryption protocols, which will put the worlds sensitive data, communications and financial transactions at risk. Adversaries have already begun acquiring and storing encrypted data for decryption by quantum computers using Store Now, Decrypt Later (SNDL) attacks. These attacks prompted President Biden to issue an Executive Order and two National Security Memoranda (NSM-8 and NSM-10) and sign the Quantum Computing Cybersecurity Preparedness Act (H.R.7535) into law.
Given the rapidly evolving cyber and quantum threats facing public sector entities, and the Presidents sweeping mandates to implement post-quantum cryptography, our partnership with Carahsoft will ensure that all federal, state and local agencies have access to a trusted, modern cryptography management solution to protect our countrys sensitive data, critical infrastructure, and national interests.
In addition to Security Suite, Carahsoft will also provide SandboxAQs Simulation & Optimization solutions, which can be used to discover and develop advanced new materials, such as more effective EV batteries or lighter, stronger metal alloys; and its quantum sensing solutions, which can be used for a broad range of biomagnetic, geophysical and materials sensing applications. Currently, the U.S. Air Force is testing SandboxAQs geomagnetic navigation system as a potential Assured Positioning, Navigation, and Timing (APNT) solution to augment the Global Positioning System (GPS).
SandboxAQ and Carahsoft will co-market these solutions via joint webinars, white papers and events, and will establish government training and upskilling courses on AI, quantum and all SandboxAQ solutions.
Carahsoft is excited to deliver SandboxAQs portfolio of cybersecurity and AI-enabled quantum solutions through our reseller partners to government, intelligence and defense agency contracts throughout the Public Sector, said Craig P. Abod, Carahsoft President. Given the size and complexity of government IT infrastructure, Security Suites ability to identify and remediate cryptographic vulnerabilities will enable the Public Sector to protect its critical systems, data and infrastructure against ever-evolving cyber threats. At the same time, SandboxAQs quantum-based solutions have tremendous potential to positively impact a broad range of government, intelligence, law enforcement, defense and health-related agencies.
Contract information for our Simulation and Sensing solutions will be available soon.
For more information, contact the Carahsoft team at (844) 445-5688 or [emailprotected]. To learn more about SandboxAQ, visit http://www.sandboxaq.com/partners
About the Authors:
Jen Sovada, President of Global Public Sector
Colonel (Ret.) Jen Sovada is the President of SandboxAQs Global Public Sector focused on Government issues at the nexus of quantum and AI. Prior to her position at SandboxAQ, she was the Chief Futures Officer and Senior Vice President / General Manager for the Intelligence Community (IC) start-up MissionTech Solutions. Jens Air Force career spanned 25 years in intelligence focused on higher-end technological capabilities where she held various positions in operational test, systems interoperability, and requirements definition. She commanded the Air Force Technical Applications Center, the DoDs sole organization responsible for nuclear treaty monitoring.
Robert E. Williams, Head of Global Channels
Robert is responsible for building out partnerships globally at SandboxAQ to increase technology adoption and service levels for its existing customers, and reach new customers. Robert has spent the last 15 years in global go-to-market leadership roles in cybersecurity, cloud, and telecom. Prior to SandboxAQ, Robert was a business development and channel executive at Palo Alto Networks, Amazon Web Services, and AT&T; his most recent role was VP of Public Sector Channels & Strategic Partnerships.
Read the original:
SandboxAQ Partners with Carahsoft to Expand Distribution of Cybersecurity And AI-Enabled Quantum Solutions in The ... - The Quantum Insider
iStorage Datashur PRO+C Encrypted Flash Drive review protecting your personal data – The Gadgeteer
We use affiliate links. If you buy something through the links on this page, we may earn a commission at no cost to you. Learn more.
