Page 1,056«..1020..1,0551,0561,0571,058..1,0701,080..»

The U.S. Is Falling Behind on Encryption Standards – And That’s a … – eSecurity Planet

eSecurityPlanet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

The U.S. National Institute of Standards and Technology (NIST) is charged with setting cybersecurity standards and certifying products, yet is woefully behind on both. As new threats emerge were looking at you, quantum computing continued delays could become a crisis.

Two areas that are particularly concerning are delays in FIPS 140-3 certifications and the development of post-quantum cryptography.

FIPS 140-3 sets encryption and protection standards for everything from software, SSDs and HDDs to network switches and new quantum encryption standards, yet product certifications have been running far behind historical norms. As quantum computing technology continues to develop, this problem will become a crisis if it cant be resolved now.

The FIPS 140 standard started in January 1994 with FIPS 140-1, developed by a government and industry working group composed of vendors and users of cryptographic equipment. FIPS 140-2 was issued in May 2001 and FIPS 140-1 was sunsetted a year later.

FIPS-140 became the main input to the international standard ISO/IEC 19790:2006, Security requirements for cryptographic modules, issued in March 2006, so NIST was leading the standards process for much of the world. Hundreds, if not thousands, of products were certified under FIPS 140-2. The vendor community knew how to develop and maintain those products for almost two decades, and historically, certification took from six months to at most 12 months, unless something egregious was found, which did not happen very often because the process was well known and vendors knew what to do and how to do it.

FIPS 140-3 was issued in March 2019 and certification submissions began in September 2020. The FIPS 140-3 standard did not change encryption algorithms or key size. What did change in FIPS 140-3 is that the standard now evaluates security requirements at all stages of cryptographic module creation, including design, implementation and final operational deployment. FIPS 140-3 also requires different authorization levels and users for management activities, similar to what SELinux requires with a SecAdmin user (security admin) and an AuditAdmin (the administrator of the audit files). So the vendor community had some changes to make, but hardware vendors most likely did not have to create a new ASIC with new algorithms and merely had to modify firmware.

Today we are almost three years into FIPS 140-3 submissions, and while we had a Covid shutdown during some of that time, it doesnt explain why there have only been seven FIPS 140-3 certifications as of last week, the last one nearly six months ago (chart below), and another 189 (and growing) in the certification process. I doubt the vendor community is so incompetent that they couldnt comply with the minor changes required to get products certified. Add to this that both hardware and software FIPS 140-2 products are likely gone, as the last submission to FIPS 140-2 was March 2022 and those products likely reached end-of-life some time ago.

FIPS 140-3 certified products as of July 18, 2023

The lack of FIPS 140-3 products is seriously hurting our security posture, and there are no public statements from NIST on when or if the certification process will catch up.

See theTop Enterprise Encryption Products

Those delays are coming at the same time the agency is overseeing a process to evaluate and standardize quantum-resistant public-key cryptographic algorithms.

The facts are pretty simple:

This process has been going on since 2016, and since that time there has been a huge increase in quantum technology and an equally large increase in quantum understanding and interest. Yet seven years later, we have only four algorithms, and one of those, SIKE, was cracked with a single core and one hour of CPU time. This does not give me warm fuzzies that the other NIST algorithms are solid, but I suppose since the others have not yet been publicly shamed, there is hope.

Related content: Confidential Computing Use Cases & Vendors

The delay in developing quantum-resistant algorithms is especially troubling given the time it will take to get those products to market.

It generally takes four to six years with a new standard for a vendor to develop an ASIC to implement the standard, and it then takes time for the vendor to get the product certified, which seems to be taking a troubling amount of time.

I am not sure that NIST is up to the dual challenge of getting the algorithms out and products certified so that vendors can have products that are available before quantum computers can break current technology. There is a race between quantum technology and NIST vetting algorithms, and at the moment the outcome is looking worrisome.

Since NIST is both the standards and certification body for standards for our nation and much of the world, I find the situation both disheartening and pretty scary. Not a week goes by without some new quantum announcement from vendors, and not a day goes by without another major cybersecurity incident.

We deserve and need standards that provide the nation a modicum of security, and we need a standards body that is looking ahead to the future and ensuring that we will be protected. At the moment we have neither, and can only hope that the Biden Administrations Cybersecurity Strategy can fix this.

Read next: Top Full Disk Encryption Software

Read the original post:
The U.S. Is Falling Behind on Encryption Standards - And That's a ... - eSecurity Planet

Read More..

Teams Enhances End-to-End Encryption to Bolster Security – UC Today

Microsoft is launching Collaboration Security for Microsoft Teams, a solution whose features include an enhancement of full end-to-end encryption.

The solution is among several Defender for Office 365 tools and applications being introduced to Teams as Microsoft, and its other features include enhanced visibility into attacks through end-user reporting and the new capability for IT admins and SecOps to auto-purge malicious messages and attachments after their delivery.

Initially announced in March 2023, Collaboration Security for Microsoft Teams is rolling out now, with full, email-style end-to-end encryption arguably its highlight addition.

Sehrish Khan, Product Marketing Manager at Microsoft, wrote in a blog post in March:

With 71 percent of companies admitting that sensitive and business-critical data is regularly shared via collaboration tools like Microsoft Teams, organizations are increasingly realizing the need to make collaboration security an integral part of their overall SOC strategy. Thats why we are bringing the full feature set that customers use to protect their email environments across prevention, detection, and response to Microsoft Teams.

Microsoft state that Collaboration Security for Microsoft Teams was catalysed by the growth of hybrid and remote working, with the risks to data protection, privacy and security inherent to working over UC and collaboration platforms.

Attacks like phishing and ransomware that for decades have primarily used email as an entry point are now also targeting users on collaboration tools with growing frequency, Khan added.

Customers of Microsoft E5, Microsoft E5 Security, or Microsoft Defender for Office 365 can now leverage this update to improve their Teams security.

