Page 701«..1020..700701702703..710720..»

Dallas County ‘interrupted’ data exfiltration, prevented encryption after attack – The Record from Recorded Future News

Dallas County provided an update on the ransomware attack that was reported this week, telling residents that they were able to stop the incident before the hackers could encrypt files or systems.

On Monday, the county of nearly 3 million residents confirmed it was dealing with a cybersecurity incident after the Play ransomware gang claimed it breached their systems this weekend.

On Tuesday evening, the county released a follow-up statement providing more details about the incident. Due to our containment measures, Dallas County interrupted data exfiltration from its environment and effectively prevented any encryption of its files or systems, they said.

It appears the incident has been effectively contained, partly due to the measures we have implemented to bolster the security of our systems.

They attributed their defensive success to the deployment of endpoint detection and response (EDR) tools, forced password changes, multi-factor authentication and more.

They did not explain how the hackers initially got into their systems but said there is no evidence of ongoing threat actor activity in our environment.

Given these measures and findings, it appears at this time that the incident has been successfully contained and that Dallas County's systems are secure for use, they said, adding that the initial attack only affected a portion of their network.

The county hired an unnamed cybersecurity company to assist in their remediation efforts after the attack was discovered the investigation is ongoing.

Counties have faced a barrage of attacks in 2023 as ransomware gangs focus their efforts on government bodies with the least amount of protections.

Ransomware gangs have caused significant issues to county government systems in Delaware, California, South Carolina, New Jersey, Oregon, Florida, Ohio, Wisconsin, Mississippi, West Virginia, Georgia, and Missouri.

Earlier this year, a major county in New York outlined the months-long devastation caused by a 2021 ransomware attack, explaining that police departments, tax offices and even basic government functions were hampered by the incident.

The Play ransomware gang has continued its streak of high-profile attacks this year. The group caused outrage with its attack on the city of Oakland, which is still dealing with the ramifications of its February attack.

The Swiss government warned in June that the hackers stole data on citizens after an attack on one of their IT providers.

The ransomware gang first emerged in July 2022, targeting government entities in Latin America, according to Trend Micro, and has also attacked the Massachusetts city of Lowell and Belgium's Antwerp as well as several companies across Europe.

Recorded Future

Intelligence Cloud.

No previous article

No new articles

Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

See the original post:
Dallas County 'interrupted' data exfiltration, prevented encryption after attack - The Record from Recorded Future News

Read More..

Researcher Claims to Crack RSA-2048 With Quantum Computer – BankInfoSecurity.com

Encryption & Key Management , Security Operations

A scientist claims to have developed an inexpensive system for using quantum computing to crack RSA, which is the world's most commonly used public key algorithm.

See Also: Live Webinar | Generative AI: Myths, Realities and Practical Use Cases

The response from multiple cryptographers and security experts is: Sounds great if true, but can you prove it? "I would be very surprised if RSA-2048 had been broken," Alan Woodward, a professor of computer science at England's University of Surrey, told me.

The scientist making the claim is Ed Gerck. According to his profile on LinkedIn, where he also posted his announcement of the RSA crack, he's a quantum computing developer at a firm he founded called Planalto Research in Mountain View, California, among other jobs.

"Quantum computing has become a reality. We broke the RSA-2048 key," Gerck said.

Many cryptographers believe that the most viable approach to this problem will involve using a quantum algorithm developed by Peter Shor in 1994 to find the prime factors of an integer, once a sufficiently powerful quantum computer is built to run the algorithm against the likes of RSA-2048.

"Breaking RSA is usually attempted by using Shor's algorithm in a quantum computer but there are no quantum computers in existence that can produce enough gates to implement Shor's algorithm that would break 2048 keys," Woodward said.

Gerck said all his "QC computations were done in a commercial cellphone, or a commercial Linux desktop," at a capital cost of less than $1,000. "No cryogenics or special materials were used."

Reached for comment, Gerck shared a preprint of his research paper, titled "QC Algorithms: Faster Calculation of Prime Numbers" and co-authored with Ann Gerck. An abstract for the paper is available online. In it, the researchers write that instead of using Shor's algorithm to crack the keys, they employed a system based on quantum mechanics that can be run using off-the-shelf hardware.

I asked Gerck if this was theoretical, or if they had cracked RSA-2048 in a real-world setting, if they planned to demonstrate this to any quantum computing experts who might vouch for their findings, and when their peer-reviewed findings would be published.

He responded, "We broke a public RSA-2048. We cannot risk impersonation."

Woodward, after reviewing the Gercks' research paper, said it appears to be "all theory proving various conjectures - and those proofs are definitely in question."

He added, "I'll believe they have done this when people can send them RSA modulus to factor and they send back two primes. Until I see that, I'm just confused and not convinced they've done what they claim in the headlines."

Anton Guzhevskiy, the chief operating officer at Australian cybersecurity firm ThreatDefence, also challenged Gerck to prove his claims. "I've shared an RSA-2048 public key and a corresponding private key encrypted by this public key. If you can decrypt the private key, you can sign some piece of text with it, which will prove that you are in possession of the private key," he said in a response to Gerck's post on LinkedIn. "Can you do it?"

"There is a publication delay, and I do not control that," Gerck responded.

If Gerck's claim is true, it is unwelcome news for any government and organization still using RSA to encrypt sensitive data. Security experts say multiple governments have been intercepting sensitive communications to later subject them to so-called "playback attacks," once they have a technique for decrypting the encrypted data.

Here's how quantum computers might do that: Generating an RSA private key involves multiplying two different large prime numbers to generate a key that is used to encrypt data. These so-called trapdoor algorithms make encryption easy but decryption difficult.

Using classical computers, which process data sequentially, brute-force cracking a strong key would require an enormous amount of time - perhaps hundreds if not trillions of years. But a big enough quantum computer, because it can use qubits to process data in parallel, could be used to easily crack even large keys generated using algorithms such as RSA in days if not hours.

