More than 2.6 billion personal records have been compromised in data breaches in the last two years and its only getting worse but it does emphasise the need for end-to-end encryption in the cloud.

Apple published an independent study by Massachusetts Institute of Technology (MIT) professor Stuart Mednick which showed data breaches have tripled in the last 10 years.

In the last two years alone, more than 2.6 billion personal records have been exposed.

The way companies are addressing these threats is by employing end to end encryption.

More than 80 per cent of breaches in 2023 involved data stored in the cloud with attacks targeting cloud infrastructure doubling from 2021 to 2022.

Last year Apple launched advanced data protection for iCloud which uses end to end encryption and offers Apples highest level of cloud data security with the ability to further protect your important data even in the case of a data breach.

iCloud can provide protection for 14 sensitive data categories using end to end encryption for things like passwords in iCloud Keychain, health data and even protecting your notes and photos.

Bad actors continue to pour enormous amounts of time and resources into finding more creative and effective ways to steal consumer data, and we wont rest in our efforts to stop them, said Craig Federighi, Apples senior vice president of Software Engineering.

As threats to consumer data grow, well keep finding ways to fight back on behalf of our users by adding even more powerful protections.

The report shows a dramatic rise in data breaches since companies started digitising users personal information and hackers are using more sophisticated methods to get around security that previously held them back.

Cyber criminals steal credentials or information that allows them to target employees or systems within the organisation.

And even when customers do the right thing to secure their sensitive data, the risk is still there from hackers if their information is stored in a readable form by the organisation they trusted with that information.

Recent examples of global data breaches included 23andMe a genetic testing company which potentially exposed 300TB of user data in October 2023.

Global clothing brand Forever 21 was hacked in early 2023 and exposed personal and health insurance information of more than half a million current and former employees.

MGM Resorts, the global hospitality and entertainment company, was the victim of a ransomware attack in September 2023 which resulted in operational outages across its properties in the US, China and Japan.

In Australia there were two major data breaches one against Latitude Financial and the other targeting health insurance provider Medibank. Together this impacted more than 23 million people.

The Australian Cyber Security Centre says reports of cyber crime have increased by 23 per cent in the 2023 fiscal year alone.

Apple developed Lockdown Mode for anyone being targeted with extreme threats like mercenary spyware because of who they are or what they do.

Apple also has Advanced Data Protection for iCloud which can protect against these growing threats and keep most user data in iCloud protected even in the event of a data breach.

The number of ransomware attacks in the first three quarters of 2023 has increased by almost 70 per cent compared to the same period in 2022.

And Australia is in the top four countries being targeted for ransomware alongside the U S, the UK and Canada.

More here:
Data breaches expose 2.6 billion personal records and highlights the need for end-to-end encryption - Tech Guide

Meta is implementing default end-to-end encryption (E2EE) for personal messages and calls on Messenger and Facebook starting December 7. Alongside this, the social networking giant is introducing a range of new features that aim to empower the user to have greater control over messaging experience. End-to-end encrypted conversations come with additional nifty features, including the ability to edit messages, sending media files in higher quality and disappearing messages.

The added security layer of end-to-end encryption ensures that the content of users' messages and calls with friends and family remain protected from the point they leave their device to when they reach the recipient's device. This also means that no one, including Facebook parent Meta, can access the content unless the user opts to report a message to the company.

It should be noted that earlier in 2016, Facebook Messenger gave the option to users to turn on end-to-end encryption, but now, it is changing private chats and calls across Messenger to be end-to-end encrypted by default.

"This has taken years to deliver because weve taken our time to get this right. Our engineers, cryptographers, designers, policy experts and product managers have worked tirelessly to rebuild Messenger features from the ground up. Weve introduced new privacy, safety and control features along the way like delivery controls that let people choose who can message them, as well as app lock, alongside existing safety features like report, block and message requests. We worked closely with outside experts, academics, advocates and governments to identify risks and build mitigations to ensure that privacy and safety go hand-in-hand," Loredana Crisan, Head of Messenger, said in a statement.

The company noted it is committed to safeguarding messages and privacy, while making the announcement.

Disappearing messages on Messenger now last for 24 hours after being sent. Meta is also improving the interface to make it easier to tell when disappearing messages are turned on. This will help people be confident that their messages stay secure and wont stick around forever. Disappearing messages on Messenger are only available for end-to-end encrypted conversations, but users can still report disappearing messages if they receive something inappropriate, and Meta notify them if it detects that someone screenshots a disappearing message.

Users can now edit messages that may have been sent too soon, or that they would simply like to change, within a 15-minute window after sending them. Users can still report abuse in an edited message and Meta will be able to see the previous versions of the edited message.

Here is the original post:
Meta Makes End-To-End Encryption Default On Messenger - ABP Live

Proton has released a number of updates and new privacy-focused solutions this year, including family plans, its end-to-end Proton Pass password manager, and more. Now, the company has launched a native Mac app for its Proton Drive secure cloud storage.