As well as introducing full end-to-end encryption in Teams, Microsoft also adds capabilities to improve cybersecurity awareness and resilience for business users.

All collaboration security functions will be integrated with the unified security operations (SecOps) experience of Microsoft 365 Defender, Microsofts Extended Detection and Response (XDR). As a result, all signals and alerts will be compiled across other domains, including endpoints, identities, email, DLP, and SaaS apps.

Microsoft now enables users to report suspicious messages directly in Teams, similar to how users can report suspicious emails in Outlook. The security team will be alerted whenever users report suspicious messages and can note them in the 365 Defender portal. This is an update of Microsofts Safe Links feature, initially launched in 2021, which scanned URLs shared in Teams conversations, chats, or channels for possibly malicious content at time-of-click to prevent users from accessing malicious websites.

All user submissions will be compiled into an auto-generated investigation of suspicious URL clicks. This will streamline the experience of reviewing suspicious messages for SOC teams, allowing them to respond more quickly.

The automatic purging of potentially malicious messages and attachments is an intriguing capability. For a faster response and automatic action, we are bringing zero auto purge (ZAP) to Teams, which protects end-users by analysing messages post-delivery and automatically quarantines messages that contain malicious content to stop the actor from compromising the account, Khan wrote.

Once a malicious message or attachment has been identified, the entire Teams ecosystem will be automatically scanned for the same sign of compromise before quarantining all other relevant messages at scale for better protection.

The default configuration for ZAP is to transfer all malicious messages into quarantine, where SOC teams can assess them further before deciding on the next steps, but the policy can also be customised to suit each businesss needs.

Other Collaboration Security features include providing SecOps with proactive tools for the advanced hunting of threats, which comprises a query-based threat-hunting tool that lets admins and SecOps examine up to 30 days of raw data. Microsoft is also adding attack simulation and training tools to bolster education, awareness, and risk assessment to support Teams user resilience against security threats.

Microsoft announced a series of new Copilot capabilities for Teams Phone and Chat. Copilot will be adding generative AI to phone calls for Teams Phone. With this new function, users can make and receive calls from their Teams app on any device and get real-time summarization and insights.

For Teams chat, users can quickly synthesise important information from their chat threads, allowing them to ask specific questions to catch up on the conversation so far, manage key discussion points, and summarise data relevant to their workflows.

Other new Teams features announced at Inspire included the Teams chat window being able to transfer to the Edge browser when opening webpage link from Teams chat, a keyboard shortcut to search chats and channels, collaborative notes in Teams meetings, and enhanced external collaboration requests.

Microsoft launched Bing Chat Enterprise, bringing Bing Chats generative AI features into the business world.

While Bing Chat Enterprises capabilities could be seismic for businesses around the world, Microsoft went to great lengths during the solutions announcement to emphasise how secure and safe its offering will be for companies with anxiety around data protection.

Microsoft emphasised the strength of Bing Chat Enterprises security because the most widely available generative AI solutions have come under close scrutiny in recent weeks and months for their handling of privacy and protection of business data.

The central issue is that OpenAIs ChatGPT, the most generally used generative AI service, leverages user prompts to develop and improve its model unless users deliberately opt out. This has galvanised worries that employees might inadvertently include proprietary or confidential data or information in their prompts, which ChatGPT utilises to answer future queries.

However, when business users utilise Bing Chat Enterprise, their chat data is not saved and, therefore, not extracted to train AI models. No one else can view the users prompts and data.

In this context, Collaboration Security for Microsoft Teams maintains MicrosMicrosoftstment in strengthening its security offerings across its suite.

See the article here:
Teams Enhances End-to-End Encryption to Bolster Security - UC Today

Read More..

The Role of Optical Encryption in Safeguarding Internet Privacy – Fagen wasanni

Exploring the Role of Optical Encryption in Safeguarding Internet Privacy

In the digital age, where data is the new gold, safeguarding internet privacy has become a paramount concern. As we increasingly rely on the internet for everything from banking to communication, the need for robust security measures is more pressing than ever. One such measure that is gaining traction is optical encryption, a technology that promises to revolutionize the way we protect our online privacy.

Optical encryption is a method of securing data by converting it into light waves, which are then transmitted over fiber-optic cables. This technology leverages the unique properties of light to create a secure communication channel that is virtually impossible to intercept or decode without the correct decryption key.

The beauty of optical encryption lies in its simplicity and effectiveness. Unlike traditional encryption methods, which rely on complex mathematical algorithms to scramble data, optical encryption uses the physical properties of light to secure information. This makes it incredibly difficult for hackers to intercept or manipulate the data, as they would need to physically tamper with the light waves, a feat that is currently beyond the reach of modern technology.

Moreover, optical encryption offers a level of security that is simply unmatched by other encryption methods. Because it uses light waves to transmit data, it is immune to the electromagnetic interference that can compromise other forms of digital communication. This makes it an ideal solution for securing sensitive information, such as financial transactions or personal communications.

But perhaps the most compelling advantage of optical encryption is its potential to safeguard our internet privacy. In an era where data breaches and cyber-attacks are becoming increasingly common, the need for robust security measures is more urgent than ever. Optical encryption offers a promising solution to this problem, providing a secure communication channel that is virtually impervious to hacking.

However, like any technology, optical encryption is not without its challenges. One of the main hurdles is the need for specialized hardware to transmit and receive the light waves. This can make it expensive and difficult to implement on a large scale. Additionally, while optical encryption is incredibly secure, it is not completely foolproof. If a hacker were able to gain physical access to the fiber-optic cables, they could potentially intercept the light waves and decode the data.

Despite these challenges, the potential of optical encryption to safeguard our internet privacy cannot be overstated. As we continue to rely on the internet for an ever-growing range of activities, the need for robust security measures will only increase. Optical encryption offers a promising solution to this problem, providing a level of security that is unmatched by other encryption methods.