Powerful quantum computers do not exist today, but experts believe they may become viable in a number of years.

Because of the risk playback attacks pose to civilian and military communications, as well as critical national infrastructure, the U.S. National Security Agency has told organizations involved in maintaining national security systems that they should be planning their transition to the Commercial National Security Algorithm Suite 2.0. This is a set of quantum-resistant algorithms approved for eventual NSS use (see: US Government Picks Quantum-Resistant Encryption Algorithms).

Based on when NSA cryptographers believe quantum computing will pose a threat to public key cryptography, the U.S. government has mandated dates by which it wants to see CNSA 2.0 compliance be in place:

The NSA guidance for custom applications and legacy equipment is to update or replace them by 2033.

Technology giants, including cloud providers, have already begun transitioning to post-quantum cryptography. In August, the Chromium Project adopted a hybrid cryptographic algorithm - X25519Kyber768 - for Chrome and Google Servers. As of Aug. 15, the latest version of Chrome includes a quantum hybrid key agreement mechanism. Amazon Web Services, Cloudflare, IBM and Microsoft are among the cloud providers also researching and updating products for post-quantum cryptography.

Visit link:
Researcher Claims to Crack RSA-2048 With Quantum Computer - BankInfoSecurity.com

Read More..

Leica Releases World’s First Encryption Verification Camera – No Film School

The show, based on an unfinished Edith Wharton novel, follows nouveau riche New York families and their young daughters, boisterous young women ready to seek marriage partners. They travel overseas to London, attracting all manner of characters (and lovers) with their money and ebullient personalities.

We spoke with Curtis via Zoom about the challenges of lighting this show and all the considerations a period project of this scale needs.

The Buccaneers Official Trailer | Apple TV+www.youtube.com

The period setting and collaborating with White were big draws for Curtis on this project. But he also appreciated the chance to shoot two difficult cultures in unique Scottish locales.

"Because shooting period, if you are working out of London, there's a lot of National Trust houses and castles and what have you that are filmed quite a lot," he said. "So to be relocated up to [the] north of the border and the borders themselves, which is just within England from Scotland, we were going to be able to use some places that were not photographed very often and quite fresh landscapes and interiors that were new to people."

He also appreciated the chance to shoot New York and British characters and show the differences between their lives through visuals.

"It's a clash of cultures," he said. "It's a sort of perennial tale of two cultures sort of colliding and people's contrasting needs and desires. So it's a universal tale. You've got these young American women coming from moneyed families to meet potential suitors and husbands with titles and estates to bequeath. So it's a wonderful clash of cultures, which from a cinematography point of view is really fruitful territory."

But this difference was not only in characters and their behavior but also the differing levels of technology.

Curtis pointed out, "You've got New York going through a time of revolution with electric light coming in and the wealthier classes, whereas the U.K. was still dealing with candles and oil lamps and gaslights. And so there was a lot of contrast on lots of levels between the two cultures and the two countries."

As the young characters begin innocently and together in New York, they're lit with warm gold in rich environments. This changes as their circumstances do.

"We wanted to set up that contrast by having the early New York scenes have a real warmth and character and luminosity," Curtis said. "So although most of the show in the U.K. was shot on the ALEXA LF camera throughout, in the U.K. we use the DNA lenses that ARRI have. But then in New York, I used Canon K35s so that they would allow more of the light and the color. And the light will bounce around inside those lenses more than it will the DNA. So it had a different quality."

Oliver Curtis on location of The Buccaneers Photo provided

From the opening moments of the show, the expansiveness of this world and its characters are established via a long, meandering one-shot throughout an opulent New York home.

Not only did the take need to incorporate different spaces with the cooperation of dozens of actors and supporting artists, but Curtis also had to consider what tools to use with his Steadicam operator, Alex Brambilla.

"Because we start close and wide on the flowers and as we sweep in, you get more compression as it gets busier with people inside. So we probably went onto a slightly longer focal length there. And then when we got up to the landing after Kristine meets Christina [Hendricks] there, I think we widened out a little bit more so that when we do the hidden edit transition, we were on a slightly wider focal length, which would allow us to get separation there."

They avoided any reflective surfaces with the coordination of the camera ops and cast. Eagle-eyed viewers might catch the one hidden cut in the sequence.

"There has to be a hidden cut because the first half of it is on location and the second half is on a build," Curtis said. "So where we go into the rooms, we built that because we couldn't find a building that gave us those two spaces. Plus we needed green screen beyond the windows for the street, which was just outside Glasgow City Chambers doubling for Madison Avenue."

The BuccaneersCredit: Apple TV+

How do you shoot just a few days in a historical location with hundreds of extras?

Better yet, how do you do it in a location that won't let you update the electrical and add more lights?

For Curtis, the most challenging space to work in was inside the Glasgow City Chambers for the debutante ball sequence, in which hundreds of young women are presented on a white marble staircase. But the scene was difficult for several reasons.

"Firstly, there was a giant skylight on the top, very few windows on the lower levels, and all the chandeliers had electric lights, and we weren't allowed to touch them because it's a listed building," Curtis said. "So very few places where I could hide any lighting."

But thankfully, he came up with a genius hack to get more light into the space.

"What I asked the production designer to do, Amy Maguire, was to build what I call window plugs," he said. "Basically on the lower landings where there's a doorway to a room, we'd take the door off and create a window as if there was an exterior wall elevation there. And then I had my electrical team build soft boxes within those doorways.

"So as you go down the staircase, you'll find lots of characters walking past and standing around these windows. Well, actually they're not windows at all. They were doorways. Because we couldn't rig anything inside that building, all the light, it had to be coming in through the windows or you had some chandeliers there or candelabras. So it took a little bit of working out, but that managed to bring you sort of light and dark as you were going down from one floor to another."

The Buccaneers Credit: Apple TV+

He also found one more creative way to get a soft, diffused light throughout the space.

