Cloud Hosting

What You Dont See Can Harm You

As we emerge from the COVID-19 lockdown, we see a rash of malicious ransomware attacks trying to shut down many sectors of the economy Colonial Pipeline, J.B.S, C.N.A Financial for profit. Why? Because crime pays. Even more threatening are the ones we dont hear about those from the users inside of the organization.

The same encryption mechanism using a public key to secure our communication transport level security (TLS) a.k.a Secure Sockets Layer (SSL) can be used by malicious users or programs to access sensitive information.

Initially, botnets were used for DDoS attacks. Now, some of these command-and-control malware use the resources of infected machines for ransom and profit (ransomware and crypto-mining), significantly affecting an enterprises performance and increasing operating costs as well as wear on the commandeered machines. These attacks can also be a conduit for additional future malware delivery.

Most malware threatens the availability, integrity, and security of a network.

As we have seen recently, ransomware attacks can often result in information theft and hijacking in addition to disrupting an organizations mission-critical operations.

When the malware activates, it may open an encrypted session to an external server. The only information the malware requires to secure the communication with the external server is the external servers public key. Since the sending organization (of the user or malware program) does not have the private key to this encrypted communication, it cannot decipher this session and thus is blind to any information that is being sent outside.

As the usage of encrypted traffic increases, this challenge will become even more pervasive. We are already beginning to see such cyber-attacks on many organizations for financial gain and access to valuable confidential data.

Many traffic inspection solutions such as data leakage prevention (DLP), intrusion prevention systems (IPS), and firewalls may not have the ability to decrypt outbound encrypted traffic, and therefore are blind to cyber threats initiated from within the organization to external servers. Furthermore, even when they can decrypt, the ability comes with a steep cost-performance impact and expense, making these systems less scalable and thus uneconomical.

Inspection and Visibility The Necessary Disinfectant

The key to protecting against such attacks is to inspect SSL traffic. So, how does the SSL traffic inspection work?

The SSL inspection systems take advantage of the fact that the security is between two endpoints and not end-to-end. Sometimes referred to as legitimate man-in-the-middle (MiTM), the SSL inspection solution intercepts and decrypts SSL sessions destined to and from the enterprise. These SSL inspection solutions appear as the intended external server for internal users or programs initiating secure communication to external servers. For the recipient servers, the SSL inspection system appears as the initiating user or malware program.

For ease of deployment, SSL inspection solutions may provide both transparent inspection without requiring the need to re-engineer the network or as explicit proxy that require all users to pass through a predefined SSL proxy configured via a users browser.

Then, the decrypted traffic is steered to any content inspection solution such as firewalls, anti-malware, or data leakage protection systems already deployed in the enterprise to check against an organizations security policies. Sessions that pass the security inspection are then re-encrypted by the SSL inspection solution and forwarded to their destination server.

[Like this post? Subscribe now to get the latest Radware content in your inbox weekly plus exclusive access to Radwares Premium Content. ]

For efficiency, some traffic may be untouched if a particular site is trusted by the enterprise or is related to employee privacy (online banking, healthcare). For productivity reasons, other traffic may be blocked, typically online gaming or known malware servers.

Since SSL decryption and re-encryption are computationally intensive operations and may impact latency, use best practices such as hardware acceleration if you have many users and encrypted traffic. Be selective with decryption by using filtering and whitelists to bypass decryption for sites that you trust, and choose solutions that reduce the number of devices you require to scale and are cost-effective.

Decrypting, inspecting, and gaining visibility to network traffic using SSL inspection solution helps identify red flags that may indicate malware. Furthermore, adopting the best practices: least privilege access, multi-factor authentication while stopping web malware injections using web application firewalls, and protecting network perimeter against denial of service while educating the workforce on cybersecurity practices help reduce an enterprises exposure to these malware threats.

[You may also like: How to Respond to a DDoS Ransom Note]

More:
Why Inspecting Encrypted Traffic Is A Must - Security Boulevard

If Your Private Key Gets Compromised, So Will Your Encrypted Data Its Why Key Management Systems Are Critical For Any Business Using Encryption

Do you know where your car keys are right now? Your house keys? Considering how important they are, we hope so (or else youll be taking an Uber home and then calling a locksmith). You also probably have a set place for them to reside when you arent using them somewhere secure, like inside your house or in your pocket.