In conclusion, optical encryption represents a significant advancement in the field of data security. Its unique ability to convert data into light waves offers a level of protection that is virtually impervious to hacking, making it an ideal solution for safeguarding our internet privacy. While there are still challenges to overcome, the potential of this technology is undeniable. As we continue to navigate the digital age, optical encryption will undoubtedly play a crucial role in protecting our online privacy.

Excerpt from:
The Role of Optical Encryption in Safeguarding Internet Privacy - Fagen wasanni

Read More..

Asymmetric Encryption Algorithms: What Are They And How Are … – Dataconomy

The need for robust cybersecurity measures has never been more critical than in 2023. Asymmetric encryption algorithms are the guardians of digital security ensuring that sensitive information remains protected and digital interactions stay authenticated.

There are many dangers out there that can harm our sensitive information and disrupt important services. These dangers keep evolving and becoming more advanced, making it harder to stay safe online.

From hackers trying to steal our money to cyber attacks sponsored by governments, the threats are diverse and relentless. They exploit weaknesses in our devices, and software, and even trick us into giving away our information.

To protect ourselves and our data, we need to be aware of these dangers and take measures to stay safe. By understanding the risks and implementing strong security measures, we can better defend against cyber threats and keep our digital lives secure.

Asymmetric encryption algorithms, also known as public-key cryptography, are powerful cryptographic techniques that play a pivotal role in modern cybersecurity. Unlike symmetric encryption, which relies on a single shared secret key for both encryption and decryption, asymmetric encryption algorithms utilize a pair of mathematically related keys a public key and a private key.

The concept behind asymmetric encryption is elegant and innovative. The public key is openly shared with the world, and accessible to anyone who wishes to engage in secure communication with the keys owner. On the other hand, the private key remains a closely guarded secret, known only to the individual or entity to whom it belongs. The ingenious aspect lies in the mathematical relationship between these keys data encrypted with the public key can only be decrypted with the corresponding private key and vice versa.

One of the most significant applications of asymmetric encryption algorithms is secure data transmission. By leveraging the public and private keys, these algorithms ensure that data exchanged between parties remains confidential during transmission, even if intercepted by unauthorized entities. The encryption process transforms the plaintext into an unintelligible ciphertext, and only the intended recipient possessing the corresponding private key can decipher and access the original data.

Asymmetric encryption algorithms are also instrumental in providing digital signatures, which verify the authenticity and integrity of digital messages or documents. Digital signatures are generated using the senders private key and appended to the data. The recipient can then use the senders public key to validate the signature, providing assurance that the message indeed originated from the claimed sender and has not been tampered with during transmission.

Beyond secure communication and digital signatures, asymmetric encryption algorithms find extensive use in file encryption. This application offers a robust solution for protecting sensitive data stored on electronic devices or transmitted across networks. By encrypting files with the intended recipients public key, the data becomes accessible only to the recipient possessing the corresponding private key, ensuring the datas confidentiality.

The concept of confidentiality is central to asymmetric encryption, as it guarantees that only the intended recipients with the appropriate private key can access and decrypt the encrypted data. This safeguard is essential for protecting intellectual property, personal information, financial records, and other sensitive data from unauthorized access and potential data breaches.

Additionally, asymmetric encryption enables the verification of the senders authenticity through digital signatures. Digital signatures provide recipients with a means to ascertain the legitimacy of the sender, reducing the risk of falling victim to phishing attacks or other forms of impersonation.

Moreover, asymmetric encryption enables non-repudiation, a crucial concept in cybersecurity. Non-repudiation ensures that a sender cannot later deny sending a specific message or initiating a particular transaction. The senders private key signs the message or transaction, providing cryptographic proof of the senders involvement and precluding any attempts to disavow the event.

Asymmetric encryption algorithms also play a pivotal role in facilitating secure key exchange techniques. These algorithms enable parties to establish a shared secret key for subsequent symmetric encryption without the need for prior communication or a secure channel. This key-agreement mechanism is essential for establishing secure and confidential communication between parties without the risk of exposing the shared key.

Beyond encryption and digital signatures, asymmetric encryption algorithms contribute to the creation of cryptographic hash functions, which play a critical role in ensuring data integrity. Cryptographic hash functions produce unique fixed-size hash values for input data, making it possible to detect any changes or tampering with the data, no matter how minor.

Finally, in the context of the internet and secure communication, asymmetric encryption plays a crucial role in creating digital certificates. These certificates are integral to establishing the authenticity and identity of entities on the internet, including websites and servers. By relying on asymmetric encryption, digital certificates ensure secure communication and encrypted connections with trusted entities, enhancing the overall security of online interactions.

In asymmetric encryption algorithms, users generate a key pair consisting of a public key and a private key. The public key can be openly shared, while the private key is kept confidential.

To send a secure message to the intended recipient, the sender uses the recipients public key to encrypt the data. Once encrypted, only the recipients corresponding private key can decrypt the information.

Upon receiving the encrypted data, the recipient uses their private key to decrypt it. As the private key is known only to the recipient, the confidentiality of the message remains intact.

In contrast to symmetric encryption, which uses a single key for both encryption and decryption, asymmetric encryption relies on a pair of keys.

Symmetric encryption is faster and more suitable for bulk data encryption, while asymmetric encryption excels in secure key exchange and digital signatures.

Here is a table that provides an overview of these two widely used encryption algorithms:

Both symmetric and asymmetric encryption have their strengths and weaknesses, making them suitable for different use cases. Symmetric encryption excels in speed and efficiency, making it ideal for bulk data encryption.

On the other hand, asymmetric encryption offers secure key exchange and digital signatures, enhancing security in communication and authentication.

The choice between the two encryption methods depends on the specific requirements of the application and the desired level of security.

Several asymmetric encryption algorithms are widely employed in the field of cybersecurity due to their unique features and varying levels of security.