"My electrical team had some helium balloons to create a consistent soft light from above. As we worked our way down the staircase, they would tow those down, pull them in on the strings, bring them lower and lower," Curtis said. "So we built the soft fill light as we went further, further down. So it worked out quite well. It was a challenge because it was site-specific. I hadn't had to encounter all of those different elements before. Plus we had very little prep time. It's a working council building, so we couldn't leave anything pre-rigged. We had to get in very quickly and get out very quickly."

Again, this was a three-day operation in total requiring precise planning and production.

"The other issue there was that one of the best camera positions was actually right in the middle of the atrium, in the center of the staircase," he added. "And unfortunately, because of loading and access, we couldn't bring in any kind of technocrane or telescopic arm. So my grips had to measure exactly the distances from the walls through the columns and the pillars to the center of that atrium so we could get the camera into the center and give us the maximum flexibility. And so it was quite a military precision kind of exercise to film in that building and to film those sequences."

The fake window trick, Curtis said, was one he'd never tried before.

"It just occurred to me that if we didn't do it, I'd be stuffed," he said.

The scene in question is quite tense with multiple cuts between hundreds of actors, so the coverage was significant.

"We ran three cameras in there," he said. "Steadicam with Alex Brambilla, my B camera op, Laura Dinnett, who did a brilliant job throughout the series, not just on my blocks, but on other blocks. And we had another camera operator that day."

'The Buccaneers'Credit: Apple TV+

Cinematographers have so many things to consider in their work, including how costuming will read on camera and play with the light, as well as how those things support the storytelling. So what happens on a period show when everyone is dressed in reflective, colorful silk?

"I know that Apple was very keen to make this show a very colorful one," Curtis said. "And so we photographed it with that in mind. But also when we got into our color timing, we made sure that we brought that saturation and luminosity out and made sure that that was kept alive.

"But it's also interesting when you carry those surfaces and those characteristics into the dark gloomy interiors of London and the upper-class life there at the time. It allowed you to bring light into those spaces. You've got these very exuberant young women invading this sort of dark, gloomy space. So purely on a visual level, it was a wonderful collision and an opportunity to transform spaces from dark to light, and from desaturated to saturated."

Working with these materials made Curtis' job more interesting, he said.

"I remember when we were shooting tests, I thought, wow, there's so much light coming back off these costumes," he said. "Also, because in that period, you think about corsets and bustlesbasically the clothing is designed to sit up and to ruche and to fold and all of these surfaces reflect the light. Whereas you think about modern clothing, it's very linear, it's very vertical.

"And so I really tried to explore that a little bit by lighting a lot with bounce sources so that the clothing would reflect the bounce source," he added. "Not always going in with hard light, but I didn't have hard and fast rules about that. It was something I certainly explored as we went along."

Oliver Curtis on location of 'The Buccaneers'Photo provided

How do you do your best work? His advice, in a nutshell, is to challenge yourself.

"Don't limit yourself to one genre or one form of filmmaking," he said. "I think you learn so many things from different genres and different styles of filmmaking.

"In this Instagram world, there tends to be a very homogenized look of heavy top light and gloomy eyes and oversaturated colors. And I think that if you do a little bit of documentary or if you do some stills work, or if you work on whether it's long-form or short-form, I think it's to be open to all kinds of challenges. Work with available light, not just have a lot of lighting packages. I think it's just about being open."

He said that this openness and a willingness to experiment is where creativity has a chance to shine.

"I think if you go into a show or a shoot where you think everything is defined and certain, you probably won't do your best work. But if you put yourself in a position where you're slightly at the deep end and your feet don't quite touch the floor, you're going to do something different and interesting at that point. So it's always to test yourself."

Oliver Curtis on location of 'The Buccaneer' Photo provided

There is, of course, an opportunity for failure when you do this. But for Curtis, that's exciting.

"So I'm always throwing myself in the deep end," he said, "and you have to accept that if you do that, you might fail, and it can hurt to not know. But you learn very quickly."

Curtis also advised that, on period projects, you shouldn't let yourself get distracted by the setting.

"When people think of a period drama, they think about opulence, they think about big interiors and the ornate quality of the architecture and all the costumes," he said. "But actually, in this show, I was as interested in portraiture as anything else. The faces were so expressive and the moments between people so intimate, that to shoot on the large sensor with the DNA lenses was the perfect way to be able to preserve the essence of portraiture whilst not depriving you of the world around them.

"The large sensor allows you to be on focal lengths that are good for portraiture, but you don't suddenly lose the environment that they're in. And that's something that I think is important to think about when you watch the show, is that it's not just about the big set piece, even though we did do that as well, because obviously there's an expectation and a visual pleasure in that. But I think that if you're not telling the tale here [in the face], you're not going to tell the tale there [in the wide].

"I was invested in how the equipment, the technology, the format, would serve portraiture as much as it would landscape."

See the original post here:
Leica Releases World's First Encryption Verification Camera - No Film School

Read More..

The Future of Encryption: Navigating Change with Crypto-Agility – IT Security Guru

Agility has been quite a buzzword recently. You will likely find it on most companies 5-year plan slide decks. Yet, there is one area where the ability to adapt quickly and efficiently makes a lot of sense -cryptography. In an age where the methods employed by cyber attackers are becoming increasingly sophisticated and the specter of quantum computing looms, the importance of encryption cannot be overstated. This has led to the rise of a concept enabled by technical capabilities, known as crypto-agility, or the ability to quickly adapt to an alternative cryptographic standard without making significant infrastructure changes.

