Page 3,243«..1020..3,2423,2433,2443,245..3,2503,260..»

Cybersecurity wars and the companies combating incursions – Finfeed

December 11, 2020 | Author: admin

Everyone grasps, on some level, that cyber-security or more correctly, the cyber-crime at which cyber-security is aimed is a big problem. But when you really look into it, the scale of the cyber-crime problem is truly staggering.

According to leading industry research firm Cybersecurity Ventures, cyber-crime is predicted to inflict US$6 trillion ($8.1 trillion) in damage globally in 2021, up from US$3 trillion in 2015: if it were measured as a country, that would make cybercrime the worlds third-largest economy, after the US and China.

Cybersecurity Ventures 2020 Official Annual Cybercrime Report says cybercrime is the greatest threat to every company in the world, and one of the biggest problems with mankind: it is bigger than the illegal drug trade. The report quotes Jack Blount, former chief information officer at the United States Department of Agriculture (USDA), and now chief executive officer at enterprise security software company INTRUSION, as saying: Every American organization in the public and private sector has been or will be hacked, is infected with malware, and is a target of hostile nation-state cyber intruders.

In fact, Blount prefers the term cyber-warfare to cyber-crime.

Last year, Chinese tech giant Huawei admitted that it endures about one million cyber-attacks on its computers and networks every day.

Cyber-security consultant Tony Barnes, director of Cyber Research Group, told this writer last year, When you switch servers on, theyre like magnets in the way they attract attacks. Barnes said that showing organisations the scale of the constant attacks on them is a penny-dropping moment: When people visualise it, it scares the pants off them, he said.

The level of threat is reinforced seemingly every week with news of high-profile hackings and data breaches. Last month, Prestige Software, a company that services hotel reservation platforms for Hotels.com, Booking.com, Expedia and more, reportedly left exposed the data of millions of those sites customers, including names, credit card details, ID numbers and reservation details. Also in November, US networking equipment vendor Belden admitted to being hacked, and even global cyber security firm Sophos owned up to suffering a data security breach.

This week, cybersecurity firm FireEye was the victim of a state-sponsored cyber-attack.

The $3.5 billion FireEye identifies the culprits of some of the worlds major cyber hacks and counts Sony and Equifax as its clients.

According to FireEye, one of ASX listed WhiteHawk's vendors (see below), the hack was carried out by a nation with top-tier offensive capabilities.

Though not named, fingers have been pointed at Russian intelligence agencies.

Hackers accessed FireEye's internal network and stole its red team tools, which could be useful in mounting new attacks around the world.

FireEye CEO, Kevin Mandia said of the attack, "Based on my 25 years in cyber security and responding to incidents, I've concluded we are witnessing an attack by a nation with top-tier offensive capabilities... The attackers tailored their world-class capabilities specifically to target and attack FireEye.They used a novel combination of techniques not witnessed by us or our partners in the past."

The breach is now being investigated by the FBI and Microsoft.

The hack raises the possibility that Russian intelligence agencies saw an advantage in mounting the attack while American attention including FireEyes was focused on securing the presidential election system, Mandis said.

This is potentially the biggest known theft of cybersecurity tools since 2016 when ShadowBrokers group targeted the NSA and dumped their hacking tools online.

This list of major hacks just in 2020 from IT newsletter/website ZDNet makes sobering reading.

However, the silver lining to the cyber-crime pandemic is that there are very smart people working on cyber-security solutions and in many cases, these companies are investable stocks. As befits the scale of the problem, cyber-security is emerging as one of the biggest secular investment theme of the 2020s.

The Australian Securities Exchange (ASX) hosts a small but intriguing group of cyber-security companies, including:

WhiteHawk (WHK)

Headquartered in Virginia, USA, WhiteHawk developed and operates the first online cybersecurity exchange, enabling businesses of all sizes to manage cybersecurity threats. This year, WhiteHawk has won a range of contracts (and contract extensions) across four main sectors the US government sector (a US agency and a department), the manufacturing sector, the financial sector and the Defence Industrial Base (DIB), the term for the worldwide industrial complex that enables research and development, as well as design, production, delivery, and maintenance of military weapons systems, subsystems, and components or parts, to meet US military requirements.

WhiteHawk has built its cyber-risk-focused business model to give it commercial and technical agility, being able to partner with the best open data and AI-enabled platforms, allowing the company to continually evolve to align with customer needs and appetites. It has positioned itself well in the US cyber-risk market, across companies and organisations of all sizes, and is now seeking to increase its business internationally.

Read: Delivering Cybersecurity Solutions

Tesserent (TNT)

Cyber-security and network services company Tesserent provides Internet security-as-a-service for a customers computer infrastructure, including firewall, authentication, anti-virus, anti-malware/spyware, intrusion detection, and security event management, typically provided on a subscription basis. Its customers both Australian and international come from the government, corporate and education fields. The companys products and services include network perimeter security, secure internet connectivity, data storage services, and internal network security services. The company has made a series of high-value strategic acquisitions recently, and in November, Tesserent announced that it will step into the real world, with a new joint venture with New Zealand firm Optic Security Group that will incorporate both cyber and physical security solutions.