Here are some of the most popular ones:

Triple DES (Data Encryption Standard) is an asymmetric-key block cipher based on the original DES algorithm. It provides enhanced security by applying the DES algorithm three times sequentially, using three different keys.

Each block of data undergoes a series of three transformations, significantly boosting security compared to the original DES. However, Triple DES has become less popular with the rise of more efficient and secure algorithms like AES.

Advanced Encryption Standard (AES) is one of the most widely used symmetric-key encryption algorithms. It replaced the aging Data Encryption Standard and operates on fixed-size data blocks with key lengths of 128, 192, or 256 bits.

AES employs a substitution-permutation network, making it highly secure and efficient for various applications.

RSA Security (Rivest-Shamir-Adleman) is a widely used asymmetric encryption algorithm based on the mathematical properties of large prime numbers.

It involves a key pair a public key for encryption and a private key for decryption. RSA is commonly used for secure key exchange, digital signatures, and secure communication.

Blowfish is an asymmetric-key block cipher known for its simplicity, efficiency, and resistance to attacks.

It operates on 64-bit blocks and supports key lengths ranging from 32 to 448 bits. Blowfish is used in secure data storage and transmission, password hashing, and other cryptographic applications.

Twofish is another asymmetric-key block cipher designed as a candidate for the AES competition. Although not selected as the standard, Twofish remains a respected and secure encryption algorithm.

It operates on fixed-size blocks and supports key sizes of 128, 192, or 256 bits.

Cryptographic hash functions, while not exactly one of the asymmetric encryption algorithms, they are vital in cybersecurity. They generate a fixed-size hash value for an input message, ensuring data integrity and enabling digital signatures and password hashing.

Popular hash functions include SHA-1, SHA-256, SHA-3, and MD5 (though MD5 is considered insecure).

Hash-Based Message Authentication Code (HMAC) is a construction that combines a cryptographic hash function with a secret key to provide message authentication and integrity.

Stateful Hash-Based Signature Scheme (SPHINCS) is a post-quantum secure digital signature scheme designed to resist quantum attacks.

Cracking the code: How database encryption keeps your data safe?

CAST (Carlisle Adams and Stafford Tavares) is a family of asymmetric-key block ciphers designed for secure encryption and decryption.

CAST-128 and CAST-256 are popular variants with varying block and key sizes.

Asymmetric encryption is a fundamental pillar of cybersecurity, providing robust mechanisms for secure data transmission, authentication, and digital signatures.

One of the primary applications of asymmetric encryption algorithms is to establish secure communication channels over untrusted networks, such as the Internet. When two parties wish to communicate securely, they exchange their public keys. Each party keeps their private key confidential.

By using the other partys public key to encrypt messages, they ensure that only the intended recipient with the corresponding private key can decrypt and access the information. This mechanism safeguards data confidentiality during transmission and protects against eavesdropping or unauthorized access.

Suppose Alice wants to send a confidential email to Bob. Before sending the message, Alice obtains Bobs public key. She then uses Bobs public key to encrypt the email, ensuring that only Bob, possessing the private key, can read the contents of the email.

Asymmetric encryption algorithms also enables the creation of digital signatures, a critical component for authenticating digital messages or documents. Digital signatures provide a way to verify the origin and integrity of data. The sender uses their private key to generate a digital signature, which is appended to the message.

Recipients can then use the senders public key to verify the signature, ensuring that the message indeed came from the claimed sender and has not been altered during transmission.

For example, a CEO can digitally sign an important company document using their private key. When employees receive the document, they can verify the signature using the CEOs public key to ensure that the document is authentic and has not been tampered with by unauthorized parties.

Asymmetric encryption is also employed for secure file encryption, adding an extra layer of protection to sensitive data stored on devices or transmitted over networks. Instead of using a symmetric key to encrypt the entire file, asymmetric encryption algorithms can be used to encrypt the symmetric key, which is then used for bulk encryption.

Imagine an organization that wants to share confidential files with a partner company. The organization encrypts the files using a randomly generated symmetric key. To securely share the symmetric key, they use asymmetric encryption algorithms. The partner companys public key is used to encrypt the symmetric key before sending it. Upon receiving the encrypted symmetric key, the partner company uses its private key to decrypt it and then uses the symmetric key to decrypt the files.

Asymmetric encryption algorithms areinstrumental in authentication mechanisms such as digital certificates, which are used to establish the authenticity of websites, servers, and individuals on the internet. Digital certificates contain the entitys public key, and a trusted certificate authority signs them, verifying the certificates authenticity.

When a user connects to a secure website (HTTPS), the website presents its SSL/TLS certificate. The users browser can verify the certificates authenticity by checking the signature from a trusted certificate authority. The certificates public key is then used to establish a secure connection and encrypt data during the browsing session.

Asymmetric encryption algorithms ensure non-repudiation, meaning the sender cannot deny sending a particular message or initiating a transaction. The use of the senders private key to sign the message provides cryptographic proof of their involvement.

Parties can use asymmetric encryption to sign contracts digitally. When one party signs a contract using their private key, it proves their agreement to the terms and prevents them from later denying their involvement in the contract.

As you can see, asymmetric encryption algorithms are one of the most important weapons you can use to ensure your and your companys cybersecurity.

Remember, your data is something you should guard as carefully as your ID in your pocket and you should always turn to its guardian angels.

Featured image credit: Freepik.

Read the rest here:
Asymmetric Encryption Algorithms: What Are They And How Are ... - Dataconomy

Read More..

Online Safety Bill: Where is encryption now? – DIGIT.FYI

The Online Safety Bill is currently in the House of Lords, where members have adopted a new amendment concerning the regulation of encrypted content.

According to the new amendment, Ofcom, the telecommunications regulator, will have to add an extra reporting stage before it can require technology companies to scanend-to-end encrypted content and messages for child sex abuse material and other illegal content.