With advancements in encryption come new challenges. As encryption methods evolve, older algorithms may become susceptible to attacks. Crypto-agility, therefore, has emerged as the antidote to this vulnerability. At its core, crypto-agility empowers organizations to transition seamlessly between encryption techniques. Rather than relying solely on one method, crypto-agility advocates for strategic flexibility, allowing the swift adoption of newer, more secure crypto libraries. However, large organizations can have hundreds or thousands of keys, digital certificates, encryption, and other cryptographic assets that can expire or suddenly break. Most security teams are unaware of the types of encryptions they use, let alone which applications use them. They implicitly trust that embedded cryptographic systems will protect their networks. This strategy has proven to fail as the headlines pile up. It is time to extend zero-trust principles into the cryptographic ecosystem to know if the most fundamental layer of protection and confidentiality can fulfill its purpose when called upon. The first step to address these risks is to discover where the current cryptographic assets reside and assess their ability to withstand decryption attempts. Cryptographic discovery tools have been developed to create accurate inventories of all cryptographic instances, known and unknown, and analyze systems relying on cryptography to protect sensitive assets, including web servers, hosts, applications, networks, and cloud systems.

The use cases of crypto-agility have soared in recent years. We could argue that it has even become a buzzword in the cybersecurity industry, although it is often misused. Even once impregnable encryption algorithms have succumbed to the relentless march of technological progress and ingenious hacking techniques. Organizations lacking crypto-agile strategies were exposed to preventable attacks, prompting industry juggernauts to partner with crypto-agility solution providers. Steering away from static cryptographic management models requires robust tooling capable of integrating with a comprehensive set of environments such as networks, servers and applications but also with certificate management solutions, threat management suites and EDR technologies, among others. Crypto-agility platforms are being developed to empower cybersecurity teams to add crypto-agility capabilities to their security tech stack. For example, large financial institutions are increasingly integrating InfoSec Global Crypto-Agility Management Platform with industry-leading agent management tools like Microsoft Sentinel or CrowdStrike Falcon. Adopting a crypto-agility framework allows organizations to accommodate future changes but also comply with strict standards, like the Payment Card Industry Data Security Standard (PCI DSS), guiding payments industry stakeholders to ensure safe payments worldwide.

Encryption technology is on a transformative journey, reflecting the need for robust data protection. Traditional symmetric and asymmetric encryption techniques now share the stage with ground breaking innovations such as homomorphic and post-quantum encryption. However, switching from legacy encryption to recommended algorithms tends to be exceedingly expensive and error prone. After a year OpenSSL experienced an implementation error that led to the Heartbleed vulnerability, half of U.S. organizations still had not patched all their OpenSSL instances. This is because cryptographic assets are deeply embedded into software, rendering them extremely difficult to change.

Another growing segment comes from the proliferation of Internet of Things devices. Securing IoT devices throughout their lifespan can be particularly challenging as their encryption is baked in when manufactured. With crypto-agility, your new electric car will be updated to mitigate risks thanks to a crypto-agile middle layer at the chip level allowing it to update its cryptographic assets.

Without crypto-agility, applications must either be reconfigured locally or recoded to enable the implementation of new quantum-safe algorithms. Neither one is a good option. To prevent security issues that can halt major networks operations and cause Global 1000 to shell out millions to ransomware attackers, leading standard bodies are working hard to identify which digital signature schemes, hash algorithms, block ciphers, and other encryption methods to approve for standardization. Legislators worldwide are also increasingly promulgating their own encryption standards, which puts additional pressure on organizations to become crypto-agile to comply to different market regulations.

See the article here:
The Future of Encryption: Navigating Change with Crypto-Agility - IT Security Guru

Read More..

Data Security and Privacy Drive Demand for Banking Encryption Software, Leading Companies like IBM and McAfee to Innovate – Yahoo Finance

Company Logo

Global Banking Encryption Software Market

Global Banking Encryption Software Market

Dublin, Nov. 02, 2023 (GLOBE NEWSWIRE) -- The "Banking Encryption Software Market by Component, Deployment Mode, Enterprise Size, Function, and Region 2023-2028" report has been added to ResearchAndMarkets.com's offering.

The global banking encryption software market has reached an impressive milestone, achieving a market size of US$ 2.1 billion in 2022. Projections indicate robust growth, with the market anticipated to surge to US$ 4.31 billion by 2028, reflecting a remarkable compound annual growth rate (CAGR) of 11.70% during the forecast period of 2023-2028.

Several factors are driving this expansion, including the increasing adoption of digital payment technologies, a rising number of cyberattacks, and the growing demand for enhanced data security and safety within the banking and financial sector.

Banking encryption software serves as a crucial tool for secure transaction handling, encompassing various encryption types such as disk, communication, file, folder, and cloud encryption. It ensures the confidentiality of transaction details, offering high-level security, hassle-free services, privacy protection, and real-time notifications. Moreover, this software prevents sensitive information leaks and mitigates the risks associated with fraudulent activities like hacking and threats. It plays a pivotal role in reducing financial losses and optimizing business operations efficiently and cost-effectively.

Furthermore, banking encryption software aids in maintaining the confidentiality of data, improving data integrity, and fostering consumer trust. It also assists businesses in streamlining processes and achieving compliance with legal requirements. As a result, banking encryption software enjoys widespread adoption among both small and medium-sized enterprises (SMEs) and large corporations worldwide.

Banking Encryption Software Market Trends:

The market's growth is strongly influenced by several key trends, including:

Story continues

Digital Payment Technologies: The increasing utilization of digital payment methods, such as credit and debit cards, and mobile banking, on a global scale, is driving the demand for banking encryption software.

Data Management: Businesses across various industries are adopting banking encryption software to gain valuable insights and improve data management.

Cybersecurity: The rising prevalence of cyberattacks, especially among fintech institutes, is fueling the adoption of banking encryption software for enhanced security.

Data Privacy Regulations: Governments worldwide are encouraging the use of banking encryption software by implementing data privacy laws to safeguard against data theft, creating lucrative growth opportunities for industry investors.

Data Security and Safety: Increasing demand for data security and safety among banks and financial institutions is a significant driver of market growth.

AI-Based Solutions: The adoption of artificial intelligence (AI)-based banking software for improved efficiency and effectiveness is bolstering market growth.

Cloud-Based Encryption: The use of cloud-based encryption, providing secure remote access to information, is further supporting market expansion.