Senetas (SEN)

Senetas provides data encryption hardware, engineered for high-speed networks, to major corporations and governments. Senetas encryptors now protect network transmitted data in more than 35 countries, and are used by customers ranging from government organisations with highly sensitive information, for example, the US defence forces, to commercial and industrial organisations, banks and global financial transactions systems providers, cloud and data centre service providers and small businesses. Senetas services segment offers its customers absolute control over file sharing and data sovereignty through its platform SureDrop. In 2020, Senetas acquired Israeli cyber-security firm Votiro, a leading provider of Content Disarm and Reconstruction (CDR) technologies, which markets its Disarmer and Secure File Gateway solutions globally for a wide range of applications, including file-transfer, email, removable devices and collaboration platforms.

archTIS (AR9)

Canberra-based archTIS has developed a cloud-based software-as-a-service (SaaS) security and collaboration platform called Kojensi, which arose out of a solution built for the Australian Department of Defence, and further developed in trials involving a number of Australian Federal Government agencies, including the Commonwealth Attorney Generals Department (AGD) and the federal Aged Care Royal Commission. The system has subsequently been deployed in the AGD, the Commonwealth Ombudsman and the Australian Criminal Intelligence Agency, and the first non-government clients, in aerospace giant Northrop Grumman and Western Australias Curtin University. archTIS is marketing the Kojensi platform to industries that service the government, and which also need to share sensitive and classified information.

Kojensi is hosted within a protected cloud environment accredited by the Australian Signals Directorate (ASD). The platform is being marketed as a secure content and collaboration cloud service, which offers a combination of enterprise content management capabilities, collaboration tools and workflows. Instead of using passwords, the Kojensi platform creates an electronic fingerprint on the data or documents, determining who can access the material, where, and when.

Also, Australian company VeroGuard is targeting a dual listing on the ASX and Singapores SGX over the next 12 months, as it seeks to commercialise its VeroCard product, which centres around the creation of a unique digital identity for individual users, based on the interbank communication protocols, applied to the internet. The VeroCard technology which will be manufactured in Adelaide removes traditional password and online identity problems, and guarantees a users identity online: company founder Daniel Elbaum says it is impossible to hack, as there is no known source of encryption. In October, VeroCard received the highest security certification available from the US-based Payment Card Industry Security Standards Council.

For investors who want a broadly diversified exposure to the cyber-security theme and the expected boom in cyber-security spending, the ASX also hosts the BetaShares Global Cybersecurity ETF (exchange-traded fund), under the code HACK. The HACK portfolio is 89.5% invested in US companies, with Israel (3.3%) and the UK (3.1%) the next-largest allocations. Systems software dominates the industry breakdown, at 51.9% of the portfolio, followed by IT Consulting (15.4%), internet services and infrastructure (12%) and communications equipment (11.9%).

HACK is designed to track (before fees and expenses) the Nasdaq Consumer Technology Association Cyber-Security Index, which comprises 43 companies. This is a diversified collection of companies, but most are small and mid-cap companies that are not well-known in Australia. At present the five largest holdings are: Crowdstrike Holdings (6.7% of the portfolio), Okta (6.3%), ZScaler (6%), Accenture (6%) and Cisco Systems (5.9%).

Since inception in August 2016, the HACK ETF has earned its Australian investors 19.2% a year, lagging its index, on 19.8% a year. In the three years to November 30, HACK generated 21.4% a year, versus 22% for the index.

HACK costs 0.67% a year in management fees. It is not currency hedged, so returns can be affected by foreign exchange fluctuations.

See more here:
Cybersecurity wars and the companies combating incursions - Finfeed

Read More..
Posted in Internet Security | Leave a Comment

Top Andriod Security Apps Of 2020 – Mfidie.com

December 11, 2020 | Author: admin

Despite Googles best efforts in Android security, no code out there can bulletproof it which is why everyone can benefit from installing an anti-virus or security app to get themselves some peace of mind.

The popular apps from established brands with long years of experience in securing desktop & other operating systems. Here are five top-shelf Android security and antivirus apps that you can use to protect your device for free.

CM security prize itself on the antivirus engine thats why repeatedly they ranked first in tests. Which is able to

The app can scan external SD cards to detect and delete threats, scan new applications, update installations in real-time, carry out scheduled scans, block unwanted phone calls to prevent harassment, and block phishing websites.

Avast is an old-time reliable defender against infected files, unwanted privacy, phishing malware, spyware, and viruses. The latest version contains features previously reserved for subscribers that have now become completely free. Avasts antivirus engine can:

No-root firewall isnt as slick as the other android security solutions listed here but serves its purpose well unlike other apps that require root privileges to do the same things.

This firewall delivers hostname, domain name filtering, fine-grained access control, and requires no suspicious permissions such as location, phone number data all of that is combined in a simple interface.

Kaspersky Labs is an award-winning android security application that is available on mobile devices. It protects the private and sensitive information stored in your smartphones and tablets against any mobile threats viruses spyware triads and intrusions. Its focus on web protection but also featuring capable file scanning Kaspersky internet security to block malicious websites while you surf the web.

Kaspersky also contains tools for remotely controlling your device in the event it gets lost or stolen. The app is also able to filter unwanted calls and messages to hide personal communication.

Kaspersky is also present on Android wear smartwatches with the ability to display notifications, send commands, or listen for voice control.

Malwarebytes is a famous anti-malware app by Malwarebytes Corporation that is upon Android to taking care of Trojan, ends malicious code, potentially unwanted programs links to malicious websites and incoming text messages, apps tracking location without your consent, and other security vulnerabilities. It features:

Merry Christmas and a Happy new year to you. Thank you for making Mfidie.com Ghana's Biggest Tech Blog.

You are the reason we produce quality digital content. Scroll down to read more onMfidie.com.

Follow us onTwitter,FB, IG, Telegram&YouTube

We accept Guest Posts. If youd like to write for us, contact us for PR or to submit an article click here.

Read more here:
Top Andriod Security Apps Of 2020 - Mfidie.com

Read More..
Posted in Internet Security | Leave a Comment

Here’s why the internet crashes thousands of times a year – RTE.ie

December 11, 2020 | Author: admin

Analysis: the internet is currently a cyber Wild West, but its outlaw days may be slowly coming to an end

ByVasileios Giotsas, Lancaster University

How could a small internet service provider (ISP) in Pennsylvania cause millions of websites worldwide to go offline? Thats what happened on June 24th2019 when users across the world were left unable to access a large fraction of the web. The root cause was an outage suffered by Cloudflare, one of the internets leading content hosts on which the affected websites relied.

