Cloud Hosting

A former head of MI5 has spoken out against curtailing use of encryption in messaging apps despite warning that Islamist terrorism will remain a threat for up to another 30 years.

Jonathan Evans said the terrorist threat to Britain was a generational problem, and suggested the Westminster Bridge attack in March may have had an energising effect on extremists.

Without encryption, everything sent over the internet from credit card details to raunchy sexts is readable by anyone who sits between you and the information's recipient. That includes your internet service provider, and all the other technical organisations between the two devices, but it also includes anyone else who has managed to insert themselves into the chain, from another person on the same insecure wireless network to a state surveillance agency in any country the data flows through.

With encryption, that data is scrambled in such a way that it can only be read by someone with the right key. While some older and clumsier methods of encryption have been broken, modern standards are generally considered unbreakable even by an attacker possessing a vast amount of computer power.

But while encryption can protect data that it is vital to keep secret (which is why the same technology that keeps the internet encrypted is used by militaries worldwide), it also frustrates efforts by law enforcement to eavesdrop on terrorists, criminals and spies.

That's particularly true for end-to-end encryption, where the two devices communicating are not a user and a company (who may be compelled to turn over the information once it has been decrypted), but two individual users.

But Lord Evans, who retired from the security service in 2013, told BBC Radio 4s Today programme that he would not support a clampdown on use of encryption.

His comments came after Amber Rudd, the home secretary, argued that internet companies were not doing enough to tackle extremism online. She has previously singled out the use of encryption as a problem.

Acknowledging that use of encryption had hampered security agencies efforts to access the content of communications between extremists, Evans added: Im not personally one of those who thinks we should weaken encryption because I think there is a parallel issue, which is cybersecurity more broadly.

While understandably there is a very acute concern about counter-terrorism, it is not the only threat that we face. The way in which cyberspace is being used by criminals and by governments is a potential threat to the UKs interests more widely.

Its very important that we should be seen and be a country in which people can operate securely thats important for our commercial interests as well as our security interests, so encryption in that context is very positive.

After the home secretarys intervention at the Global Internet Forum to Counter Terrorism in California this month, the companies taking part said they were cooperating to substantially disrupt terrorists ability to use the internet in furthering their causes, while also respecting human rights.

Looking ahead, Evans warned of the threat of a cyber-attack against the internet of things the networking of physical devices, ranging from cars to lightbulbs to TVs as a major issue.

As our vehicles, air transport, our critical infrastructure is resting critically on the internet, we need to be really confident that we have secured that because our economic and daily lives are going to be dependent on the security we can put in to protect us from cyber-attack, he said.

But the threat of Islamist terrorism was likely to remain at the fore for 20-30 years, he warned.

Were at least 20 years into this. My guess is that we will still be dealing with the long tail in another 20 years time I think this is genuinely a generational problem, Evans said.

I think that we are going to be facing 20 or 30 years of terrorist threats and therefore we need absolutely critically to persevere.

He said the London bombings in July 2005 triggered an energising effect on the extremist networks in the UK, and thought there would be a similar feeling after the Westminster Bridge attack.

We did see a huge upsurge in threat intelligence after 7 July and I suspect that theres the same sort of feeling in the period after the Westminster Bridge attack that a lot of people who thought Id like to do this suddenly decided Yep, if they can do it, then I can do it.

Since the atrocity in March, there have been attacks in Manchester, London Bridge and Finsbury Park.

Evans, now an independent crossbencher in the House of Lords, also told the programme he would be surprised if Russia had not attempted to interfere with British democracy, after repeated allegations of Kremlin interference in foreign elections.

He said: It would be extremely surprising if the Russians were interested in interfering in America and in France and in various other European countries but were not interested in interfering with the UK, because traditionally I think we have been seen as quite hawkish and therefore I would be surprised if there had not been attempts to interfere with the election.

Read this article:
Ex-MI5 chief warns against crackdown on encrypted messaging ... - The Guardian

Encryption can be the answer to many data security issues faced by small and medium businesses.Not onlycan it protect sensitive information from unauthorized use and minimize the risks arising from data breaches, implementing this technology can also represent another step towards compliance with legislation, especially with respect to the General Data Protection Regulation (GDPR).

But in cybersecurity, there isno silver bullet meaning that no single product or service can handle all the potential threats out there. This applies to encryption also, as even this technology despite its many advantages still has limitations that you need to take into consideration. So before opting for a specific product, be sure you know the one that best fits your needs.

According to a recent study on data breaches carried out by the Ponemon Institute, human error is second only to malicious actors when it comes to the most commonly cited root cause of data leaks. However, these can be avoided by deploying a solution that is easy to use.

There will always be the need for some encryption to be carried out by the user, based on policy and training. If these actions require expert knowledge and the product is not user-friendly, employees might try to find the easy way out and companyrules could be broken. With a simple, user-friendly solution, this can be avoided.

A recent IDC survey on ESETs behalf has also shown that ease of management and ability to recover a lost access key are among the most important criteria when a business is in the process of choosing an encryption solution.

To avoid cases where employees are unable to decrypt their data because they have forgotten their keys, search for solutions that use a system of shared encryption keys, managed by on-site system administrators.

This is similar to the use of actual keys, something we all understand before starting elementary school. On top of that, it also makes sharing encrypted data within a predefined group quick, easy and in many cases, transparent for the user.

The solution you choose should be scalable and flexible, so that you can easily add advanced features if necessary, enabling you to vary enforced policies and keys remotely helping you to keep a strong default configuration.

Select a product that doesnt require reinstallation for upgrades or renewals. In addition, dont forget that if an encryption solution is available as a perpetual license, including annual maintenance and support, or as a subscription license, it can enable you to manage costsand improve your financial flexibility.

Select a solution that employs industry-standard encryption algorithms that you can trust, and a sophisticated key-sharing system for secure data exchange among all users.

Check if the encryption solution you are considering meets the rigorous FIPS-140-2 standard in the US and is validated by the National Institute of Standards and Technology (NIST). Also verify if it has been certified by key players on the market (i.e. OPSWAT) and has performed well in independent tests.

Set your data protection strategy carefully and choose the encryption solution that helps you fulfill it in a way that suits you best. To make the right decision, dont shy away from any questions you might have about usability and features of the product, even if they sound obvious to you. You might be surprised how many encryption solutions on the market dont cover the basics.

If you want to know which questions you should ask and what answers to seek, we will help you in our next blogpost, so stay tuned and read more on WeLiveSecurity.com.

Author Ondrej Kubovi, ESET

Read more from the original source:
Avoid getting lost in encryption with these easy steps - We Live Security (blog)