Key Market Segmentation:

The market analysis includes the following key segments:

Component:

Deployment Mode:

Enterprise Size:

Function:

Regional Insights:

North America: (United States and Canada)

Largest market for banking encryption software, driven by growing demand for data privacy and security, rising cyberattacks, and supportive government initiatives.

Asia Pacific: (China, Japan, India, South Korea, Australia, Indonesia, and others)

Europe: (Germany, France, United Kingdom, Italy, Spain, Russia, and others)

Latin America: (Brazil, Mexico, and others)

Middle East and Africa

Competitive Landscape:

The competitive landscape of the global banking encryption software market includes key players such as Broadcom Inc., ESET spol. s r.o., International Business Machines Corporation, McAfee, LLC, Sophos Ltd., Thales Group, Trend Micro Inc., WinMagic, and more. These companies are at the forefront of innovation and development in the industry, ensuring robust competition and continued advancements in banking encryption technology.

Key Questions Answered in This Report:

How has the global banking encryption software market performed so far, and how will it perform in the coming years?

What are the drivers, restraints, and opportunities in the global banking encryption software market?

What is the impact of each driver, restraint, and opportunity on the global banking encryption software market?

What are the key regional markets?

Which countries represent the most attractive banking encryption software market?

What is the breakup of the market based on the component?

Which is the most attractive component in the banking encryption software market?

What is the breakup of the market based on the deployment mode?

Which is the most attractive deployment mode in the banking encryption software market?

What is the breakup of the market based on the enterprise size?

Which is the most attractive enterprise size in the banking encryption software market?

What is the breakup of the market based on the function?

Which is the most attractive function in the banking encryption software market?

What is the competitive structure of the global banking encryption software market?

Who are the key players/companies in the global banking encryption software market?

Key Attributes:

Report Attribute

Details

No. of Pages

134

Forecast Period

2022 - 2028

Estimated Market Value (USD) in 2022

$2.1 Billion

Forecasted Market Value (USD) by 2028

$4.31 Billion

Compound Annual Growth Rate

12.7%

Regions Covered

Global

For more information about this report visit https://www.researchandmarkets.com/r/t7cyov

About ResearchAndMarkets.comResearchAndMarkets.com is the world's leading source for international market research reports and market data. We provide you with the latest data on international and regional markets, key industries, the top companies, new products and the latest trends.

Attachment

See the original post:
Data Security and Privacy Drive Demand for Banking Encryption Software, Leading Companies like IBM and McAfee to Innovate - Yahoo Finance

Read More..

Healthcare’s Ransomware Attackers Are Addicted to Encryption – BankInfoSecurity.com

Fraud Management & Cybercrime , Healthcare , Industry Specific

Once ransomware hackers get inside a healthcare sector organization's systems, 3 in 4 attackers will also maliciously encrypt data, says security firm Sophos.

See Also: Live Webinar | Generative AI: Myths, Realities and Practical Use Cases

Attackers successfully encrypted data in 75% of ransomware attacks on healthcare sector entities, Sophos said in an annual report on healthcare cybersecurity trends published Wednesday.

"This likely reflects the ever-increasing skill level of adversaries who continue to innovate and refine their approaches," Sophos said.

On the flip side, that means only about 24% of healthcare organizations successfully disrupted a ransomware attack before the attackers encrypted their data - down from 34% in 2022, the research found.

The report is based on a vendor-agnostic survey of 3,000 information technology and cybersecurity organizations across 233 healthcare organizations located around the globe, conducted between January and March.

The healthcare industry has a reputation for being a soft target due to often low levels of cybersecurity spending by hospitals - particularly those serving rural or underserved communities. Many medical organizations apparently prefer to pay a ransom rather than lose access to patient data.

When clinical settings fall victim to ransomware attacks, which disrupt care, it is bad for patients' health, experts warn. A September 2021 alert by the Cybersecurity and Infrastructure Security Agency links cyberattacks to increased patient mortality.

While attacks against the healthcare sector remain robust, researchers did find that the number of healthcare organizations that were hit by ransomware and paid a ransom declined from 61% last year to 42% this year. This is lower than the cross-sector average of 46%, Sophos said. Healthcare organizations' propensity to pay an extortion demand may correlate to whether they have a stand-alone cyber insurance policy. Of the healthcare entities that had a stand-alone policy, 53% paid the ransom. Of those who only had a wider insurance policy that includes cyber risk, 34% paid the extortion, according to the survey.

More potential good news is that the rate of successful ransomware attacks affecting healthcare entities appears to have slightly diminished compared in 2022, when 66% of respondents said they suffered a ransomware attack. This year the number is 60%.

Fewer attacks doesn't correlate to a lower average payout. A dozen organizations told Sophos exactly how much they paid. The median amount was $2.5 million - considerably more than the $30,000 median Sophos data showed in 2022.

Contributing to the challenges faced by the healthcare sector is that ransomware attacks continue to grow in sophistication, and cybercriminals are speeding up their attack timelines to try and more rapidly penetrate corporate networks and unleash crypto-locking malware before defenders can detect those efforts and respond, Sophos said.

Sophos also found that 90% of ransomware attacks took place after regular business hours, which is a repeat tactic attackers use to try and maximize their chance of success.

How are ransomware-wielding hackers breaking into healthcare networks? Compromised credentials were the top culprits in ransomware attacks against healthcare organizations, followed by vulnerability exploits, Sophos said.

Read more from the original source:
Healthcare's Ransomware Attackers Are Addicted to Encryption - BankInfoSecurity.com

Read More..

Data Residency Compliance using Baffle and BYOK – Security Boulevard

Baffle provides strong encryption and data key management, while also allowing our customers and their tenants to bring your own key (BYOK) or hold your own key (HYOK) for maximum control over their sensitive data. Baffles powerful and flexible architecture will drop into your current infrastructure without application code changes and is easily adapted to provide decryption or masked data only at the intended destination.Baffle enables encryption for logical data isolation, which in-turn, enables highly scalable multi-tenant designs. The capabilities are essential for meeting todays compliance and security demands around data residency and data sovereignty.