Cloudflare traced the problem to a regional ISP in Pennsylvania that accidentally advertised to the rest of the internet that the best available routes to Cloudflare were through their small network. This caused a massive volume of global traffic to the ISP, which overwhelmed their limited capacity and so halted Cloudfares access to the rest of the internet. As Cloudflare remarked, it was the internet equivalent of routing an entire freeway through a neighbourhood street.

This incident has highlighted the shocking vulnerability of the internet. In 2017 alone, there were about 14,000 of these kinds of incidents. Given it is mission-critical for much of the worlds economic and social life, shouldnt the net be designed to withstand not just minor hiccups but also major catastrophes, and to prevent small problems turning into much bigger ones? Governing bodies such as the EU Agency for Network and Information Security (ENISA) have long warned of the risk of such cascading incidents in causing systemic internet failure. Yet the internet remains worryingly fragile.

We need your consent to load this YouTube contentWe use YouTube to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences

From BBC Click, how does the internet actually work?

Like a road network, the internet has its own highways and intersections that consist of cables and routers. The navigation system that manages the flow of data around the network is called the Border Gateway Protocol (BGP). When you visited this website, BGP determined the path through which the sites data would be transmitted to your device.

The problem is that BGP was designed only to be a temporary fix, a "good enough" solution when the internet was rapidly growing in the late 1980s. It then proved good enough to help the net sustain its explosive expansion and quickly became part of every backbone router that manages the flow of data down the internets principal pathways. But it wasnt built with security in mind, and mechanisms to ensure that the paths BGP sends data down are valid have never been added. As a result, routing errors go undetected until they cause congestion and outages.

The tussle between thesedifferent players with competing interests means they don't have incentives to make their own part of the internet more secure

Even worse, anyone who can access a backbone router (and doing so is trivial for someone with the right knowledge and budget) can construct bogus routes to hijack legitimate data traffic, disrupt services and eavesdrop on communications. This means the modern internet operates using an insecure protocol that is exploited on a daily basis to compromise communications from governments, financial institutions, weapon manufacturers and cryptocurrencies, often as part of politically-motivated cyber-warfare.

These issues have been known about at least since 1998, when a group of hackers demonstrated to the US Congress how easy it was to compromise internet communications. Yet, little has changed. Deploying the necessary cryptographic solutions turned out to be as hard as changing the engines of an airplane in mid-flight.

In an actual aviation issue, such as the recent issues with Boeings 737 MAX aircraft, regulators have the authority to ground an entire fleet until it is fixed. But the internet has no centralised authority. Different parts of the infrastructure are owned and operated by different entities, including corporations, governments and universities.

The tussle between thesedifferent players, which often have competing interests, means they dont have incentives to make their own part of the internet more secure. An organisation would have to bear the significant deployment costs and operational risks that come with a switch to a new technology, but it wouldnt reap any benefits unless a critical mass of other networks did the same.

The most pragmatic solution would be to develop security protocols that dont need global coordination. But attempts to do this have also been impeded by the decentralised ownership of the internet. Operators have limited knowledge of what happens beyond their networks because of companies desires to keep their business operations secret.

We need your consent to load this rte-player contentWe use rte-player to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences

From RT 2fm's Dave Fanning Show, Accenture security lead and vice-chairperson of Cyber Security Ireland Jacky Fox onwhat we can do to prevent security breaches

As a result, today nobody has a complete view of our societys most critical communications infrastructure. This hinders efforts to model the internets behaviour under stress, making it harder to design and evaluate trustworthy solutions.

The direct implications of this bleak situation on national security have led government agencies to intensify their activities to protect their critical internet infrastructure. For example, the UK National Cyber Security Centre (NCSC) recently launched the Active Cyber Defence (ACD) program, which puts the security of internet routing among its top priorities.

As part of this program, my own research involves mapping the internet at an unprecedented level of detail. The aim is to illuminate hidden locations where the infrastructure is particularly susceptible to attack and responsible for cascading failures.

At the same time, new initiatives are attempting to make security a more routine consideration for people who work for organisations controlling internet infrastructure.

As we become more economically dependent on the internet, the cost of outages will grow further. And the advent of cryptocurrencies, whose transactions are fundamentally vulnerable to BGP hijacking attacks, could finally make resolving this problem a priority for internet infrastructure businesses.

Its no exaggeration to say that the internet is currently a cyber Wild West. But after two decades of ineffectual efforts, theres a chance the outlaw days may slowly be nearing to an end.

Vasileios Giotsasis a Lecturer in Computing and Communications atLancaster University. This piece originally appeared inThe Conversation.

The views expressed here are those of the author and do not represent or reflect the views of RT

Read more here:
Here's why the internet crashes thousands of times a year - RTE.ie

Read More..
Posted in Internet Security | Leave a Comment

Encrypted messaging could increase child abuse cases, report warns – E&T Magazine

December 9, 2020 | Author: admin

Millions of children in England are using messaging platforms that they are not old enough to be accessing and the introduction of end-to-end encryption (E2EE) could increase their risk of exploitation, the Childrens Commissioner for England has warned in a report.

The Commissioner'sreport follows announcements by Facebook- and indications by other social platforms, such as Snap - that they plan to apply E2EE to all their messaging services.

The Commissioner said that E2EEmakes it impossible for the platform itself to read the contents of messages and risks preventing police and prosecutors from gathering the evidence they need to prosecute perpetrators of child sexual exploitation and abuse.

