Cloud Hosting

Continuing to address security issues that emerged during the early days of the COVID-19 pandemic, Zoom Video Communications Inc. has added support for customer-provided encryption to its popular videoconferencing service.

Zoom Customer Managed Key is aimed primarily at customers in heavily regulated industries like healthcare and financial services. It comes on the heels of increased encryption support that was built into version 5.0 of its platform, which was announced in April. That release added Advanced Encryption Standard 256-bit Galois/Counter Mode, a type of encryption that is known for both security and performance.

All cloud platforms and many software-as-a-service providers support encryption but most require that keys be stored in the hosted cloud. That isnt sufficient for some firms, though, and support for customer keys has become a point of differentiation for security-focused services. In rolling out its Cloud for Financial Services in 2019, IBM Corp. promoted bring your own key encryption as a core feature that distinguishes its platform from other public clouds.

With Customer Managed Key, users can opt to use their own encryption keys to encrypt such assets as cloud recordings, voicemails and calendar access, Zoom said. Encryption can be applied to meetings, webinars, voicemails, Microsoft Corp. Teams access tokens and archived sessions.Administrators can provision encryption keys directly within the Security tab on the Zoom administrative portal or get help from Zooms Global Servicesorganization.

The feature will incur an additional cost but Zoom didnt provide specifics.

Read this article:
Zoom adds 'bring your own key' encryption to its conferencing service - SiliconANGLE News

from the passing-the-buck-means-having-no-more-bucks-to-pass dept

Over the past few years, international law enforcement has been cracking down on encrypted device purveyors. Were not just talking about regular device encryption, which has been mainstream for several years now. These would be specialized manufacturers that appear to cater to those seeking more protection than the major providers offer services that ensure almost no communications/data originating from these phones can be obtained from third-party services.

The insinuation is that specialized devices are only of interest to criminals. And there is indeed some evidence backing up that insinuation. But plenty of non-criminals have reason to protect themselves from government surveillance, a fact that often goes ignored as criminal crackdowns continue.

Even if theres a honest market for something international law enforcement considers to be a racket (as in RICO), the market cannot seem to sustain the continuous scrutiny of law enforcement. Another purveyor of specialty phones catering to people who desire the utmost in security and privacy has decided resellers should bear the legal burden of offering its offerings. Heres Joseph Cox reporting for Motherboard:

Encrypted phone firm Ciphr, a company in an industry that caters to serious organized criminals, has made a radical change to how its product can be used and sold, signaling an attempt by the company to distance themselves from, or perhaps cut off, their problematic customers.

How do you cut off perhaps your (previously) most valued customers? Well, in this market, you force the resellers to assume all legal liability.

Now, it is shifting that responsibility away from itself to individual resellers of the devices. The message says that for resellers to continue with new sales or renewals of customers subscriptions, they will need to run their own MDM solution. This essentially puts the management of customers much more in the hands of the resellers and not Ciphr.

Offloading mobile device management (MDM) to third party resellers perhaps provides Ciphr with plausible deniability. If resellers want to have something to sell, theyll need to take direct control of device management to ensure end users dont install apps that might compromise security as well as controlling distribution of software updates and other necessities of cell phone service.

While this move may have ultimately provided Ciphr with plausible deniability when the feds came knocking, it immediately appears it wont be profitable for Ciphr. The offloading of device management to resellers appears to have severely harmed reseller desire for Ciphr phones, as Joseph Cox notes in his follow-up article.

Ciphr will cease operations at the end of the month, according to the message. The reason was that not enough resellers took up Ciphr on its plan to shift the responsibility for Mobile Device Management (MDM) away from the company itself to individual resellers.

Resellers appeared to enjoy their previous relationship with Ciphr, which allowed them to profit heavily from a demanding, but limited market. That relationship allowed Ciphr to absorb the legal liability while third parties cashed checks. Check cashing is still an option, but cashing checks now means a possible increase in legal liability. Obviously, Ciphrs biggest resellers arent on board with assuming additional legal risk.

Since theres no interest from downstream retailers in running their own device management systems, Ciphr could either sell directly to customers it has always tried to distance itself from or call it a day. It chose the latter option, which will likely end up being far less harmful to its profits than dealing with the outcome of raids, arrests, and criminal charges that may have been the end result of its continued existence.

And while it may be easy to cheer on the demise of another company that apparently catered to criminals, lets not forget every failure by device manufacturers like this one make it far easier for government entities to (falsely) claim secure devices and end-to-end encryption only benefit criminals. For that reason alone, we should be concerned about companies like these that shut down rather than offer products that could possibly fend off sustained attacks by state-sponsored hackers and make normal surveillance tools irrelevant.