The European Unions GDPR, or General Data Protection Regulation is a top priority for any company that wants to do business with EU residents. GDPR was introduced in 2016 and went into enforcement in 2018. GDPR does not require that personal data be kept in the EU but does demand that the data is protected with all the same safeguards and redress rights afforded by GDPR.

GDPR has three mechanisms for allowing data outside of the EU. The first mechanism is literally called Adequacy, and it means that the EU has determined that the country in question provides similar data rights as the EU. Unfortunately, the US and EU have gone back and forth for over 20 years now (yes, even before GDPR was introduced) on whether the US provides enough data rights for EU residents. The most recent bout includes President Bidens executive order in October 2022 outlining sensitive data protections and the EU approved it. However, litigation in Europe began almost immediately that the order was not adequate. This is still playing out. The second mechanism is a set of possibilities outlined in Article 46(1) that comes down to commercial contracts where the data controllers and processors are legally bound to uphold the data rights of EU residents. The primary problem with both mechanisms in the US (as far as the EU is concerned) is that US intelligence and law enforcement agencies can often subpoena the organizations with personal data and compel them to provide it, overriding the commercial contracts. However, there is a third possibility.

GDPR allows supplementary controls on personal data that provide EU levels of protection. The European Data Protection Board wrote this document outlining recommendations for providing such protection, and the bottom line is strong encryption with proper key management. It has sample use cases that include storing the data and protecting it from public authorities.

How can this be applied to the real world?Continue reading to understand Baffles approach to key management and then how Baffles flexible architecture can be adapted to almost any system.

As shown in the diagram, Baffle uses two-tiers of keys to encrypt data, using a technique known as envelope encryption. In this approach, the keys used to encrypt data are themselves encrypted or wrapped using a symmetric key encryption key (KEK) that never leaves the key store. The wrapping algorithm uses AES encryption with a 256-bit key length to prevent compromise of the data encryption key (DEK). Because the DEK is encrypted, it can optionally be stored in unsecured or less trusted locations for ease of storage, management, and recovery. The use of key encryption or wrapping keys in this way is a well-accepted approach for key management and described within the National Institute Standards and Technology (NIST) Special Publication 800-57 Part 1, Recommendations for Key Management. PCI-DSS describes envelope encryption and proper key storage in PCI-DSS v4.0 requirements 3.6.1. For ISO key management, see ISO 11568-1 Banking Key management Part 1.

Envelope encryption is not only a secure approach to key management, but it enables the seemingly contradictory requirements of allowing the use of the customer KEKs -where Baffle software never has access to the actual key values, while Baffle does the DEK mapping to data and management so the applications (i.e. our customers) dont have to.

Global means that the same DEK is used to encrypt all the same type of sensitive data. In a relational database, this translates to an entire column, say of social security numbers or national ids, where every record is encrypted with the same DEK. Global key management is ideal for single-tenant applications.

Unique to Baffle is the ability to cryptographically isolate the data of different tenants within a system by encrypting each tenants data with a different key. This capability is particularly useful for enterprises that store and process data on behalf of other organizations.

In keeping with Baffles goal of making it easy to adopt encryption, Baffle Data Protection supports the most common ways tenant data is organized including:

Users can configure a key store, KEK, and DEK to use for each tenant, and Baffle Data Protection will automatically locate and use the appropriate keys when encrypting or decrypting each tenants data. Under no circumstances would a tenant be able to decrypt the data of another tenant.

In the case where tenant data are commingled records in a common set of tables, Baffle can use the value in the tenant identifier column to identify the correct key to use when encrypting or decrypting the records associated with the query. In cases where the tenant identifier is unable within the context of the query, Baffle can also use the database session variables, roles, or end-user identity that the application provides in the query to automatically choose the right record-level key (RLK) to use.

In the case where tenant data is in logical databases, Baffle can use the logical database name to identify the correct logical-database key (LDK) to use to encrypt or decrypt the data for the query.

Baffle architecture is ideal for organizations that need to isolate data sets from different geographic regions to comply with data sovereignty requirements. See figure 3. At the highest level, there are two components of a Baffle implementation, Baffle Manager and Baffle Shield.

Baffle Manager is an API and GUI-based controller for configuration and auditing of Baffle Shields.

Baffle Shields are reverse proxies that intercept communications at the SQL session layer, meaning that they can be implemented between your current applications and corresponding databases without significant impact to either. They encrypt on WRITE commands and decrypt or mask on READ commands.

Envelope encryption is shown well here. Baffle Shield connects the DEK store to pull encrypted DEKs and then sends them to the KEK store for decryption. The DEK can then be used to encrypt or decrypt the data. After a user-programmable amount of time, the DEK is deleted from memory. By allowing the user (application owner or its tenants) set the path to their own HSM or KMS, they can cut-off access at any time they need to and effectively shred the data.

Baffle Shield can also provide masking per role-based access control (RBAC). Depending on the application or the users of the application, Shield can determine if READs provide the data in the clear or fully or partially masked. In Figure 4, the hypothetical CCN is 1111-1111-1111-1111 and the SSN is 111-11-111 and illustrates how different applications are provided different access based on need-to-know or least privilege. The figure shows one proxy to many applications, but multiple Shields may be deployed for one proxy per application and/or for multiple database instances for business continuity.

With Baffle, the database, and therefore the encrypted data, can be located anywhere. This allows maximum scale and cost/benefit trade-offs that may not have been possible before. Multiple shields can be deployed in the same geographies as the applications. The connections to the DEK and KEK stores would also be in the same location as the Shields, making the keys inaccessible anywhere else. Figure 5 is a hypothetical illustration with the encrypted database in North America connected to applications in different parts of the world. The sensitive data intended for the other locations is never decrypted in North America but allows for the scale and easier management of infrastructure of one location.