In January 2020, the NSPCC said that the number of child abuse cases had risen to 90 per day and called for regulators to tackle the issue.

The report includes a survey revealing the extent of childrens use of messaging services, including by children much younger than the minimum age requirement.

Nine out of ten children aged between 8-17 were found to be using messenger services, with 60 per cent of 8-year-olds and 90 per cent of 12-year-olds using a messaging app with an age restriction of 13 or older.Almost one in ten children report using a messaging service to talk to people they dont already know.

The report warns that the privacy of direct messaging platforms can conceal some of the most serious crimes against children, including grooming, exploitation and the sharing of child sexual abuse material.

An NSPCC investigation found that Facebook, Instagram and WhatsApp were used in child abuse images and online child sexual offences an average of 11 times a day in 2019.

It also found that the rate of grooming offences committed in the UK appears to have further accelerated over the course of lockdown, with 1,220 offences recorded in just the first three months of national lockdown.

Anne Longfield, the Childrens Commissioner for England called on the government to introduce online harms legislation to Parliament in 2021. The legislation should set a strong expectation on platforms to age verify their users and allow for strong sanctions against companies which breach their duty of care, she said.

Longfield further recommended the inclusion of GDPR-style fines and a requirement to issue notifications to users when tech firms are found to be in breach of their duty of care.

This report reveals the extent to which online messaging is a part of the daily lives of the vast majority of children from the age of 8. It shows how vigilant parents need to be, but also how the tech giants are failing to regulate themselves and so are failing to keep children safe, Longfield said.

The widespread use of end-to-end encryption could put more children at risk of grooming and exploitation and hamper the efforts of those who want to keep children safe.

It has now been 18 months since the Government published its Online Harms White Paper and yet little has happened since, while the threat to childrens safety increases.

Its time for the Government to show it hasnt lost its nerve and that it is prepared to stand up to the powerful internet giants, who are such a big part in our childrens lives. Ministers can show they mean business by promising to introduce legislation in 2021 and getting on with the job of protecting children from online harms.

Sign up to the E&T News e-mail to get great stories like this delivered to your inbox every day.

Original post:
Encrypted messaging could increase child abuse cases, report warns - E&T Magazine

Read More..
Posted in Encryption | Leave a Comment

A Balanced DNS Information Protection Strategy: Minimize at Root, TLD; Encrypt When Needed Elsewhere – CircleID

December 9, 2020 | Author: admin

Over the past several years, questions about how to protect information exchanged in the Domain Name System (DNS) have come to the forefront.

One of these questions was posed first to DNS resolver operators in the middle of the last decade, and is now being brought to authoritative name server operators: "to encrypt or not to encrypt?" It's a question that Verisign has been considering for some time as part of our commitment to security, stability and resiliency of our DNS operations and the surrounding DNS ecosystem.

Because authoritative name servers operate at different levels of the DNS hierarchy, the answer is not a simple "yes" or "no." As I will discuss in the sections that follow, different information protection techniques fit the different levels, based on a balance between cryptographic and operational considerations.

Rather than asking whether to deploy encryption for a particular exchange, we believe it is more important to ask how best to address the information protection objectives for that exchange whether by encryption, alternative techniques or some combination thereof.

Information protection must balance three objectives:

The importance of balancing these objectives is well-illustrated in the case of encryption. Encryption can improve confidentiality and integrity by making it harder for an adversary to view or change data, but encryption can also impair availability, by making it easier for an adversary to cause other participants to expend unnecessary resources. This is especially the case in DNS encryption protocols where the resource burden for setting up an encrypted session rests primarily on the server, not the client.

The Internet-Draft "Authoritative DNS-Over-TLS Operational Considerations," co-authored by Verisign, expands on this point:

Initial deployments of [Authoritative DNS over TLS] may offer an immediate expansion of the attack surface (additional port, transport protocol, and computationally expensive crypto operations for an attacker to exploit) while, in some cases, providing limited protection to end users.

Complexity is also a concern because DNS encryption requires changes on both sides of an exchange. The long-installed base of DNS implementations, as Bert Hubert has parabolically observed, can only sustain so many more changes before one becomes the "straw that breaks the back" of the DNS camel.

The flowchart in Figure 1 describes a two-stage process for factoring in operational risk when determining how to mitigate the risk of disclosure of sensitive information in a DNS exchange. The process involves two questions.

Figure 1 Two-stage process for factoring in operational risk when determining how to address information protection objectives for a DNS exchange.

This process can readily be applied to develop guidance for each exchange in the DNS resolution ecosystem.

Three main exchanges in the DNS resolution ecosystem are considered here, as shown in Figure 2: resolver-to-authoritative at the root and TLD level; resolver-to-authoritative below these levels; and client-to-resolver.

Figure 2 Three DNS resolution exchanges: (1) resolver-to-authoritative at the root and TLD levels; (2) resolver-to-authoritative at the SLD level (and below); (3) client-to-resolver. Different information protection guidance applies for each exchange. The exchanges are shown with qname minimization implemented at the root and TLD levels.

The resolver-to-authoritative exchange at the root level enables DNS resolution for all underlying domain names; the exchange at the TLD level does the same for all names under a TLD. These exchanges provide global navigation for all names, benefiting all resolvers and therefore all clients, and making the availability objective paramount.

As a resolver generally services many clients, information exchanged at these levels represents aggregate interests in domain names, not the direct interests of specific clients. The sensitivity of this aggregated information is therefore relatively low to start with, as it does not contain client-specific details beyond the queried names and record types. However, the full domain name of interest to a client has conventionally been sent to servers at the root and TLD levels, even though this is more information than they need to know to refer the resolver to authoritative name servers at lower levels of the DNS hierarchy. The additional detail in the full domain name may be considered sensitive in some cases. Therefore, this data exchange merits consideration for protection.