If youre using encryption for any purpose, then you should have a similar system in place for your private keys. They are the critical piece of the cryptographic equation that, when combined with an algorithm, is the key (pun very much intended) to transforming encrypted ciphertext into plaintext that you and I can read.

One of the best things about encryption is that, if used properly, it is essentially impossible to crack. The private keys are one of the weak points, however. If someone gets their hands on yours then theyll be able to decipher the sensitive information that you intended to keep safe and secure. Thus, cryptography keys are one of the most crucial assets that any company has, with the value of the key being equal to that of your most vital data.

Whats the best way to keep your encryption keys safe from cybercriminals? Thats where key management systems come into play. They play a critical role in protecting and managing your keys, which can be especially difficult as a business scales and a handful of keys suddenly turns into hundreds, thousands, or more.

So, what does key management mean, exactly? What are the benefits of using a key management system? And what are the different types of key management platforms?

Lets hash it out.

When we talk about key management, were referring to all the tasks relating to cryptographic keys in an encryption system creation, usage, storage, exchanging, archiving, deleting, and replacing. The overall goal is to protect every key that an organization has, preventing attackers and unauthorized users from getting their hands on the data that has been secured via encryption.

Nowadays, companies possess more data than ever, with significant portions of it being sensitive information that must be protected. Because of the potential value of this data to cybercriminals, more and more businesses have turned to encryption to protect against an uptick in security breaches, prevent costly data losses, and remain compliant to regulatory requirements. Its now to the point that having thousands of cryptographic keys is commonplace, with key management systems (KMS) becoming the primary way of safely, securely, and efficiently handling them all.

Key management covers all of the keys in a cryptosystem at the user level, between either users or the system itself. An effective key management system should be robust and have comprehensive policies for:

There are three broad approaches that can be taken for key management systems:

We recommend a centralized approach in the vast majority of situations, finding that one single system is much easier to manage (with less potential for mistakes or oversights) and avoids contradictions or conflicts between teams or users. Even if different departments have drastically different needs, it is still better to make sure that everyone is on the same page as far as the basic protocols and requirements. Centralize your KMS as much as possible.

Without a proper management system in place, keys can be lost or compromised, resulting in lost access to critical data. Unfortunately, key management gets harder and harder as the size and complexity of your cryptographic ecosystem increases. Key management systems are designed to address the challenges that organizations face when dealing with cryptographic keys, things like:

Now lets go into more detail regarding the benefits that key management bring to a business and the reasons for implementing such systems.

The features of key management systems help boost security thanks to technical elements that help prevent lost, stolen, or misused keys by:

Many organizations turn to encryption because its a requirement of local laws or industry regulations. The specifics of the requirements can vary widely depending on industry, location, and other factors, but no matter what, companies want to avoid the costly fines and penalties that result from non-compliance.

Therefore, key management systems act as a kind of insurance, adding an extra layer of security for data that must be kept safe and confirming that the necessary precautions have been taken ahead of time in order to remain compliant with standards like:

Key management systems are designed to simplify, automate, and scale, which translates to reduced costs for organizations by:

Its the primary goal of encryption in the first place, and key management systems help maximize data protection. It empowers businesses to be selective about key access, only allowing certain employees, applications, or devices to access the keys, and thus the encrypted data they protect. The controls provided by key management systems play a crucial role in preventing valuable information from making its way into the hands of unauthorized or hostile users.

If a simple spreadsheet or list of keys sounds like a good idea, think again. Modern key management systems give users the ability to easily and efficiently manage their keys at every point in the lifecycle. There are different types of key management platforms that have different advantages and disadvantages depending on the needs of the end user. Regardless though, theres a few attributes you always want to look for:

As far as the platforms themselves, they can be broken down into a few basic types:

HSM stands for hardware security module, and is a kind of server that has additional levels of security levels in order to prevent breaches:

HSMs can be used to generate keys, keep them safe from electronic or physical attacks, and make use of the keys within while performing encryption or decryption tasks. An HSM can be used as a key management system, but there are downsides:

This is the same as above, except that the HSM is in the cloud, hosted by a third party provider. These are ideal for companies that are lacking in security resources and cant properly implement an HSM themselves or want to move their security off-site for any other reason. The same hardening measures are still present on the HSMs themselves, theyre just in a different physical location than the end user.