If the applications are multi-tenant, the database could be set up with tables using RLK or it could be an entire database instance setup with DLK. Either way, every tenant has their own KEK in their own location and revoke at any time the need should arise. Shields may also provide RBAC/masking for every individual application.

Baffle provides strong encryption and key management for sensitive data. The powerful and efficient architecture requires no coding changes for fast deployment and the flexibility enables scale and easy management while meeting security and privacy compliance needs. Every Baffle customer or their tenants may BYOK for maximum control of their sensitive data.

Sign up for a demo here.

The post Data Residency Compliance using Baffle and BYOK appeared first on Baffle.

*** This is a Security Bloggers Network syndicated blog from Baffle authored by Billy VanCannon, Director of Product Management. Read the original post at: https://baffle.io/blog/data-residency-compliance-using-baffle-and-byok/

Read the original post:
Data Residency Compliance using Baffle and BYOK - Security Boulevard

Read More..

Why organisations must protect data from the quantum threat – Technology Magazine

As quantum computers inch closer to practical application, concerns around their capabilities to crack conventional encryption algorithms have given rise to a critical dialogue in cybersecurity circles.

According to a recent Forrester study, quantum computers could be able to crack all current cryptosystems in the next five to 30 years, with a majority claiming there is between a 50% to 70% chance of this occurring in the next five years.

With this in mind, we speak to experts in the field of quantum computing about the threats the technology poses to data security and what organisations should be doing to protect their valuable information.

"Quantum computers have already initiated a paradigm shift in the ways researchers think about data security," says Sarvagya Upadhyay, Senior Research Scientist Manager at Fujitsu Research.

This, he describes, began within academic circles when highly efficient quantum algorithms for seemingly intractable computational problems underpinning encryption schemes were unearthed. This led to the development of cryptosystems designed to withstand quantum attacks. In recent years, with attention mounting around the potential capabilities of quantum computers, various organisations and governments have initiated frameworks to safeguard against such attacks.

According to Upadhyay, quantum algorithms capable of solving the computational problems that underpin encryption schemes are already in development. Organisations and governments are now striving to keep pace. The US, for instance, enacted the Quantum Computing Cybersecurity Preparedness Act just last year, signalling a proactive approach to this looming challenge.

When we talk of securing sensitive data today there is strong focus on, and argument for, encryption, comments Gavin Millard, Deputy CTO at Tenable. As advances in quantum computing are made, decryption at lightning speed is increasingly possible. For organisations, this both helps and hinders security practices as it introduces a number of risks, including retrospectively.

Algorithms used to encrypt data a few years ago could easily be deciphered by threat actors harnessing quantum computing tomorrow. Security teams should consider the viability of retrospectively encrypting data to ensure continuously strong protection.

As explained by Andersen Cheng, CEO of Post-Quantum, organisations need to be aware of the threat of quantum computing. The advent of a quantum computer, he says, is not a matter of if but when.

Research suggests that within three years, there is a one in seven chance that quantum computers will break the most used computer encryption systems this number goes as high as 50% by 2031, he says. Therefore, failing to secure your digital infrastructure against the threat of quantum computing leaves your data and systems vulnerable to attack.

Most important for organisations however is not the sheer code-breaking capabilities these machines will usher in, its the threat they are already posing today in the form Harvest Now, Decrypt Later (HNDL) attacks. Any data with a multi-year lifespan, such as government secrets, R&D innovation, asset ownership data in financial services and strategic plans, could be collected today and decrypted in the future, says Cheng. No matter what industry you are in - the private keys of utilities providers or the cardholder's information held by big banks - all data is vulnerable.

This HNDL threat is backed-up by numerous pieces of research, which find that nation-state adversaries are already collecting encrypted data with long-term utility. In fact, we are already seeing instances where internet traffic has been routed on unusual global paths for no apparent reason before returning to normal, which are indicative of such attacks occurring.

Organisations that fail to recognise this threat and secure their data today, particularly those holding highly sensitive data with a long shelf life, are potentially putting themselves and the wider economy at huge risk in the future.

For organisations today, Upadhyay insists that acknowledging quantum threats should be the first step. Then comes serious engineering and rigorous research efforts to transition to post-quantum cryptographic systems.

The field of quantum data security is evolving and organisations will undoubtedly require talent equipped with expertise in both quantum computing and security, he says.

As Gavin Millard adds, it's pointless having 'post-quantum' levels of encryption on data when other parts of the business are exposing easily exploitable vulnerabilities.

Its really important that we recognise that, even with good data security practices today, it's often weaknesses in other areas that potentially leave the organisation exposed, he describes. Security teams need processes in place to continuously assess certificates know where old certificates and standards are stored and update when they can, he says.

Its also imperative that security teams remain up to date with emerging capabilities and retrospectively address introduced weak or broken security practices such as outdated encryption standards.

Cheng, meanwhile, recommends a more radical approach: creating an end-to-end infrastructure that's quantum-safe by design. This would include everything from quantum-proofing your identity access management system to utilising a quantum-safe VPN. Cheng advises businesses to think about "crypto-agility, backward compatibility, and hybridisation" as they migrate to post-quantum cryptography (PQC).

For example, the Internet and Engineering Taskforce (IETF) recently created a new VPN standard that helps specify how VPNs can exchange communications securely in the quantum age. The novel approach prioritises interoperability by making it possible for multiple post-quantum and classical encryption algorithms to be incorporated into VPNs, ensuring no disruption to the functioning of existing IT systems, and protecting data from attack by both classical and quantum computers.

At-risk organisations might also consider establishing secure end-to-end messaging infrastructures that they control and can quantum-proof today. Such an approach allows different business processes to be created within an end-to-end secure environment so critical data is verifiably quantum-safe throughout its lifecycle.

