Security vs Privacy: Encryption Technology After the Paris Attack
Security vs Privacy: Encryption Technology After the Paris Attack
In the wake of the Paris attack, a healthy discussion about security and privacy has been revisited and the discussion is centered on encryption technology. So what is “Encryption”? Encryption is the process of encoding a message so that only the sender and the intended recipient or recipients can read it.
Law enforcement and Intelligence officials claim, terrorist are taking advantage of the “end-to-end” encryption communication technology on iPhones and Android-based phones as well as apps like WhatsApp and iMessage to name a few. Now they are asking Silicon Valley to weaken its encryption or provide a backdoor so they can better monitor malicious activities.
The problem is, let’s say law enforcement were to provide a search warrant to Apple so they can access your email. Apple would reply stating, “Sorry, we can’t help you, we do not have access to the data, you will have to get the key from the person of interest. They are the only one that can access the information”.
They push for this level of privacy started in 2013 due to Edward Snowden revelations on how the National Security Agency (NSA) were spying and collection our information. Since then the newer operating systems on phones made by Apple and Google can’t be unlocked without the user passcode, not even by the companies themselves.
Law enforcement see this as a potential danger and are looking for legislation to change the current practices, but security and privacy professional state, even if Apple and Google could be convinced to cooperate, tech executives say there are dozens of other encrypted communication systems. Most encryption techniques are publicly known and terror organizations could build their own alternatives. Furthermore, many privacy advocates fear backdoors and encryption escrow keys can allow other countries and hackers with a vector to crack the code if it is not totally secure.
Before the Paris attack, it was nearly impossible for law enforcement and intelligence officials to talk about weaken decryption for surveillance matter due to Snowden revelations, but since then, there is a serious and open dialog about this matter.
ISIS ranking of encryption apps.
What is your opinion? Should we give up some of our privacy in hope for better security or should we keep our privacy and maybe compromise our security? Let me know.
The Heartbleed Bug
The Heartbleed Bug
The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).
The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
What leaks in practice?
We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.
How to stop the leak?
As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.
Source: HeartBleed
The SecurityOrb Show – An Interview with ISSA-LA President Richard Greenberg
The SecurityOrb Show – An Interview with ISSA-LA President Richard Greenberg
I had an opportunity the current ISSA-LA President Richard Greenberg. Richard holds the CISSP certification and was the the Security Summit 2015 Co-Chair and an ISSA Fellow.
He is the Information Security Officer for the Los Angeles County Department of Public Health. Previous positions include Director of Surveillance and Information Systems, Chief of Security Operations, Director of IT, and Project Manager for various companies/agencies.
National Cyber Security Awareness Month Kicks Off
National Cyber Security Awareness Month Kicks Off
As Growing Global Coalition Urges Internet Users Everywhere
To STOP. THINK. CONNECT.
Coordinated Message to Get #CyberAware Impacts Millions as Individuals, Groups and Businesses Unite to Better Protect the Internet; Organization of American States Hosts Launch Event in Washington, D.C.
WASHINGTON, D.C., Oct. 1, 2015 – The 2015 National Cyber Security Awareness Month (NCSAM) kicks off emphasizing “Our Shared Responsibility,” the month’s official theme and call to action for all global citizens to take basic steps to make the Internet – a vital resource for our personal, public and professional lives – safer and more secure. Led by the National Cyber Security Alliance (NCSA), the nation’s leading nonprofit, public-private partnership promoting online safety, and the U.S. Department of Homeland Security (DHS), NCSAM marks its 12thanniversary this October. Launching the month with the recognition that securing the Internet is a global imperative, the General Secretariat of the Organization of American States (OAS) will also host an international event in Washington, D.C. promoting a culture of cybersecurity among its member states’ 250 million Internet users in Latin America and the Caribbean as well as other countries around the globe. OAS is a long-time STOP. THINK. CONNECT. partner and has championed participation in education and awareness by a diverse group of stakeholders in Latin America.
The theme of the month resonates with young people internationally. According to the recently released Cyber Safety for the Digital Generation survey by the Raytheon Company, 82 percent of young adults globally believe that keeping the Internet safe and secure is our shared responsibility. They are clear on the roles everyone should play in keeping them safe and secure online:
- 75 percent think they themselves should be significantly involved;
- 69 percent think the commercial websites they visit and use should be significantly involved;
- 51 percent think the government should be significantly involved;
- 47 percent think the people they interact with on social networks should be significantly involved.
“We live in a global, digital age where people, networks and devices are increasingly interconnected, and everyone needs to be taking steps to use the Internet safely and more securely,” said Michael Kaiser, NCSA’s executive director. “Practicing good cybersecurity empowers Internet users to reap the benefits of connectivity with greater confidence. National Cyber Security Awareness Month succeeds when we work together to build a safer, more secure and trusted Internet. Awareness month is a must.”
NCSAM 2015 also marks the fifth anniversary of STOP. THINK. CONNECT., the preeminent global cybersecurity education and awareness campaign. Driven by NCSA, the Anti-Phishing Working Group (APWG) and DHS, which leads the federal government’s campaign, STOP. THINK. CONNECT. continues to extend its international impact with a simple but increasingly important message to stay safer and more secure online. The campaign’s partners include 271 large companies, small- and medium-sized businesses, colleges and universities, regional banks and a collection of other organizations as official partners. Currently, STOP. THINK. CONNECT. has official partnerships in Canada, Australia, Panama, the European Union, India, Japan, Mexico and other countries and regions, with its materials translated into five languages — Spanish, French (Canadian), Portuguese (Brazilian), Japanese and Russian — and several more translations on the way. Check out NCSA’s new infographic, “5 Years of STC” and learn more about how to get involved: http://ncsam.info/
“While NCSA and its many partners work year round to create awareness around the safe and secure use of the Internet, National Cyber Security Awareness Month unites everyone in a concentrated effort to promote a culture of cybersecurity in everything we do,” said Jacqueline Beauchere, Chief Online Safety Officer of Microsoft and Chair of NCSA’s Board of Directors. “We are thrilled to see the adoption of Cybersecurity Awareness Month and STOP. THINK. CONNECT. across the globe. When industry, government and civil society work together, we can help every digital citizen access and act on the information they need to be safer and more secure online.”