Proton CEO Andy Yen shared all the details in a blog post:

Cloud storage is a critical piece of our mission to build an internet that protects your privacy and secures your data. Its where you keep your most sensitive files, from personal photos to identity documents. Unfortunately, the leading cloud storage providers today can scan your data and dont use end-to-end encryption by default.

Thats why were pleased to announce that Proton Drives encrypted cloud storage is now available on all major platforms with the launch of our macOS app. In addition to Proton Drive apps for iPhone, Android, Windows, and web, we now offer Mac users a privacy-first alternative to Big Tech.

Andy highlights that with Apple, end-to-end encryption isnt on by default for iCloud Drive (you have to enable Advanced Data Protection for that).

Along with Proton Drive using end-to-end encryption for all your data across all devices, it also does the same for all of your metadata, like file names and date modification details.

Proton Drive for macOS is secured with cryptographic signatures to guarantee file authenticity and prevent data tampering. Plus, like Protons other services, Proton Drive for macOS will be open source and is being independently reviewed.

Proton offers 1 GB of free encrypted storage with other plans going from $3.50/month (when paying for two years) or $3.99/month (when paying for one year). The Proton Family plans included 3 TB of storage starting from $19.99/month (when paying for two years).

You can download the new free Proton Drive for Mac (and other platforms) directly from Proton.

FTC: We use income earning auto affiliate links. More.

View post:
Proton Drive arrives for macOS with full end-to-end encrypted cloud storage - 9to5Mac

from the our-security-trumps-your-security dept

New York City residents will, once again, be asked to foot the bill for NYPD efforts that solely benefit the nations largest police department. Its not enough that theyve been asked to spend hundreds of millions of dollars every year to bail out officers hit with civil rights lawsuits. Its not enough that theyve been asked to foot the bill for the NYPDs repeated refusal to comply with public records laws.

Now, theyre being asked to pay for even more opacity, this time taking the form of full encryption of police/dispatch radio transmissions.

The NYPD is set to fully encrypt its radio broadcasts by the end of next year as part of a nearly $400 million planned system upgrade setting off alarm among local politicians and press advocates.

[]

The NYPDs massive network of radio communications is expected to go dark by the end of 2024 as the department switches from an analog to a digital network, according to Chief of Information TechnologyRobert Beltran.

This will effectively cut one form of public oversight out of the loop. Journalists and others keeping an eye on police activity will no longer be able to perform this public service. Instead, the NYPD will spend $400 million in public funds to ensure only cops know what cops are up to.

A decade ago, the NYPD was actually encouraging people to keep their smartphones updated to ensure they could avail themselves of device and communication encryption offerings. Not long after that, the tune changed, led by Police Commissioner Bill Bratton and Manhattan DA Cyrus Vance.

Bill Bratton, following the lead of then-FBI Director James Comey, said device encryption did a terrible disservice to the public by making it more difficult for police to obtain data and communications from seized phones. Bratton also claimed the move towards default device encryption (as well as end-to-end encryption for communications) was nothing more than mercenary behavior by device manufacturers that served nothing more than their bottom line.

Cyrus Vance engaged in his own brand of encryption demonization, claiming (without supporting facts) the NYPD was sitting on dozens of uncrackable devices, insinuating that all the phones he tossed on the press conference table were loaded with evidence crucial to ongoing investigations and prosecutions. Warrant-proof was the term deployed by DA Vance, a term frequently deployed by consecutive FBI directors as they complained about the public being allowed to secure their devices and communications.

But encryption is apparently ok if its the PD using it. Thats the takeaway from this planned deployment, which NYPD officials claim is crucial to ensuring officer safety. That it helps prevent the public from keeping an eye on cops is just an added bonus one that is deliberately ignored when police officials discuss the encryption rollout. According to the NYPD, the fact that the NYPD communicates anything at all through social media accounts and press releases is far more than the public deserves.

Beltran said the switch was necessary to protect cops and the personal details of crime victims, arguing during the hearing that the police department can be trusted to get important information out to the public in a timely manner.

The department provides information to reporters many times a day every day. We also have hundreds of digital media officers assigned to precincts that are also updating information on social media in real time, he said.

Yes, the citys journalists and citizens should be thrilled to be blessed by fully vetted PR releases, rather than being allowed to draw their own conclusions from radio transmissions and activity witnessed at crime scenes ones theyre able to locate thanks to previously unencrypted transmissions.

Somewhat ironically, one of the most notable victims of this shift to encryption is the controversial crime-reporting app, Citizen. This app and its developers have courted controversy in the past by encouraging users to act as ambulance chasers and rush to crime scenes to provide other users with footage and speculation. The company that courted voyeurs and vigilantes is now a bit nonplussed that this shift to encryption will render its product mostly useless.

We have spent six years building up this network and saving a tremendous amount of lives and this threatens all of this progress, said Andrew Frame, CEO of Citizen, adding that many New Yorkers rely on the app to stay safe.

I can believe the six years building up this network. The claim that Citizen has saved lots of lives is completely ridiculous. The app was never about improving public safety. It was always about filling crime scenes with rubberneckers and encouraging peoples worst impulses.