As quantum computing continues to evolve, Upadhyay is optimistic about the future. I foresee a rapid expansion in the field of quantum data security, he says. Upadhyay believes that post-quantum cryptosystems will find widespread adoption among organisations, thereby creating significant economic opportunities for security firms specialising in this area. He also notes that transitioning from RSA or ECC-based systems to alternatives that are secure against quantum attacks is not only economically viable but also less technically demanding.

Millard warns that while defenders will have better technologies, attackers will get smarter and more automated. He points out that the time required to decrypt data will dramatically decrease, going from weeks or months to hours or seconds. However, Millard is quick to add that data secured by quantum-level encryption will remain robust.

Cheng highlights the disparity between the development of quantum computers and quantum security, especially in terms of funding. However, he observes a positive change, particularly in government action. The US has now firmly taken the lead following a series of orders and legislation, he states, referring to the Quantum Computing Cybersecurity Preparedness Act and the recent 2023 US National Cybersecurity Strategy. Cheng also mentions the National Institute of Technology's (NIST) global competition to develop new algorithms, stating that four have been shortlisted and are on track to be standardised, which many see as the catalyst for post-quantum migration.

The truth is that post-quantum migration can and should have begun earlier. Especially with the threat of HNDL attacks, everyone is playing catch-up. Its not too late, but the next few years are crucial for the future of data and information security.

Link:
Why organisations must protect data from the quantum threat - Technology Magazine

Read More..

Messaging apps may leave UK over encryption demands – ReadWrite

After years of debate and criticism, the UKs Online Safety Bill has finally become law.

According to an Oct. 26 TechRadar report, the bill received Royal Assent on October 26th, 2023, marking the last step in the legislative process before it goes into effect. However, tech experts and civil liberty groups remain deeply concerned about the implications this far-reaching regulation may have on internet freedoms and privacy.

The Online Safety Bill aims to make the Internet safer, especially for children, by imposing new obligations on social media platforms, search engines, and other digital services. Companies like Facebook, TikTok, and Google will now have a legal duty of care to protect users from harmful content online.

The 300-page bill forces tech firms to proactively identify and remove illegal content like child sexual abuse, revenge porn, hate speech, harassment, and terrorism. Companies face huge fines of up to 18 million or 10% of their global revenue whichever is higher if they fail to comply. The bill also requires platforms to offer optional tools for adults to filter out legal but potentially harmful content.

In addition, tech companies must verify users ages, enforce age limits, and prevent children from accessing inappropriate content. Parents will have the right to see what information companies hold on their children and demand it be deleted. The bill also creates new criminal offenses, such as cyberflashing and sharing AI-generated pornographic imagery.

While the intentions behind the bill may be well-meaning, digital rights advocates argue some provisions fundamentally threaten encryption and could lead to increased government surveillance.

Clause 122 of the bill grants authorities the power to access and read encrypted messages to detect illegal content. However, the government has postponed implementing this spy clause until the capability to implement it is developed.

Tech experts warn that building backdoors into encrypted messaging platforms like WhatsApp and Signal would undermine privacy and security for all users. It could allow criminals and hostile states to exploit those backdoors themselves.

Many encrypted services like Proton and Element say they are unwilling to comply with decryption demands, arguing it violates the privacy rights of law-abiding citizens. Some companies are even threatening to pull their services out of the UK market entirely rather than undermine their encryption standards.

Matthew Hodgson, CEO of secure messaging app Element, said his company is adding contractual clauses promising they will never agree to implement client-side scanning mandated under the Online Safety Bill in order to reassure customers.

There are also concerns that under the vague definitions in the bill, tech companies may end up over-censoring legal speech and political dissent out of fear of steep penalties. Handing tech firms direct content moderation orders could allow the government to indirectly control online discourse.

While the goals of improving child safety and reducing cybercrime are admirable, digital rights advocates urge policymakers to tread carefully. They argue the far-reaching requirements under the Online Safety Bill could end up doing more harm than good by opening dangerous loopholes in encryption and enabling increased government surveillance and censorship powers over the internet.

Featured Image Credit: Photo by Screen Post; Pexels; Thank you!

Radek Zielinski is an experienced technology and financial journalist with a passion for cybersecurity and futurology.

More here:
Messaging apps may leave UK over encryption demands - ReadWrite

Read More..

How Do I Send Sensitive Information Via Email? – The Elm – The Elm

How Do I Send Sensitive Information Via Email? November 01, 2023 Fred Smith

Encrypting an email message ensures that the content of your email remains private and inaccessible to unauthorized individuals.

When you need to protect the privacy of an email message, encrypt it.

When you include the word [SECURE] including the brackets and not case sensitive anywhere in the subject line of an Outlook email, the message and any attachments will be encrypted.

Encrypting an email message ensures that the content of your email remains private and inaccessible to unauthorized individuals. Only the recipients of a message included in the To: or Cc: fields will be able to read the encrypted message. The message and any attachments remain encrypted if shared with anyone not included in the original email. Dont use braces { }. You must use brackets [ ].

Always use [SECURE] to encrypt a message when an email or attachment includes any of the following data as defined by the Office of the Attorney General:

An individuals first name or first initial and last name in combination with any one or more of the following data elements:

How Can Non-UMB Individuals Send Me a [SECURE] Email?

Create an email containing the word [SECURE] in the subject line and send to the recipient with whom youd like to establish an encrypted email thread.

The email recipient must click the Read the Message button to open the email; this ensures that their reply will be encrypted in return.

All additional communication between sender and recipients will remain encrypted.

The key component of this workflow is that the initial message must originate from a UMB email address and be encrypted via the word [SECURE] in the subject line.

There are additional instructions available to implement subject line keyword encryption on the Center for Information Technology Services and University of Maryland School of Medicine webpages that include explicit details and screenshots.

You should familiarize yourself with how to encrypt emails. Anytime you need to share sensitive data make sure to include [SECURE] in the subject line.

Read more from the original source:
How Do I Send Sensitive Information Via Email? - The Elm - The Elm

Read More..