Cloud Hosting

There are many encryption challenges in the tech world today, particularly as the importance of encryption as a fundamental, rather than nice to have for data security, becomes the norm for businesses. An increasing number of organisations worldwide are adopting encryption to address the growing concerns of data safety and data privacy for compliance regulations.

The prevalence of data breaches has played a huge role in this along with the growth of mobile and public cloud services becoming the norm in the enterprise IT infrastructure. For example, there have been a number of hacks that have underlined the risks of using 3rd party storage or Enterprise File Sync and Share (EFSS) solutions as either a primary storage solution for corporate data or where employees are allowed to put corporate data onto their personal accounts.

But its not just the cloud services, working with files or cloud services through unauthorised hardware such as home computers or mobile devices, increases the risks to a company of a security breach taking place. This could be a hack, or data being shared accidentally in an unencrypted format to an unauthorised person. Devices off the corporate network, and in the shadows, are not protected to the same level as those known to corporate IT, and the same is true of cloud services. They will not be subject to the same corporate, regulatory (HIPPA, SOX, PCI, etc.) policies in relation to encryption, authentication, identity and access management, threat detection, device management, or something as straightforward as password policy. The new EU General Data Protection Regulation (GDPR) set to come into force in from 25th May 2018 will place significant responsibilities and penalties on those that process, or store data related to EU citizens, regardless of the companys location in the world.

It is critical to take the attitude that data must be protected at source. This means knowing what controls are in place to control the way data moves to internal and external network resources, and how its protected in those locations. Any data that you would fear losing, or is sensitive in any way, should always be encrypted at the end point in the organisation. Taking that approach will ensure that when data leaves the organisation it is encrypted at those external end points meaning access to the files remains completely under the control of the organisation, and the centrally controlled encryption key server.

One example of where this is very valuable, is when a personal cloud service account is used by an employee, who then leaves the organisation. Without encryption the user retains access to those files, and the organisation would have no way of removing them from the cloud service, or in fact any other device. Using centrally managed encryption, the users access can be removed in the policy engine of software the user instantly loses the ability to decipher and read the encrypted files.

Data encryption is a time-tested tool that can severely hinder attackers in their goal to steal confidential user and customer data, trade secrets, and more. In addition, to the complex regulations, the increasing adoption of new technologies such as mobility, cloud and virtualisation have also found the need for encryption more than ever before.

With more organisations encrypting more and more data, the key management still remains one of the biggest challenges. The problem with encryption has always been around the management strategy, if youre working with the different platforms, such as FDE, servers, file and folder, removable media, mobile devices, cloud IaaS, and cloud EFSS you should prep your management strategy before undergoing the project. Having a unified tool that can perform the key management responsibilities and also maintain the different platforms is an essential part of not only implementation, but ensuing solid ongoing security.

There are a lot of things to think about today when managing encryption and keys. Organisations should make sure they have a product that could reach the many different platforms within their organisation; all platforms at one point in time could require encryption. In addition, organisations should make sure the product they choose can manage all the keys spanning those different platforms. Below are just some examples of the different environments in which encryption might need to be managed for a typical enterprise.

FDE (Full Disk Encryption)

o BiLocker (Take over and manage) o Software Encryption o Apple FileVault (Take over and manage) o SED (Self Encrypting Drives)

File and Folder Encryption

o SFE (Secure File Encryption) with persistence

Removable Media and Container encryption Mobile Device Encryption Cloud IaaS (Private, Hybrid, Public) o AWS o Azure o VMWare o Citrix Zen o HyperV

Cloud EFSS o Google Drive o Dropbox o OneDrive o Box

Control over your data is one of the major benefits of centralised key encryption, rather than with external service providers, such as cloud storage services. This adds yet another level of protection should a breach of usernames/passwords occur at a 3rd party cloud service provider they cant get the encryption keys.