The measure for extra scrutiny is meant to give further protections to privacy that is typically secured by end-to-end encryption.

A report by a skilled person will have to be commissioned by Ofcom before the regulator gives notices to technology companies to scan encrypted messages.

The skilled person will be an independent expert, according to Lord Parkinson of Whitely Bay, who spoke at the House of Lords on Wednesday.

Ofcom would need to consider how the scanning of encrypted messages in each circumstance would impact privacy and freedom of expression prior to requiring a company to introduce the technology necessary to read encrypted messages. Further, the regulator would be bound by human rights laws.

But it still remains unclear how end-to-end encryption scanning technology will be rolled out, and how the regulator will balance privacy concerns amid an alarming rise in child sexual abuse content in the UK.

Two other amendments which attempted to impose stricter parameters to Ofcoms encryption scanning notices were dropped in the House of Lords in favour of the newly adopted one.

The first, introduced by conservative Lord Moylan, would have put an outright ban on Ofcom imposing any requirements on weakening or removing of encryption, a move which has been called for by many tech companies like WhatsApp and Signal.

Labour Peer Lord Stevensen of Balmacaras amendment was also dropped, which would have required an independent judicial commissioner to review if an encryption scanning notice would be proportionate prior to its issue by Ofcom.

There still remains a lack of consensus in government on what this bill would mean for privacy and encryption.

The bill excludes text messages, Zoom, and email from the encryption measures, as well as messages sent by law enforcement, the public sector, and emergency responders.

The exclusion of the public sector and law enforcement from scans, especially amid reports of rampant sexual abuse by law enforcement in the UK has pulled into question the effectiveness of this part of the online safety bill, as well as where it is pointed.

Lord Parkinson, however, has assured that scanning encrypted messages would be a last resort if companies were found to not properly manage their risks if child sexual abuse material is continually found on a platform, Ofcom will be able to direct the company to use accredited technology to remove the content.

Even with the extra step, civil groups are saying the protections do not go far enough to ensure privacy and freedom of expression.

Related

See the rest here:
Online Safety Bill: Where is encryption now? - DIGIT.FYI

Read More..

Apple accuses UK government of trying to become ‘global arbiter’ of … – The Record from Recorded Future News

Apple has accused the British government of attempting to become the de facto global arbiter of what level of data security and encryption are permissible in response to new legal proposals.

The iPhone maker warned that if the proposals became law it could be forced to publicly withdraw security features from the United Kingdom and potentially completely turn off services such as FaceTime and iMessage in the country.

The company was responding to a consultation on amendments to the Investigatory Powers Act, which was passed in 2016 in the wake of the Snowden scandal to reform the legal regime used by intelligence services and law enforcement agencies to access communications data.

In an update to this legislation, the Home Office is seeking to overhaul a range of protections originally baked into the legislation that would strengthen its ability to force technology companies into amending their services so that communications data can be accessed.

The proposed changes are independent of the countrys Online Safety Bill, which is still being debated in Parliament. Apple alongside civil society groups and other technology companies has also criticized this bill as risking the privacy of billions of people around the world by undermining end-to-end encryption.

According to Apple, the Home Offices plans to update the Investigatory Powers Act would allow the government to require the company to notify it over any security updates that could have a negative impact on investigatory powers.

The law currently allows the government to issue a secret notice prohibiting Apple from implementing such an update, something which Apple has the right to appeal. However, under a new amendment, Apple would be forced to comply with the instruction even while its appeal was being reviewed.

The company said: Together, these provisions could be used to force a company like Apple, that would never build a backdoor, to publicly withdraw critical security features from the UK market, depriving UK users of these protections.

The amended law would result in an impossible choice between complying with a Home Office mandate to secretly install vulnerabilities into new security technologies (which Apple would never do), or to forgo development of those technologies altogether and sit on the sidelines as threats to users data security continue to grow, the company said.

Recorded Future

Intelligence Cloud.

Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and is also a fellow at the European Cyber Conflict Research Initiative.

See the article here:
Apple accuses UK government of trying to become 'global arbiter' of ... - The Record from Recorded Future News

Read More..

How homomorphic encryption can solve blockchain privacy – Information Age

In recent years, few technological advancements have sparked as much excitement and discussion as blockchain. With its rise to prominence during the unprecedented cryptocurrency boom of 2017, blockchain swiftly entered the mainstream lexicon. This technology builds upon well-established principles in distributed transaction processing and encryption, combining them in a truly innovative manner.

Today, the technology has garnered significant attention well beyond cryptocurrency, especially in the financial sector. From tokenisation to stablecoin, remittances, market-making and cross-border payments, blockchains decentralised nature and immutability provide countless opportunities for enhanced security, transparency, and efficiency. However, privacy remains a critical concern within the blockchain ecosystem across nearly all the industries and sectors it touches.

The issues arising from the lack of privacy in blockchains include theft, Maximum Extractable Value (MEV), and pervasive surveillance. This lack of privacy opens the door for various malicious activities and puts user funds and data at risk. Unlike this, at least traditional finance affords a satisfactory level of privacy, allowing transactions to be executed without exposing sensitive details to the world. Without privacy, blockchain falls short of its lofty ambitions. Its a fundamental requirement for its adoption as a core infrastructure for value transfer. If blockchains are to achieve their full potential and become a bedrock of our financial systems, the issue of privacy needs to be addressed effectively.

Using blockchain to grow your start-up Trust and verification are becoming increasingly important. Blockchain guarantees that trust, becoming a crucial tool if youre growing your start-up.

Addressing this challenge requires innovative solutions that can enhance privacy without compromising the core principles of blockchain. Fully Homomorphic Encryption (FHE), a cryptographic technique which has been talked about for many years but only now starting to realise its full potential, holds immense promise in mitigating the privacy issues associated with blockchain.