The decision flow (as generally described in Figure 1) for this exchange is as follows:

Interestingly, while minimization itself is sufficient to address the disclosure risk at the root and TLD levels, encryption alone isn't. Encryption protects against disclosure to outside observers but not against disclosure to (or by) the name server itself. Even though the sensitivity of the information is relatively low for reasons noted above, without minimization, it's still more than the name server needs to know.

Summary: Resolvers should apply minimization techniques at the root and TLD levels. Resolvers and root and TLD servers should not be required to implement DNS encryption on these exchanges.

Note that at this time, Verisign has no plans to implement DNS encryption at the root or TLD servers that the company operates. Given the availability of qname minimization, which we are encouraging resolver operators to implement, and other minimization techniques, we do not currently see DNS encryption at these levels as offering an appropriate risk / benefit tradeoff.

The resolver-to-authoritative exchanges at the SLD level and below enable DNS resolution within specific namespaces. These exchanges provide local optimization, benefiting all resolvers and all clients interacting with the included namespaces.

The information exchanged at these levels also represents the resolver's aggregate interests, but in some cases, it may also include client-related information such as the client's subnet. The full domain names and the client-related information, if any, are the most sensitive parts.

The decision flow for this exchange is as follows:

Summary: Resolvers and SLD servers (and below) should implement DNS encryption on their exchanges if they are sending sensitive full domain names or client-specific information. Otherwise, they should not be required to implement DNS encryption.

The client-to-resolver exchange enables navigation to all domain names for all clients of the resolver.

The information exchanged here represents the interests of each specific client. The sensitivity of this information is therefore relatively high, making confidentiality vital.

The decision process in this case traverses the first and second steps:

Summary: Clients and resolvers should implement DNS encryption on this exchange, unless the exchange is otherwise adequately protected, for instance as part of the network connection provided by an enterprise or internet service provider.

The following table summarizes the guidance for how to protect the various exchanges in the DNS resolution ecosystem.

In short, the guidance is "minimize at root and TLD, encrypt when needed elsewhere."

If the guidance suggested here were followed, we could expect to see more deployment of minimization techniques on resolver-to-authoritative exchanges at the root and TLD levels; more deployment of DNS encryption, when needed, at the SLD levels and lower; and more deployment of DNS encryption on client-to-resolver exchanges.

In all these deployments, the DNS will serve the same purpose as it already does in today's unencrypted exchanges: enabling general-purpose navigation to information and resources on the internet.

DNS encryption also brings two new capabilities that make it possible for the DNS to serve two new purposes. Both are based on concepts developed in Verisign's research program.

You can read more about these two applications in my recent blog post on this topic, Authenticated Resolution and Adaptive Resolution: Security and Navigational Enhancements to the Domain Name System.

The rest is here:
A Balanced DNS Information Protection Strategy: Minimize at Root, TLD; Encrypt When Needed Elsewhere - CircleID

Read More..
Posted in Encryption | Leave a Comment

Protecting consumer data is leading driver for encryption in Middle East: report – Gulf Business

December 9, 2020 | Author: admin

Protecting consumer personal information is the top driver for deploying encryption in the Middle East region, a new study by Entrust has found.

According to the Middle East Entrust 2020 Middle East Encryption Trends study by the data protection technology company, 67 per cent of respondents placed protecting consumer data above protecting intellectual property (59 per cent), protecting information against specific identified threats (40 per cent) and complying with external privacy or data security regulations (34 per cent).

The study says employee mistakes continue to be the biggest threat to sensitive data (60 per cent) and significantly outweigh concerns over attacks by hackers (32 per cent) or malicious insiders (19 per cent), but the threats posed by hackers has increased significantly from 25 per cent in 2019.

The study indicates that 78 per cent of respondents in the Middle East have adopted an encryption strategy which is either enterprise-wide or limited to particular deployments. This is lower than the global average of 87 per cent.

The study found that financial records (54 per cent) and intellectual property (52 per cent) are the most common types of data encrypted by Middle East organisations

Read: How data is quantifying the impact of plastic on the environment

In the near term, 51 per cent of respondents plan to use blockchain for encryption, with cryptocurrency/wallets and asset transactions cited at the top use cases. Other much-hyped encryption technologies are not on IT organisations near-term radar. Most IT professionals see the mainstream adoption of multi-party computation at least five years away, with the mainstream adoption of homomorphic encryption more than six years away, and quantum-resistant algorithms over eight years out, all of which are in line with global trends.

Sixty percent of respondents say their organisations currently transfer sensitive or confidential data to the cloud and 27 per cent of respondents plan to do so in the next 12 to 24 months. The region also rates support for cloud and on-premises deployment (92 per cent) as the most important feature associated with encryption solutions, far ahead of the global average of 67 per cent.

Organisations are under relentless pressure to deliver high security and seamless access to their customer data, business-critical information and applications while ensuring business continuity, said Philip Schreiber, regional sales director-Data Protection Solutions, for Entrust.

The 2020 Global Encryption Trends Study shows the Middle Easts focus on protecting customer information and intellectual property to be much higher than the global average, which is laudable and shows the region setting benchmarks in this regard.

Read the original here:
Protecting consumer data is leading driver for encryption in Middle East: report - Gulf Business

Read More..
Posted in Encryption | Leave a Comment

Insights on the Cloud Encryption Software Market 2020-2024: COVID-19 Industry Analysis, Market Trends, Market Growth, Opportunities and Forecast 2024…

December 9, 2020 | Author: admin

LONDON--(BUSINESS WIRE)--The cloud encryption software market is expected to grow by $ 2.82 bn, progressing at a CAGR of over 38% during the forecast period.