REVIEW We all have data that we need to protect, data like passwords, tax information, financial investments, social security and passport numbers, security clearance information, medical and dental records, and so on. Its data that we dont want anyone else to see, and we really dont want it stolen and used for identity theft. We need that data to be stored external to our computer so that it cant be stolen via malware or held hostage with ransomware. We need this data encrypted, but we dont want to figure out the details of encryption ourselves. We need it to be stored on a gadget small enough to toss into a home safe when were out of town or into a purse if we take it with us. For this kind of data, an encrypted flash drive like the iStorage Datashur PRO+C is exactly what we need.
The iStorage Datashur PRO+C is an encrypted flash drive from iStorage. It uses USB-C to connect to the computer, a built-in keypad to enter the PIN, and automatic hardware-based encryption to protect the data. iStorage is a company that develops innovative ultra-secure portable data storage devices.
The iStorage Datashur PRO+C is a svelte little gadget. Its only slightly bigger than a normal USB stick and stands out with a bright blue color. The housing and its case are both made of aluminum, which protects from water, dust, and physical damage. The top of the drive has a numeric keypad and three small LEDs. One end has the USB-C port, and the other has a wire ring for clipping on a lanyard or keychain. The entire drive has a design that says, I mean business.
The PRO+C comes with a quick start guide that, as the name suggests, provides just enough information to get up and going. Before using the drive for the first time, I have to setup an 8 to 15-digit PIN. After inserting the gadget into a USB port the PRO+C comes with a dongle that allows me to use a USB-A if I need to I followed the instructions, which include entering this PIN twice, and it was ready to go.
Using the keypad is a bit of a pain on this device. I have to press buttons while its plugged in and do so gently so that I dont bend the port. For a personal computer like my Mac mini, this is virtually impossible, because the ports are all around back. Even for my work computer, a MacBook Pro, this is still difficult, because it sits back to one side behind my monitor. This device is easiest to use in a computer that sits near the front of your desk and has a front-facing port USB port.
To make things easier for my testing, I found a USB extension cable that I had lying around; this allowed me to bring it out front and to hold the drive in my hand while entering the PIN. If you get this drive, I highly recommend spending a few extra bucks and picking up an extension cable, whether a USB-A or a USB-C.
Once I added the cable, I found that using this drive could not be any simpler. I simply connect it to the USB port of my computer, press the key button, enter my PIN, and then press the key button again. The LEDs flash and eventually, the green one turns on, letting me know that its ready to go. At this point, the PRO+C functions just like any other flash drive. It shows up as DATASHURPPC in the sidebar of finder, and I can copy, edit, and delete all files that I want. When I am done, I click the eject icon in Finder, wait for the blue light to finish flashing, and then remove the drive. The LED blinks red to let me know everything is secure. Easy peasy.
For most home users, this is all you will ever need to know: How to setup a PIN and how to unlock and use the drive. There are a few other situations that might be handy to know, and so iStorage includes a digital copy of the user manual on the drive itself and on their website. A few examples include:
I tested all of these features and found they worked just as the manual describes. There is one very important detail: All three of these changes should be made when the drive is NOT connected to the computer. The PRO+C has an internal battery that provides the power necessary to make these changes.
For those who work in an office, its possible to set two different PINs, the normal PIN for an employee and an admin PIN for administrators. This would allow an administrator to always have access to company data on the drive, even if the employee forgot the PIN, left the company, or whatever.
The buttons on the keypad are very small, approximately 5mm square. Those with larger fingers may find them a challenge to use.
The largest size PRO+C drive is 512 GB and costs $324. By comparison, a vanilla 512 GB drive is only $49.99 on Amazon, making the PRO+C drive 7.5 times more expensive. This kind of comparison, however, is not really fair, because a vanilla drive doesnt offer the same protection and capabilities. Protecting your most valuable data is worth the extra cost.
We live in a world where bad actors are constantly trying to exploit us through the misuse of our data. We need a gadget that provides great protection while being easy enough for anyone to use and highly portable. The Datashur PRO+C encrypted flash drive from iStorage is the perfect device for the average person. If your data is valuable to you and worth spending a little extra money to protect, then I commend this drive to you. If this drive isnt exactly what youre looking for, then take a look at the many other drives that iStorage sells.