Thats not to say the NYPD has completely cut the public out of the loop. It claims it might let a few chosen partners (journalists, Citizen) engage in virtual ride-alongs via limited feed access, but it wont make that decision until long after the heat has died down.

The NYPD hasnt ruled out allowing the press or companies like Citizen to tune in, said Beltran, while noting that such a plan which could include granting delayedaccess to the feeds is under a departmental review that wont be completed until after the entire network is encrypted.

In other words, the NYPD will go dark first. Then it will engage in the much longer process of determining whos allowed to listen in a process that I imagine will involve months or years of discussion, followed by months or years of inaction NYPD officials will claim is actually implementation.

The NYPD is going dark, something it claims is necessary to keep it safe and secure. But its not willing to extend the same courtesy to the people it serves. And it certainly wont be bothered by the extra layer of opacity it provides. The taxpayers lose. Again. And theyre expected to pay for this privilege.

Filed Under: encryption, nypd, transparency

Follow this link:
NYPD Moves Towards Encrypting Radio Transmissions After Years ... - Techdirt

Today, encryption is a cornerstone of our cybersecurity practices. It protects everything from cell phones and SMS messages to financial transactions and intellectual property.

However, a new challenge in the complex landscape of encryption has recently emerged, thanks to the advancement of quantum computing. What challenges lay ahead? Here is the breakdown:

Quantum Computing (QC), invented in the 1970s by David Deutsch, has made significant steps forward in the following decades and has become a viable technology capable of solving complex computational problems. Based on the laws of quantum mechanics, QC is not bound to the restrictions of classical computers, where everything resolves to a 1 or 0. Instead, QC uses "multidimensional computational spaces" to answer nearly impossible questions. It sounds like sci-fi, but it applies to our current computing environment.

Quantum Computing presents a unique challenge to all cybersecurity efforts because it has the potential to break some of the commonly used encryption standards used today.

Organizations use symmetric or asymmetric keys to encrypt their data at rest or in motion. Symmetric cryptography, like the Advanced Encryption Standard (AES), utilizes a single key to encrypt and decrypt data. In contrast, asymmetric cryptography (RSA) uses a public and private key to encrypt and decrypt data. The two types of cryptography differ in the security they provide based on their bit count (AES typically uses 128 or 256 bits, and RSA keys typically use 1024-2048 bits) and the password strength the key creator uses.

Due to QCs threat to circumvent almost any encryption, in 2022, NIST introduced several new encryption key algorithms to address the inherent risks posed by QC. Because of the increased complexity of the algorithms used to generate the keys, they are considered QC-resistant (QCR). The new encryption keys mitigate the potential impact of Grovers Algorithm, which can break AES-128 encryption in seconds today, and Shors Algorithm, which will eventually be able to break RSA encryption as QC technology advances.

In short, suitable algorithms and encryption standards could protect us from the future of QC hackers. But deploying them is a different matter.

Todays lack of widespread QC availability makes QCR encryption a non-existent priority for most organizations because no perceived threat would require immediate action. Many companies IT and cybersecurity teams are already pushed to the maximum and tend to focus their efforts (and budgets) on decreasing current attack surfaces and clearing out the never-ending stream of alarms.

But thats no reason to delay action. Complacency yields breaches, especially in cybersecurity. If encryption is not updated to match tomorrows threats, whats to stop malicious actors from decrypting all of the non-QCR data in the future? IBM estimates a 1-in-7 chance that current encryption keys will be breakable by QC as early as 2026, and that chance skyrockets to 1-in-2 in 2031. If todays data encryption isnt made QCR shortly, companies could see their information harvested or held ransom, damaging an organizations reputation and ability to operate.

The best time to upgrade your encryption is before hackers can break it with these new tools -- an ounce of prevention is worth a pound of cure, as the saying goes. Part of this prevention is identifying where all essential data resides, how users or systems access it, and the encryption used to protect it. For organizations anticipating the addition of new data sources or applications to their enterprise, part of the planning and encryption selection criteria should include support for QCR encryption.In addition, companies that develop enterprise applications in-house should also update their DevSecOps pipeline to include the integration of QCR encryption to prevent potential issues and rework in the future.

Image credit: plotplot/Shutterstock

Jerry Derrick is Vice President of Engineering atCamelot Secure. He leads the company's engineering division and is responsible for the design, development, and sustainment of the Camelot Secure360 platform. Jerry's responsibilities also include the management of the product roadmap, research and development activities, and ensuring the overall security of the platform and customer data. A cybersecurity engineering veteran of over 20 years, Jerry understands and focuses on the importance of fusing people, processes, and technology to ensure Camelot Secure360 enables organizations to know their environments are secure against the latest threats. Before joining Camelot Secure, he worked at top military and government cybersecurity organizations to develop and deploy tools and capabilities to facilitate the more efficient and effective analysis of cybersecurity data.

See original here:
Will Quantum Computing change the way we use encryption? - BetaNews