Click & Get Free Sample Report in Minutes

The increasing use of in-built cloud encryption solutions is one of the major factors propelling market growth. However, factors such as high capital investment for deployment will hamper the market growth.

More details: https://www.technavio.com/report/cloud-encryption-software-market-industry-analysis

Cloud Encryption Software Market: End-user Landscape

Based on the end-user, the BFSI segment is expected to witness lucrative growth during the forecast period.

Cloud Encryption Software Market: Geographic Landscape

By geography, North America is going to have a lucrative growth during the forecast period. About 38% of the markets overall growth is expected to originate from North America. The US is the key market for cloud encryption software market in North America.

Buy 1 Technavio report and get the second for 50% off. Buy 2 Technavio reports and get the third for free.View market snapshot before purchasing

Related Reports on Information Technology Include:

Companies Covered:

What our reports offer:

Technavio suggests three forecast scenarios (optimistic, probable, and pessimistic) considering the impact of COVID-19. Technavios in-depth research has direct and indirect COVID-19 impacted market research reports.

Register for a free trial today and gain instant access to 17,000+ market research reports.Technavio's SUBSCRIPTION platform

Key Topics Covered:

Executive Summary

Market Landscape

Market Sizing

Five Forces Analysis

Market Segmentation by End-user

Customer landscape

Geographic Landscape

Vendor Landscape

Vendor Analysis

Appendix

About Us

Technavio is a leading global technology research and advisory company. Their research and analysis focuses on emerging market trends and provides actionable insights to help businesses identify market opportunities and develop effective strategies to optimize their market positions. With over 500 specialized analysts, Technavios report library consists of more than 17,000 reports and counting, covering 800 technologies, spanning across 50 countries. Their client base consists of enterprises of all sizes, including more than 100 Fortune 500 companies. This growing client base relies on Technavios comprehensive coverage, extensive research, and actionable market insights to identify opportunities in existing and potential markets and assess their competitive positions within changing market scenarios.

View post:
Insights on the Cloud Encryption Software Market 2020-2024: COVID-19 Industry Analysis, Market Trends, Market Growth, Opportunities and Forecast 2024...

Read More..
Posted in Encryption | Leave a Comment

Commercial Encryption Software Market Trends, Growth, Analysis, Opportunities and Overview by 2026 – Murphy’s Hockey Law

December 9, 2020 | Author: admin

Global Commercial Encryption Software Market Research Report 2020

The Report 2020-2026 Global Commercial Encryption Software Market Report Industry analyses the important factors of this market based on present industry situations, market demands, business strategies utilized by Commercial Encryption Software market players and their growth synopsis. This report divides based on the key players, Type, Application and Regions are Mentioned Below.

The new research report on Commercial Encryption Software market intends to offer a competitive edge to enterprises prevailing in this industry vertical through a comprehensive assessment of the market outlook, its history and other major development trends. The study allows companies to analyse the current dynamics and prospects in order to articulate effective business strategies.

Request a sample Report of Commercial Encryption Software Market at:https://www.reportsandmarkets.com/sample-request/global-commercial-encryption-software-market-size-status-and-forecast-2020-2026?utm_source=murphyshockeylaw&utm_medium=24

The document elaborates on the growth drivers and opportunities that define the profitability graph of this market during the study duration. It also enlists the challenges and restraints faced by the industry participants.

The study offers a comparative evaluation of the past and the existing market trends in order to derive the industry growth rate in the subsequent years. Apart from this, it also measures the effect of COVID-19 pandemic on the regional as well as the overall market.

Key Players: Dell, Eset, Gemalto, IBm, Mcafee, Microsoft, Pkware, Sophos, Symantec, Thales E-Security, Trend Micro, Cryptomathic, Stormshield, Sangfor Technologies Inc., Zhongfu, Venustech, and FEITIAN

Major Highlights from the Table of Contents:

1 Study Coverage: Commercial Encryption Software Market 2020

2 Executive Summary

3 Global Commercial Encryption Software by Manufacturers

4 Company Profiles

5 Breakdown Data by Type

6 Breakdown Data by Application

7 North America

8 Asia-Pacific

9 Europe

10 Latin America

11 Middle East and Africa

12 Supply Chain and Sales Channel Analysis

13 Market Dynamics

14 Commercial Encryption Software Market Research Findings and Conclusion

15 Appendix

Regional landscape:

The report answers key questions such as:

Comprehensive assessment of all opportunities and risks in the Commercial Encryption Software market.

In a nutshell, the Commercial Encryption Software market report offers in-depth assessment of various segmentations, while elaborating on the sales channel & supply chain processes deployed which consists of upstream suppliers, raw materials vendors, distributors, and downstream consumers.

For More Details On this Report:https://www.reportsandmarkets.com/sample-request/global-commercial-encryption-software-market-size-status-and-forecast-2020-2026?utm_source=murphyshockeylaw&utm_medium=24

About Reports And Markets:

Market research is the new buzzword in the market, which helps in understanding the market potential of any product in the market. Reports And Markets is not just another company in this domain but is a part of a veteran group called Algoro Research Consultants Pvt. Ltd. It offers premium progressive statistical surveying, market research reports, analysis & forecast data for a wide range of sectors both for the government and private agencies all across the world.

Contact Us:

Sanjay Jain

Manager Partner Relations & International Marketing

http://www.reportsandmarkets.com

Ph: +1-352-353-0818 (US)

Read this article:
Commercial Encryption Software Market Trends, Growth, Analysis, Opportunities and Overview by 2026 - Murphy's Hockey Law

Read More..
Posted in Encryption | Leave a Comment

Does opening a ‘back door’ to encrypted communications create a whole new raft of problems? How can firms promise privacy if there is official access?…

December 9, 2020 | Author: admin

This article originally appeared in LawNews (ADLS) and is here with permission.