One of the primary privacy concerns in blockchain transactions is the lack of confidentiality, as the design of blockchain inherently promotes transparency and visibility to all participants. This openness potentially compromises the confidentiality of sensitive information, posing a significant challenge for industries that handle private and personal data. Storing sensitive data on-chain further increases the vulnerability to attacks and unauthorised access.

However, FHE arises as a powerful mechanism to potentially address these privacy concerns, enabling data encryption while preserving functionality. Participants can perform computations on encrypted data without the need to decrypt it, ensuring the confidentiality of sensitive information throughout the entire process.

This transformative approach allows blockchain participants to engage in transactions and data processing activities while maintaining the utmost privacy and minimising the chances of unauthorised access or data breaches.

Blockchain transactions are typically pseudonymous, with transaction details being publicly accessible. This inherent transparency can raise concerns about the privacy of users, as their transaction history becomes visible to anyone on the network. It is certainly telling that there are companies like Arkham and Chainalysis currently working to de-pseudonymise blockchain.

FHE introduces an additional layer of protection by encrypting the transaction data and enabling computation on encrypted data, offering a compelling solution to this challenge.

This means that participants can perform transactions on the blockchain while keeping their transaction details private, reducing the potential for data breaches or unwanted exposure of personal information.

This increased privacy fosters trust among users and promotes a more secure environment for conducting transactions on the blockchain.

Data privacy: why consent does not equal compliance Brands and publishers are unwittingly leaving themselves exposed to being fined billions of dollars for data privacy violations, warns Jamie Barnard.

Alongside user privacy and confidentiality concerns, blockchain adoption also faces challenges due to regulatory requirements surrounding data privacy and protection. Many industries have strict compliance frameworks that must be adhered to when handling sensitive data.

However, encrypting sensitive data using FHE can provide a privacy-enhancing solution that aligns with these regulatory frameworks, encouraging greater trust and widespread adoption. FHE enables organisations to securely store and process sensitive data while ensuring privacy and data protection. This not only helps blockchain platforms comply with regulations, but also provides users with the assurance that their data is handled in a secure and privacy-preserving manner.

Another integral part of blockchain ecosystems often requiring access to sensitive data for execution are smart contracts, again raising concerns about the privacy and confidentiality of the data involved.

Because FHE can enable smart contracts to operate on private information securely, sensitive data remains confidential, even during contract execution. By incorporating FHE into smart contract design, blockchain platforms can preserve the privacy of the details of the contract, as well as the underlying data, while maintaining the trust and integrity of the overall system.

Building trust in the metaverse As buying digital goods and services for your avatar becomes accepted, Dan Llewellyn argues building trust in the metaverse will be increasingly important.

FHE holds tremendous promise in addressing many privacy problems within the blockchain ecosystem including the preservation of confidentiality, enhancement of data security, assurance of user privacy facilitation of regulatory compliance, and protection of smart contract privacy. However, it is important to acknowledge that further research and development are required to overcome its current computational complexity and performance limitations.

As the technology continues to evolve, efforts must be made to enhance its efficiency and scalability, ensuring that FHE becomes a practical and viable solution for blockchain privacy.

By combining the strengths of blockchain and FHE, we can forge a path towards a more private and secure future that empowers individuals, protects sensitive data, and instils confidence in the blockchain ecosystem.

Jason Delabays is blockchain ecosystem lead at Zama.

How regulation of the metaverse could impact your business Heres how regulation of the metaverse could play out for organisations looking to leverage the infrastructure.

Originally posted here:
How homomorphic encryption can solve blockchain privacy - Information Age

Read More..

Network Encryption System Market Size with Focus on Emerging … – Glasgow West End Today

Keeping in mind the customer requirement, the finest Network Encryption System Market research report is constructed with the professional and in-depth study of Network Encryption System Market industry. Market segmentation studies conducted in this report with respect to product type, applications, and geography are valuable in taking any verdict about the products. This market report serves the purpose of businesses of making enhanced decisions, deal with marketing of goods or services, and achieve better profitability by prioritizing market goals. With the use of up to date and proven tools and techniques, complex market insights are organized in simpler version in the first class Network Encryption System Market business report for the better understanding of end user.

The report describes the situation of the present industry combined with the future trends which will satisfy the requirements of the end-consumers. The report analyzes a rich source of predominant elements accountable for improving the Network Encryption System market. The company analysts also source data & investigate trends based on information from supply & demand intermediaries in the value chain. The report provides an analysis of the performance of the market over the years with the all the downs & ups.

Download Full PDF Sample Copy of Report with Global Industry Analysis: (Including Full TOC, List of Tables & Figures, Chart) at: https://globalmarketvision.com/sample_request/188099

Key Players Mentioned in the Global Network Encryption System Market Research Report:

Cisco, Thales Esecurity, Atos, Juniper Networks, Certes Networks, Rohde & Schwarz Cybersecurity, Adva, Gemalto, Nokia, Colt Technology Services, Aruba, Huawei, Ciena, Eci Telecom, Senetas, Viasat, F5 Networks, Raytheon, Arris, Stormshield, Atmedia, Securosys, Packetlight Networks, Quantum, Technical Communication

Global Network Encryption System Market Segmentation:

Market Segmentation: By Type

HardwarePlatformServices

Market Segmentation: By Application

Telecom And ItBfsiMedia And EntertainmentGovernmentOthers

Market revenue forecasts for each geographic region are included in the Network Encryption System research study. In addition to forecasts, growth patterns, industry-specific technologies, problems, and other features, this report contains a complete assessment of the major variables influencing the global market. A breakdown of the major market share, a SWOT analysis, a profitability index, and the geographic dispersion of the Network Encryption System market are all included in the Network Encryption System research. The global Network Encryption System industry research offers a comprehensive comparison of economies and global market places to show the Network Encryption System industrys importance in a changing geographic environment.