Filed Under: criminals, encrypted phones, encryptionCompanies: ciphr

View post:
Encrypted Phone Provider Calls It Quits After Failing To Persuade Middlemen To Roll Their Own Device Management Systems - Techdirt

By Antoine Harb, Team Leader, Middle East and North Africa at Kingston Technology

The banking and financial sector faces heavy cybersecurity challenges, with hackers consistently zeroing in on its rich trove of sensitive data. Figures released by IBM and the Ponemon Institute revealed that the average cost of a data breach in the financial sector in 2021 was at USD 5.72 million[1].

Without a doubt, cyberattacks lead to astronomical financial losses and reputational issues that can erode customer trust. Banking and financial institutions have, thus, been ramping up their cybersecurity protocols to combat online breaches and comply with existing local and international regulatory requirements.

Implementing a comprehensive cybersecurity strategy specific to the needs of the industry in general and the organisation in particular is crucial. Data protection through encryption and backup is one of the fundamentals of practical corporate information management tactics.

However, for some banks, owning their data infrastructure is preferable than collaborating with third parties for their data encryption, storage and backup requirements. They turn to mobile security solutions as part of their measures of securing and keeping the integrity of their data and applications.

This is where encrypted USB drives come in. Specifically, hardware-centric, software-free encryption is considered one of the more effective, non-complicated solutions to online network breaches. By using state-of-the-art encrypted USB devices, organisations can also be more confident in meeting stringent regulatory standards, minimising risks and ensuring optimum data protection and safety.

With custom architectures that incorporate a premium onboard encryption controller and access control, these USB drives are designed with advanced security features. They work by encrypting data using the strongest AES-256 bit encryption in XTS mode, and then combine this with other safeguards to combat physical- and firmware-based attacks. More specifically, FIPS 197 or FIPS 140-2 Level 3 drives can add greater data protection levels, which are an essential data security requirement for businesses and government entities.

With hardware-encrypted USB drives, deploying relevant software programs is unnecessary. As the software program is removed from the equation, an organization can significantly reduce its exposure to software vulnerabilities such as brute-force, sniffing and memory hash attacks.

Furthermore, with hardware-encrypted USB, banks and other financial services institutions are more positioned to prevent users from turning off encryption, resetting the password rules specifically the minimum length and complexity and disabling the automatic password retries.

A unique recognition feature that can identify the manufacturer (vendor ID) and product model (product ID) increases data security as well. Thanks to this functionality, if a drive is plugged into the companys inner or outer firewall, it can be identified as a company-issued device by using a unique serial number. The feature is available on all of Kingston Technologys encrypted USB drives.

Another advantage of utilising hardware-encrypted USB is that the device allows an administrator to establish information access criteria for the user and then integrate this with existing local endpoint solutions. This is highly critical, especially in cases of malfunctioning cloud storage or when data is stored in devices that are not networked and for which offline access is required. It should be noted, however, that not all hardware-encrypted USBs are equipped with such a feature.

High-performance hardware-encrypted USB drives serve as an extra layer of data protection, acting as secure portable storage that meets ever-changing requirements. They permit fast data transfer and ensure safe data storage and backup, especially at times when regulatory information is needed to be hand delivered or when documents are required to be printed out on-site or off-site, among others.

Providing peace of mind, these compliant devices are not only easy to use and deploy but also more capable of fighting off brute force attacks compared to software encryption. This is because hardware encryption is designed to be separated from the host system, thereby making it much harder to breach.

With the rising popularity of cloud storage, some may consider USB drives as no longer relevant in todays industry landscape. But with their advanced features, hardware-encrypted USB drives, in reality, afford better data protection, confidentiality and compliance standards.

[1] https://www.upguard.com/blog/biggest-cyber-threats-for-financial-services

The rest is here:
Encrypted USB drives and cyber threats facing the financial sector - Tahawul Tech

Whether youre sharing confidential information or swapping movie ideas with a friend, people are turning to private messaging apps that offer end-to-end encryption to protect the contents of their conversations.

When data is shared over the internet, it often traverses a series of networksto reach its destination. Apps such as WhatsApp, owned by social media giant Meta (formerly Facebook), provide a level of privacy that even challenges Government agencies from accessing encrypted conversations.

However, with the apps constantly changing their security and privacy policies, are the messages still safe from being decrypted?

Back in May 2021, disapproval by the online community with the changes to WhatsApps privacy policy for business entities using the platform, saw many users switch to other private messaging apps such as Signal and Telegram.

Cybersecurity expert, Dr Arash Shaghaghi from UNSW School of Computer Science and Engineering and UNSW Institute for Cyber Security, compares encryption to the likes of having a secret conversation between you and another person.

To keep our information away from prying eyes, we rely on cryptographic algorithms to encrypt our data. Encryption involves converting human-readable plaintext into an encoded format and the data can only be read after its been decrypted, he says.

Encryption involves using a key to lock a message, while decryption is using a key to unlock a message.

In theory, if an outsider observed an encrypted conversation, they could not make sense of it, and they will need the appropriate key to decrypt it.