By Diana Clement

The New Zealand government, along with its Five Eyes intelligence partners, has called for tech firms to open a back door to encrypted communications to make it easier for law enforcement to access information.

What are the implications for law firms and their clients data?

Just five days before this years election, when the countrys attention was fixated on politics, Andrew Little then Justice Minister and now the minister responsible for both the GCSB and NZSIS signed a controversial statement asking technology companies such as Facebook, Google and Apple to allow access to encrypted communications and data passing through their services.

Australia has already come to the party. The controversial Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 enables Australian law enforcement and intelligence agencies to compel anyone providing a service or product that involves telecommunications or the internet to remove electronic protection, such as encryption.

Not only is it an offence not to comply but those required to turn over information are not permitted to disclose that the compulsion order even exists. New Zealand organisations which store information on Australian servers have been warned that their data might be at risk.Read more.

Tech companies encrypt ie, scramble - their users messages, audio and video communications from end to end, meaning they cant be accessed by others. This gives individuals, businesses and other organisations total privacy, but is a significant barrier to legal access to those messages by law enforcement.

The Five Eyes countries, along with Japan and India which also signed the agreement, argue that unbreakable encryption technology creates severe risks to public safety, in particular to vulnerable groups such as sexually exploited children. But any back door will affect all internet users.

And the statement Little signed is inconsistent with New Zealands cybersecurity strategy, which notes that secure data is fundamental to a robust and thriving society. It also warns that as more people use and do business on the internet, the payoffs from cyber and cyber-enabled crimes will increase, attracting greater numbers of cybercriminals

Client files

Lawyers whose eyes might glaze over at the mention of technology should pay attention. End-to-end encryption as a concept is simple to understand and among the data at risk are their client files and other confidential information.

ADLS Technology & Law committee member James Ting-Edwards likens unencrypted communications to a postcard that can be read by anyone whose hands it passes through. An encrypted communication would mean the postcard was placed inside an envelope.

Since whistle-blower Edward Snowden leaked classified information revealing the extent of global surveillance programs, technology companies have increasingly added security to their services, including unbreakable encryption.

End-to-end encryption is what enables business to thrive online.

Former Commerce & Consumer Affairs Minister Kris Faafoi, when launching New Zealands cybersecurity strategy in 2019, said encryption ranged from the basic functioning of New Zealands economy and society our jobs, banks and schools to the delivery of government and telecommunications and electricity services.

We need to know that our systems will keep running, that our personal and commercial information is safe and that we can trust the information that we use to make decisions, he said.

Ting-Edwards says anyone seeking to comply with privacy law and those with obligations of confidence, such as lawyers, needs encryption.

Its very easy to find people pushing a hard-line position on both sides of this. Now that the internet includes four billion people there are some difficult, nuanced problems about how the administration of social life, how the admin of government happens in a world where this exists.

We really do need access to encryption for all kinds of privacy and security reasons but thats not to say the policy and law enforcement concerns raised dont matter. They do matter.

Banks and professionals

Security breaches resulting from a back door could affect our communications with banks and commerce, and professionals such as lawyers and doctors who need security to ensure the confidentiality of their clients data, says Marcin Betkier, a law lecturer at Victoria University and a committee member of the Privacy Foundation NZ (whose patron is Dame Silvia Cartwright).

But it wont necessarily be safe if the Five Eyes governments have their way and a back door is opened to monitor those communications and data on organisations servers or in the cloud. Criminals and state-sponsored actors using cyber tools for geopolitical advantage could be given a new way to break encrypted communications for their own ends.

Andrew Littles signing of the document marked a change in our approach, Betkier says. In a report about the proposal, the foundation called for careful review and validation by the New Zealand public.

We are concerned that the New Zealand government has signed the statement without wider public consultation or discussion, the foundation wrote. This is critical in light of the direct impact that undermining encryption would have on New Zealanders privacy and cybersecurity.

In an interview withLawNewsBetkier added: It would be nave to think you could have some sort of private, exclusive access for Five Eyes. Not Russia, China or North Korea. Its not that easy. Systems leak sooner or later.

Betkier cites the case of Moscow-based cybersecurity company Kaspersky Lab, which in 2017 either actively or passively enabled the hack of a US National Security Agency contractors data. The contractor was working to replace hacking tools that had been leaked by Snowden. The hacked information ended up in the hands of the Russian government.

Ting-Edwards adds: It seems really important that New Zealand as a small participant in the multilateral order is careful not to sign up to precedents that we would be unhappy with other governments using to serve their own ends in their own ways.

Having signed the international statement doesnt mean it will come to fruition, however. Privacy law expert Tania Goatley, a partner at Bell Gully, says there is no legal requirement for the government to execute such statements on behalf of New Zealanders.

However, the general role of a government in any society is to ensure its citizens are protected and that parameters are put in place to ensure the safety of those citizens. Executing the international statement therefore might be seen by government representatives as necessary to protect the more vulnerable members of New Zealands society.

Goatley says it indicates the signatories generally support encryption technologies, but that encryption that wholly precludes legal access to any content should be addressed, to enable access to illegal content in circumstances where access is authorised, necessary and proportionate, and subject to strong safeguards and oversight.

If the government introduced strong safeguards and oversight and supported encryption technologies as it stated, then there are some good policy arguments in favour of implementing the international statement, she said.

Privacy risks

But Goatley says several concerns might arise around implementation. These include a definition of what constitutes illegal content, who will monitor enforcement agencies to ensure their access and use of information is only for enforcement and safety purposes, and whether there would be penalties for non-compliance or unjustifiable intrusions into personal privacy.