The base of geography, the world market of Network Encryption System has segmented as follows:

COVID-19 Impact

Report covers Impact of Coronavirus COVID-19: Since the COVID-19 virus outbreak in December 2019, the disease has spread to almost every country around the globe with the World Health Organization declaring it a public health emergency. The global impacts of the coronavirus disease 2019 (COVID-19) are already starting to be felt, and will significantly affect the Network Encryption System Market in 2023.

The outbreak of COVID-19 has brought effects on many aspects, like flight cancellations; travel bans and quarantines; restaurants closed; all indoor/outdoor events restricted; over forty countries state of emergency declared; massive slowing of the supply chain; stock market volatility; falling business confidence, growing panic among the population, and uncertainty about future.

Key questions answered in the report:

Table of Content (TOC):

Chapter 1: Introduction and Overview

Chapter 2: Industry Cost Structure and Economic Impact

Chapter 3: Rising Trends and New Technologies with Major key players

Chapter 4: Global Network Encryption System Market Analysis, Trends, Growth Factor

Chapter 5: Network Encryption System Market Application and Business with Potential Analysis

Chapter 6: Global Network Encryption System Market Segment, Type, Application

Chapter 7: Global Network Encryption System Market Analysis (by Application, Type, End User)

Chapter 8: Major Key Vendors Analysis of Network Encryption System Market

Chapter 9: Development Trend of Analysis

Chapter 10: Conclusion

Conclusion: At the end of Network Encryption System Market report, all the findings and estimation are given. It also includes major drivers, and opportunities along with regional analysis. Segment analysis is also providing in terms of type and application both.

Complete Report Details with Facts and Figures along respective Images and Graphs

(High Priority to corporate email id)@ https://globalmarketvision.com/checkout/?currency=USD&type=single_user_license&report_id=188099

If you have any special requirements, please let us know and we will offer you the report at a customized price.

Relevant points Highlighted:

About Global Market Vision

Global Market Vision consists of an ambitious team of young, experienced people who focus on the details and provide the information as per customers needs. Information is vital in the business world, and we specialize in disseminating it. Our experts not only have in-depth expertise, but can also create a comprehensive report to help you develop your own business.

With our reports, you can make important tactical business decisions with the certainty that they are based on accurate and well-founded information. Our experts can dispel any concerns or doubts about our accuracy and help you differentiate between reliable and less reliable reports, reducing the risk of making decisions. We can make your decision-making process more precise and increase the probability of success of your goals.

Contact Us

Sarah Ivans | Business Development

Phone: +1 617 297 8902

Phone: +44 151 528 9267

Email: sales@globalmarketvision.com

Global Market Vision

Website: http://www.globalmarketvision.com

Link:
Network Encryption System Market Size with Focus on Emerging ... - Glasgow West End Today

Read More..

Document Encryption Software Market to witness rapid growth by … – Glasgow West End Today

Global Market Vision has recently released expansive research titled Global Document Encryption Software Market guarantees you will remain better informed than your competition. An outstanding Document Encryption Software Market research report intensely analyses the potential of the market with respect to current scenario and the future prospects by considering several industry aspects of Document Encryption Software industry. The report also recognizes and analyses the rising trends along with major drivers, challenges and opportunities in the market. The report provides major statistics on the market status of global and regional manufacturers and is a helpful source of assistance and direction for companies and individuals interested in the Document Encryption Software Market industry. The company profiles of all the chief and dominating market players and brands who are taking steps such as product launches, joint ventures, mergers and acquisitions are mentioned in the superior Document Encryption Software Market report.

Click Here to Get the Sample PDF of the Premium report: https://globalmarketvision.com/sample_request/188674

An excellent Document Encryption Software market research report is a great store to acquire current as well as upcoming technical and financial details and market insights of the Document Encryption Software industry for the precise forecast period. The report carries out an analysis and discussion of important market trends, market size, sales volume, and market share for the Document Encryption Software industry. SWOT analysis and Porters Five Forces Analysis are two of the most comprehensively used techniques while preparing this report. Estimations about the rise or fall of the CAGR value for a specific forecast period are also mentioned in the persuasive Document Encryption Software report.

Similarly, in this report, clients are rendered important cues on providers landscape and their current competition strength, which highly influence the development of the global Document Encryption Software market. Further, leading providers, manufacturing landscape, percentage splits, market revenues, breakdowns of the product scenario, and growth details are studied through primary as well as secondary sources.

Key Players Mentioned in the Global Document Encryption Software Market Research Report:

Thales, Fuji Xerox, Dell Technology, Macro Systems, Axcrypt, Newsoftwares Net, Esafenet, Tipray, Eetrust Technology, Bluedon, Venustech

Global Document Encryption Software Market Segmentation:

Market Segmentation: By Type

Idea AlgorithmRsa AlgorithmAes Algorithm

Market Segmentation: By Application

Confidential DocumentMeeting MinutesTechnical InformationFinancial StatementsOthers

In terms of depth and area of review, the study is extensive. It covers global developments faithfully, all the while focusing on crucial market segment regions. This research accurately reflects the distinction between corporate performance parameters and procurement scenarios across various geographical locations. It provides a detailed breakdown of the Document Encryption Software industry sectors. The report contains some general information as well as a sales projection study for each location.

Geographic Segment Covered in the Report:

The Document Encryption Software Market report offers insights on the market area, which is further divided into sub-regions and nations/regions. This chapter of the research includes details on profit prospects in addition to market share data for each nation and subregion. During the expected time, this component of the research covers the market share and growth rate of each region, country, and sub-region.

North America (USA and Canada)

Europe (UK, Germany, France and the rest of Europe)

Asia Pacific (China, Japan, India, and the rest of the Asia Pacific region)

Latin America (Brazil, Mexico, and the rest of Latin America)

Middle East and Africa (GCC and rest of the Middle East and Africa)

Oceania (Australia, and New Zealand)

The Document Encryption Software report analyses various critical constraints, such as item price, production capacity, profit & loss statistics, and global market-influencing transportation & delivery channels. It also includes examining such important elements such as Document Encryption Software market demands, trends, and product developments, various organizations, and global market effect processes.