Interestingly, with some end-to-end encryption protocols, such as Signal, even if someone steals the encryption keys and taps over the connection, they cannot decrypt messages already sent. In crypto parlance, this is termed as forward secrecy.

Read more:Camfecting: how hackers attack by gaining access to your webcam

Modern encryption algorithms have been battle-tested and shown to have no known vulnerabilities. While it doesnt mean its impossible to crack, the process requires extensive processing powers and could take a significantly long time to do. Quantum computers, if they mature enough, will be able to crack much of today's encryption.

Attackers commonly target endpoints and their vulnerabilities. This is much easier than cryptanalysis which is the process used to breach cryptographic security systems.

For instance, last year, attackers targeted a vulnerabilityrelated to WhatsApps image filter functionality that was triggered when a user opened an attachment containing a maliciously crafted image file. There have been more seriousand less complicated vulnerabilities reported targeting WhatsApp clients running on iOS and Android.

Dr Shaghaghi says when you back up your messages on some of the messaging platforms, your messages are pushed to the cloud. This means that all your messages are now stored on someone elses computer.

The service providers implementation of end-to-end encryption plays a significant role in the security and privacy of a messaging app against the provider and attackers, he says.

WhatsApp used to keep a backup of the messages in an unencrypted format over iCloud for Apple users and Google Drive for those who used WhatsApp in Android. Even though WhatsApp adopted an end-to-end encryption model in 2016, unencrypted backups were vulnerable to government requests, third-party hacking, and disclosure by Apple or Google employees."

In 2021, WhatsApp rolled out an option for users to enable end-to-end encryption of their backups. While this was welcomed as a positive step forward, it should be the default for all users - not offered as an option, saysDr Shaghaghi.

Users concerned about the security and privacy of their data must make sure to enable the end-to-end encryption backup for WhatsApp and other messaging platforms.

Unless you are backing your data to an encrypted server, you are still vulnerable to have it hacked. Photo: Shutterstock

Unlike WhatsApp and Signal, Telegram does not have end-to-end encryption enabled by default. Only when the secure chat function is enabled, Telegram applies the MTProto protocol, an open-source and custom-developed protocol by the messaging provider.

As far as we know, Signal, Telegram and WhatsApp are secure in providing end-to-end encryption, if the option is enabled, says Dr Shaghaghi.

However, Signal is built with privacy and security as the primary motivation. Signals endpoint source code is also available to the public this allows anyone to inspect the code and identify vulnerabilities.

I believe the consensus is that Signal is a more secure and privacy-friendly messaging solution when compared to WhatsApp, Telegram, or Facebook Messenger."

With so many messaging platforms available on the market, Dr Shaghaghi says there are some simple steps to take to help safeguard a users privacy.

Messaging platforms contain a lot of private information so it's worth ensuring that the platform we use has a good reputation for ensuring the security and privacy of its users, he says.

It is also worth spending a few extra minutes to enable some of the more advanced security features these platforms offer, such as end-to-end backup encryption or multi-factor authentication.

And whichever platform you decide to use, its best practice to ensure we use the latest version of the apps and avoid downloading apps from third-party stores.

Read more:How cyberspace has become the new battleground in modern day warfare

There have been strong calls by different Government organisations for these apps to include backdoors which would provide access to data when deemed required by authorities.

Recent leaksfrom the US Federal Bureau of Investigation (FBI) demonstrated that even with a subpoena, powerful government entities have limited access to messages exchanged over apps that use end-to-end encryption.

This argument is especially worrying for many users who are concerned that its the first step away from the strong encryption principles that they rely on to ensure the security and privacy of their data.

There have been ongoing debates in Australia and overseas regarding this topic.

From a security engineering perspective, implementing a backdoor is never a good idea, says Dr Shaghaghi.

There is no guarantee that malicious hackers do not find out about these backdoors too and exploit them.

However, those in favour of a solution allowing access for law enforcement agencies argue that they need access given the increasing usage of these platforms by criminals.

Some messaging providers and tech companies have responded by making changes to the functionality of the platform.

To meet regulatory requirements, WhatsApp now allows users to flag a message to be reviewed by their moderators. This needs to be initiated by a user and when a message is flagged, the few messages before it is also forwarded to WhatsApp moderators, says Dr Shaghaghi.

"Apple has promoted encrypted messaging across its ecosystem and have fought off law enforcement agencies looking for records.

In 2021, they announced child safety features that include detecting sexually explicit pictures over iMessage, another platform using end-to-end encryption. To implement this feature, Apple plans to implement the detection on the device and not through an encryption backdoor.

I think we can balance the need for moderating criminal content and security and privacy requirements by breaking down the problem into more specific use-cases and developing innovative solutions.

Read this article:
Unlocking the secret to private messaging apps - UNSW Newsroom