Virtual instances of key management systems offer a few different advantages over HSMs. First off, deployment is usually a much quicker process. HSMs are a physical product that need to be shipped somewhere. Then, a physical installation is needed. A virtual instance on the other hand, can be downloaded from a vendors server in a few minutes and no physical installation is required. Virtual systems also provide more flexibility than HSMs, since they can be installed on any machine that supports the virtual platform running the key manager, such as VMWare.

The virtual element can also be a downside, however. Because theres no physical components, the software of the key manager cannot be FIPS 140-2 validated it can only be FIPS 140-2 compliant. If youre required to have FIPS-140-2 validation by any particular regulations, then youll have to go with an HSM instead. Usually, though, the level of security given by a FIPS 140-2 compliant key manager system is more than enough for the average company.

A key manager system can also be dedicated, or as a service. This kind of configuration is offered by cloud providers like Amazon Web Services (AWS) or Microsoft Azure, which have marketplace offerings in addition to their own key management as a service (KMaaS) systems. These systems are usually multi-tenant, which can be viewed as a negative since it means that several different end users will have their keys stored on the same key manager instance. For clients with security concerns, this type of system is not ideal. Because of this, dedicated services are also usually offered by providers via independent vendors.

Its critical that every organization make key security a high priority, no matter what type of key management system they end up going with in the end. Key management systems make life much easier for end users, while maximizing security at the same time. Sensitive data needs to be restricted, and key management systems provide the kind of organization and control that will ultimately keep it out of the hands of attackers.

Link:
The Ultimate Guide to Key Management Systems - Hashed Out by The SSL Store - Hashed Out by The SSL Store

China is actually all in on crypto. Make no mistake about that, Haun said on Squawk Box, despite its latest crackdown on bitcoin mining and crypto services. The Chinese governments five-year plan drafted earlier this year for the first time mentioned blockchain, which is the decentralized digital ledger technology that underpins cryptocurrencies such as bitcoin.

Chinas most recent actions to restrict bitcoin mining in the country and apply pressure to financial services firms against providing crypto-related services has weighed on sentiment in crypto markets.

However, she stressed that Chinese President Xi Jinping and other officials are all in on their brand of crypto, which is a closed permission system. Kind of at odds with the open, decentralized protocols we see as the future of the crypto system.

Bitcoin on Tuesday fell below $30,000 and, at one point even further, briefly losing all of its 2021 gains. The worlds largest cryptocurrency has recovered somewhat, trading at nearly $34,000 on Thursday.

This is hardly the first time China has put restrictions on bitcoin, Haun noted. In 2017, the country moved to shutdown local crypto exchanges, which forced them to move offshore. It did not, however, put an end to the influence of Chinese bitcoin traders.

China also has long been home to more than half of the worlds bitcoin mining capacity; so-called miners use high-powered computers to verify transactions across the blockchain network and are rewarded for their efforts with bitcoin.

The fact China is now ratcheting up its crackdown, Haun said, ultimately reflects the staying power of open decentralized crypto like bitcoin because weve seen this happen before.

Hauns appearance on CNBC came shortly after Andreessen Horowitz announced it was launching a $2.2 billion cryptocurrency-focused fund.

So, I think China is going all in on crypto in a big way and this is a big opening for western societies, and the U.S. included, to lean in, she said.

The well-known Silicon Valley venture capital firm has been involved in the digital asset industry for years, debuting its first dedicated fund in 2018 even as bitcoin and other cryptocurrencies withered during the so-called crypto winter. Haun, also a former Justice Department prosecutor, and Chris Dixon, who founded and ran two start-ups, are in charge of Andreessen Horowitzs crypto group.

Andreessen Horowitz was also the largest outside investor in Coinbase at the time of the crypto exchanges direct listing in April. Haun is a Coinbase board member.

Bitcoins all-time high of nearly $65,000 came on the same day of Coinbases public debut. That day, April 14, was also when Coinbase hit its intraday record of $429.54 per share.

Both the cryptocurrency and Coinbase shares are currently well below those levels. Coinbase traded at around $228 per share Thursday.

Disclaimer: If you need to update/edit/remove this news or article then please contact our support team.

See original here:
China 'all in' on its own encryption brand - BollyInside