Table of Content: Global Document Encryption Software Market

Part 01: Executive Summary

Part 02: Scope of the Document Encryption Software Market Report

Part 03: Global Document Encryption Software Market Landscape

Part 04: Global Document Encryption Software Market Sizing

Part 05: Global Document Encryption Software Market Segmentation by Product

Part 06: Five Forces Analysis

Part 07: Customer Landscape

Part 08: Geographic Landscape

Part 09: Decision Framework

Part 10: Drivers and Challenges

Part 11: Market Trends

Part 12: Vendor Landscape

Part 13: Vendor Analysis

Conclusion: At the end of Document Encryption Software Market report, all the findings and estimation are given. It also includes major drivers, and opportunities along with regional analysis. Segment analysis is also providing in terms of type and application both.

Access the full Research Report @ https://globalmarketvision.com/checkout/?currency=USD&type=single_user_license&report_id=188674

The report answers the following questions-

If you have any special requirements, please let us know and we will offer you the report at a customized price.

About Global Market Vision

Global Market Vision consists of an ambitious team of young, experienced people who focus on the details and provide the information as per customers needs. Information is vital in the business world, and we specialize in disseminating it. Our experts not only have in-depth expertise, but can also create a comprehensive report to help you develop your own business.

With our reports, you can make important tactical business decisions with the certainty that they are based on accurate and well-founded information. Our experts can dispel any concerns or doubts about our accuracy and help you differentiate between reliable and less reliable reports, reducing the risk of making decisions. We can make your decision-making process more precise and increase the probability of success of your goals.

Contact Us

Sarah Ivans | Business Development

Phone: +1 617 297 8902

Phone: +44 151 528 9267

Email: sales@globalmarketvision.com

Global Market Vision

Website: http://www.globalmarketvision.com

Visit link:
Document Encryption Software Market to witness rapid growth by ... - Glasgow West End Today

Read More..

How Signal Walks the Line Between Anarchism and Pragmatism – WIRED

It's no exaggeration to say that small features in a chat app encode different visions of how society should be organized. If the first reacji in the palette was a thumbs down rather than a heart, maybe we would all be more negative, cautious people. What kind of social vision did Signal arise from?

Looking back, I and everyone I knew was looking for that secret world hidden in this one, Marlinspike admitted in a 2016 interview. A key text in anarchist theory describes the idea of a temporary autonomous zone, a place of short-term freedom where people can experiment with new ways to live together outside the confines of current social norms. Originally coined to describe pirate utopias that may be apocryphal, the term has since been used to understand the life and afterlife of real-world DIY spaces like communes, raves, seasteads, and protests. And Signal is, unmistakably, a temporary autonomous zone that Marlinspike has spent almost a decade building.

Because temporary autonomous zones create spaces for the radical urges that society represses, they keep life in the daytime more stable. They can sometimes make money in the way that nightclubs and festivals do. But temporary autonomous zones are temporary for a reason. Over and over, zone denizens make the same mistake: They cant figure out how to interact productively with the wider society. The zone often runs out of money because it exists in a world where people need to pay rent. Success is elusive; when a temporary autonomous zone becomes compelling enough to threaten daytime stability, it may be violently repressed. Or the attractive freedoms offered by the zone may be taken up in a milder form by the wider society, and eventually the zone ceases to exist because its existence has pressured wider society to be a little more like it. What kind of end might Signal come to?

There are reasons to think that Signal may not be around for very long. The nonprofits blog, meant to convince us of the elite nature of its engineers, has the unintentional effect of conveying the incredible difficulty of building any new software feature under end-to-end encryption. Its team numbers roughly 40; Marlinspike has just left the organization. Achieving impossible feats may be fun for a stunt hacker with something to prove, but competing with major tech companies engineering teams may not be sustainable for a small nonprofit with Marlinspike no longer at the helm.

Fittingly for an organization formerly led by an anarchist, Signal lacks a sustainable business model, to the point where you might almost call it anti-capitalist. It has survived so far in ways that dont seem replicable, and that may alienate some users. Signal is largely funded by a big loan from a WhatsApp founder, and that loan has already grown to $100 million. It has also accepted funding from the US government through the Open Technology Fund. Because Signal cant sell its users data, it has recently begun developing a business model based on directly providing services to users and encouraging them to donate to Signal in-app. But to get enough donations, the nonprofit must grow from 40 million users to 100 million. The companys aggressive pursuit of growth, coupled with lack of moderation in the app, has already led Signal employees themselves to publicly question whether growth might come from abusive users, such as far-right groups using Signal to organize.

But there are also reasons for hope. So far, the most effective change that Signal has created is arguably not the existence of the app itself, but making it easy for WhatsApp to bring Signal-style end-to-end encryption to billions of users. Since WhatsApps adoption, Facebook Messenger, Googles Android Messages, and Microsofts Skype have all adopted the open source Signal Protocol, though in milder forms, as the history of temporary autonomous zones would have us guess. Perhaps the existence of the Signal Protocol, coupled with demand from increasingly privacy-conscious users, will encourage better-funded messaging apps to compete against each other to be as encrypted as possible. Then Signal would no longer need to exist. (In fact, this resembles Signals original theory of change, before they decided they would rather compete with mainstream tech companies.)

Now, as the era of the global watercooler ends, small private group chats are becoming the future of social life on the internet. Signal started out a renegade, a pirate utopia encircled by cryptography, but the mainstream has becomealarmingly quicklymuch closer to the vision Signal sought. In one form or another, its utopia just might last.

Continued here:
How Signal Walks the Line Between Anarchism and Pragmatism - WIRED

Read More..