Another concern, she says, may be the extent to which it is permissible to erode individual privacy rights to protect the vulnerable. This is particularly significant where organisations do not actually know what the relevant content is or might contain.

Implementation of the type called for in the international statement also raises privacy risks from an organisational perspective, says Goatley. These include mapping data flows and, in particular, understanding where data is collected, held, used and disclosed, understanding the legal obligations and access powers that may apply to organisations as a result, and ensuring customer data is properly protected and not illegally disclosed in that context.

Not a first

If the statement becomes reality it wouldnt be the first time a government has demanded access to end-to-end encryption. As discussed, Australia has passed legislation enabling lawmakers and enforcement to compel communications providers to provide certain assistance in accessing content.

The Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 has been criticised for being inadequately debated, poorly drafted and draconian.

An amendment was passed in 2019 and the law was subsequently reviewed by an Independent National Security Legislation Monitor which has recommended extensive amendments. The Australian Parliamentary Joint Committee on Intelligence and Security (PJCIS) is undertaking a review.

In the United States, the FBI has unsuccessfully attempted to require Apple to provide tools for bypassing the security restrictions on iPhones belonging to suspects.

The question is whether any of this legislation is necessary.

Undermining encryption is not the only way to access data, says Betkier. Law enforcement agencies can access communications when necessary even without this back door. He cites the example of EncroChat, a secure telephone network in Europe favoured by criminal groups. French police hacked into the network, broke the encryption and cracked open millions of messages. It was big news for law enforcement.

Playing on emotions

The Privacy Foundation expressed its concerns about the emotional language used in the Five Eyes statement and the fact that it offered little in terms of a solution.

Such discourse creates a false illusion that everyone who stands for privacy also supports individuals who use the internet for these sorts of illegal activities, it says. This is, of course, not the case and we agree that law enforcement agencies need to have tools and processes to protect individuals and vulnerable groups in society.

Betkier says we need to discuss this more rationally as a nation. What can law enforcement agencies do? Right now, it looks like they just want everything. If there is no easy way, they just keep reporting that emotional communication.

Translation into law?

As Goatley points out, the government has not brought in specific anti-encryption legislation and has not indicated it intends to do so. Rather, to date its focus appears to be engaging in constructive dialogue, which is likely to involve consultation with industry experts.

This approach, she says, is generally preferable and would help avoid shortfalls in the equivalent Australian law.

The Australians are struggling with the law of unintended consequences. So too, the foundation noted, could New Zealand if it were to enact similar legislation.

The foundation noted: It will reduce confidence in e-commerce, independent journalism, whistleblowing and many other sectors or scenarios where the confidentiality and integrity of information is essential. For example, it may be a direct threat to vulnerable communities (like LGBTQ) and to groups that oppose authoritarian regimes across the globe.

Another unintended consequence might be whether New Zealand could continue to be considered an adequate country under Europes General Data Protection Regulation (GDPR) privacy rules, says Goatley. This is soon to be reviewed by the European Commission.

Any weight the EU might place on a back door to end-to-end encryption remains uncertain, Goatley says.

How might it work?

The foundation says the statement does not present practical proposals for achieving its aims of maintaining public safety while protecting privacy and cybersecurity through encryption.

Law enforcement agencies may have a number of alternative means of accessing digital content that does not require them to break encryption through exploiting vulnerabilities in an individuals device or tracking their online activities to glean further information.

Ting-Edwards says it would help if the Five Eyes governments could publish technical designs so relevant parties could scrutinise and discuss them.

We can trust software systems only when the design is presented and people can independently look at them and test them and see what breaks to assure them the systems do what they say on the box and they dont have any surprising impacts.

Diana Clement is a freelance journalist.This articleoriginally appearedin LawNews (ADLS) and is here with permission.

See the original post:
Does opening a 'back door' to encrypted communications create a whole new raft of problems? How can firms promise privacy if there is official access?...

Read More..
Posted in Encryption | Leave a Comment

Enigma encryption machine used by Nazis in World War II found on bottom of ocean – ABC News

December 9, 2020 | Author: admin

German divers searching the Baltic Sea for discarded fishing nets have stumbled upon a rare Enigma cipher machine used by the Nazi military during World War II which they believe was thrown overboard from a scuttled submarine.

They thought they had discovered a typewriter entangled in a net on the seabed of Gelting Bay, but underwater archaeologist Florian Huber quickly realised the historical significance of the find.

"I've made many exciting and strange discoveries in the past 20 years. But I never dreamt that we would one day find one of the legendary Enigma machines," Dr Huber said.

The Nazi military used the machines to send and receive secret messages during World War II but British cryptographers cracked the code, helping the Allies gain an advantage in the naval struggle to control the Atlantic.

At Bletchley Park codebreaking centre, a British team led by Alan Turing is credited with unravelling the code, shortening the war and saving many thousands of lives.

Shortly before Germany's surrender in May 1945, the crews of about 50 submarines, or U-Boats, followed an order to scuttle their ships in Gelting Bay, near the Danish border, to avoid handing them to the Allies.

Destroying encryption devices was part of the order.

"We suspect our Enigma went overboard in the course of this event," said Dr Huber, of the company Submaris which leads underwater research missions.

Overall, Germans sank more than 200 of their submarines in the North and Baltic Seas at the end of the war.

The Enigma device, which looked like a typewriter, consisted of a keyboard and wheels which scrambled messages.

Although several hundred thousand machines were produced, only a few hundred are known to exist.

They sell at auction for tens of thousands of euros.

The find, made by divers working on behalf of WWF aiming to find abandoned fishing nets that endanger marine life, will be given to the archaeology museum in Schleswig.

Reuters

Continued here:
Enigma encryption machine used by Nazis in World War II found on bottom of ocean - ABC News

Read More..
Posted in Encryption | Leave a Comment