Its easy to see how things can quickly get very complex, and why Its important that organisations enforce encryption automatically through their security policy to help avoid disaster. Encrypting at the source may not stop a hacker from gaining access to data, but it will prevent the data itself from being disclosed.

Data encryption, when executed properly, protects the sensitive information stored within any given organisation. Although there are many myths attributed to data encryption, the surprising truth of the matter is that at its core, data encryption provides a foundational piece to any data security and cloud strategy. Many companies, when asked think they are well protected from attack, but ultimately every company should expect to become the victim of a data breach, whether accidentally at the hands of a miss-sent employee email, lost device, hacktivists, or the nefarious intentions of cyber criminals. Its only by taking that attitude that well ensure we have the best protection we can in place.

Mark Hickman, Chief Operating Officer, WinMagic Image Credit: Sergey Nivens / Shutterstock

See the original post:
It is critical to take the attitude that data must be protected at source. - ITProPortal

Tools are beginning to emerge that can be used to start the process of recovering files encrypted by WannaCry on some Windows systems.

This takes on extra urgency because today marks one week from the initial outbreak, and files encrypted during that first wave are on the clock and close to being lost forever.

Adrien Guinet, of Quarkslab, yesterday released a tool to the public called Wannakey that tries to recover one prime number from memory used to factor the RSA public key stored by the malware on the local drive. Once the public key is retrieved, it can be used to rebuild the private key and eventually, with a decryptor, recover encrypted files.

Guinet said he had some luck once hed recovered the private key to decrypt files from an infected XP machine using Benjamin Delpys WanaDecrypt tool.

I actually tried the Wanadecrypt tool. It works pretty well once youve got the private RSA key, Guinet told Threatpost. It should be noted as well that these tools put victims on the road to recovering only from the WannaCry ransomware, and that the exploit used last week to spread the malware requires the MS17-010 patch from Microsoft. WannaCry may be spread by a number of different means aside from the EternalBlue NSA exploit, including phishing emails and exploit kits.

Wannakey has some limitations to it given that it was only able work on Windows XP machines since the prime numbers are overwritten in memory on later versions of the Microsoft OS.

Delpy overcame those limitations with his Wanakiwi tool that works on Windows XP and Windows 7 machines, with the implication being that it would work on all Windows versions including Windows Server 2003, Windows Vista, Windows 8 and Windows Server 8 R2, researcher Matt Suiche said.

The available tools try to recover the prime numbers of WannaCrys RSA private key, by searching for them in the wcry executable dropped by the ransomware. Guinet said this is the process that generates the RSA private key. The prime numbers are available, he said, because the CryptReleaseContext function available through the Windows Crypto API in later versions of Windows overwrites memory wiping out the prime numbers. In XP, Guinet said, the function does not clean up memory.

Guinet admitted there is a bit of good fortune involved in recovering the prime numbers, first and foremost that the associated memory has been erased and that theyre still in memory.

His tool is very ingenious as it does not look for the actual key but the prime numbers in memory to recompute the key itself, Suiche said of Wannakey. In short, his technique is totally bad ass and super smart.

Suiche stresses that victims should not reboot their infected machines if they havent already. Suiche, who did a breakdown of the crypto implementation of WannaCry during a webinar with Kaspersky Lab this week, said today that the killswitch domain he registered is still recording infection attempts, including a spike of almost 5,000 last night from Malaysia.

In the meantime, Guinet said that WannaCry authors properly use the Windows Crypto API, and the fact the prime numbers are recoverable are more on Microsoft than an implementation error.

I think the overall cryptographic scheme is good. It could have been done differently, but it works in theory, Guinet said. When you look at the part of the codes that handle cryptography, care has been taken so that what we are trying to do does not actually work. The issue is that the MS Crypto API does not cleanup memory, and theres not much the authors could have done against that, apart from using another cryptographic library that takes care of these issues. So, IMHO, on the cryptographic part, they made a decent job.

Continued here:
Available Tools Making Dent in WannaCry Encryption - Threatpost