Price: $129 to $324Where to buy: iStorage online store and AmazonSource: The sample for this review was provided by iStorage.
Excerpt from:
iStorage Datashur PRO+C Encrypted Flash Drive review protecting your personal data - The Gadgeteer
Enhanced security: Default end-to-end encryption now on Facebook Messenger – HT Tech
Meta Platforms has fulfilled a longstanding promise by introducing default end-to-end encryption for one-on-one conversations and calls on Facebook Messenger. The company asserts that with this encryption enabled, only the sender and recipient of a message can access its contents. Initially introduced as an opt-in feature in 2016, end-to-end encrypted texts and calls for individual discussions will now be the standard, marking a significant milestone after an extended development process.
Loredana Crisan, VP of Messenger, expressed, "This has taken years to deliver because we've taken our time to get this right." The team, including engineers, cryptographers, designers, policy experts, and product managers, worked diligently to rebuild Messenger features comprehensively.
Despite the encryption shift, Crisan assured users that popular Messenger features like themes and custom reactions would remain unaffected. However, she cautioned that the transition to default encryption might "take some time" for all Messenger chats.
While this move is a positive stride, The Verge notes that end-to-end encryption for group Messenger chats remains opt-in. Additionally, default encryption is yet to extend to Instagram messages, although Meta had previously indicated its implementation shortly after private Messenger chats.
In 2019, CEO Mark Zuckerberg outlined the company's intention to embrace encrypted ephemeral messages across its messaging apps. Zuckerberg wrote in a Facebook post, "I believe the future of communication will increasingly shift to private, encrypted services."
The implementation of default encryption implies that Meta won't have visibility into the contents of most Messenger chats, nor can it hand them over to law enforcement. This shift comes in the wake of a notable case where law enforcement obtained Messenger chat history in a criminal investigation. Despite concerns from anti-encryption advocates about the challenges it poses for identifying bad actors, Meta remains committed to enhancing user privacy across its messaging platforms.
Read the original:
Enhanced security: Default end-to-end encryption now on Facebook Messenger - HT Tech
Meta Starts Fully Encrypting Messages on Facebook and Messenger – RetailWire
Meta Platforms has rolled out end-to-end encryption for all personal chats and calls on both Messenger and Facebook. The end-to-end encryption feature will be available for use immediately, the social media giant said, but it may take some time for all Messenger accounts to be updated with the new technology.
Messenger users have had the option to turn on end-to-end encryption since 2016. This feature allows messages to be read only by the sender and its recipients. Once this change is implemented, messages will be thereafter encrypted by default. This encryption can help keep users safe from hackers.
Metas blog post reveals the encryption for personal messages and calls on both Facebook and Messenger, along with a suite of features that allow users to further control their experience. These features are part of the companys responsible effort to ensure a safer, more secure, and private service.
Weve introduced new privacy, safety and control features along the way like delivery controls that let people choose who can message them, and app lock, alongside existing safety features like report, block and message requests. We worked closely with outside experts, academics, advocates and governments to identify risks and build mitigations to ensure that privacy and safety go hand-in-hand, the post reads.
Meta has also added an editing messages feature for messages that users want to change for up to 15 minutes after sending them. Meta will be able to see the previous versions of the edited message.Disappearing messages on Messenger, which currently last for 24 hours after sending, will be improved to make it easier to tell when disappearing messages are turned on.
The change will roll into Instagram as well sometime in 2024, people familiar with the matter told The Wall Street Journal. However, encryption is not without its critics. Critics of the rollout include U.S. law enforcement agencies, who have argued that encrypted messages can shield criminals, including child predators and terrorists.
Continued here:
Meta Starts Fully Encrypting Messages on Facebook and Messenger - RetailWire