Ready, Set, Get #CyberAware
Under the umbrella theme of “Our Shared Responsibility,” NCSAM 2015 will explore five weekly themes addressing a cross section of cybersecurity issues. They include STOP. THINK. CONNECT., cybersecurity in the workplace, connected communities and families, our evolving digital lives/the Internet of Things and building the next generation of cyber professionals.
Individuals and companies and organizations of all sizes can show their support for NCSAM by becoming a Champion. Currently there are more than 475 NCSAM Champions who will play an active role in sharing important cybersecurity messages with their local communities, corporations, governments and individuals internationally. For more information on how to become a champion, visit https://www.
Using the new hashtag, #CyberAware, NCSAM’s Champions and supporters are also encouraged to join the conversation by posting tips, advice and information and participating in weekly Twitter chats occurring every Thursday at 3:00p.m. EDT and keeping up on the latest updates on http://www.facebook.com/
To stay safer online everyone should implement these simple, actionable steps:
- Keep a clean machine: Keeping all web-connected devices ‒ including PCs, mobile phones, smartphones, and tablets ‒ free from malware and infections makes the Internet safer for you and more secure for everyone.
- Get two steps ahead: Turn on two-step authentication ‒ also known as two-step verification or multi-factor authentication ‒ on accounts where available.
- When in doubt, throw it out: Links in email, posts and texts are often the ways cybercriminals try to steal your information or infect your devices.
- Share with care: Before posting something online, think about how it could be perceived now and in the future.
Check out NCSA’s tips infographic: http://ncsam.
A snapshot of some early NCSAM events include:
- #ChatSTC Twitter Chat: STOP. THINK. CONNECT. Around The Digital World (Twitter chat), October 1, 3-4 p.m. EDT/12-1 p.m. PDT. Learn more at: https://www.
staysafeonline.org/about-us/ events/#sthash.jinX5kVD.dpuf - OAS Cyber Security Workshop, October 2: The OAS Cyber Security Program will hold a plenary session along with SEGURINFO to launch the Cybersecurity Awareness Month. The event will focus on a discussion on the role of industries, nonprofits, and academia in raising awareness about cyber security matters among society and fostering a cybersecurity culture. Click here to register:https://www.sites.
oas.org/cyber/EN/Pages/Events/ eventsdet.aspx?docid=72 - U.S. Chamber’s Fourth Annual Cybersecurity Summit, October 6, 8:30a.m. – 4:00p.m. EDT, Washington, D.C.: The U.S. Chamber of Commerce is pleased to host the Fourth Annual Cybersecurity Summit to explore the latest threat landscape, market-based and public-private solutions and the new framework. The summit will feature speakers from the business community, international experts, the administration and Congress. Additional information and registration here
- EDUCAUSE Live! Creating a Culture of Cybersecurity and Safety on Your Campus and in Your Community (webinar), October 6, 1-2 p.m. EDT/10-11 a.m. PDT. Awareness and education are key elements of creating a culture of safety on campus. Campuses have also participated in NCSAM activities over the past decade, including Texas A&M University. Learn more about their most recent security awareness campaigns, Fight Back and What’s Your Status, and how they educate students, faculty and staff in October and year round. Presenters: Michael Kaiser, Executive Director, NCSA; Suzanne Traxler, Chief Information Officer, University of Wisconsin-Platteville; Allison Oslund, IT Product Strategy and Communication, Texas A&M University. Additional information and registration here
Visit NCSAM’s Media Resource Hub for more information on activities and events throughout the month. Additional resources (infographics, tip sheets, media kit and more) and information on getting involved are also available at https://www.staysafeonline.
No matter what audiences you are trying to reach ‒ young people, seniors, businesses or families ‒ there are resources available to help you. Visit any of these sites to get started:
- NCSA: https://www.
staysafeonline.org - DHS: http://www.dhs.gov/topic/
cybersecurity - FTC: https://www.ftc.gov/tips-
advice/business-center/ privacy-and-security/data- security - BBB: http://www.bbb.org/
council/for-businesses/ toolkits/
About National Cyber Security Awareness Month
National Cyber Security Awareness Month (NCSAM) was created as a collaborative effort between government and industry to ensure every American has the resources they need to stay safer and more secure online. Now in its 12th year, NCSAM is co-led by the Department of Homeland Security and the National Cyber Security Alliance, the nation’s leading nonprofit public-private partnership promoting the safe and secure use of the Internet and digital privacy. Recognized annually in October, NCSAM involves the participation of a multitude of industry leaders ‒ mobilizing individuals, small- and medium-sized businesses, non-profits, academia, multinational corporations and governments. Encouraging digital citizen around the globe to STOP. THINK. CONNECT., NCSAM is harnessing the collective impact of its programs and resources to increase awareness about today’s ever-evolving cybersecurity landscape. Visit the NCSAM media room: https://www.
About The National Cyber Security Alliance
The National Cyber Security Alliance (NCSA) is the nation’s leading nonprofit public-private partnership promoting the safe and secure use of the Internet and digital privacy. Working with the Department of Homeland Security (DHS), private sector sponsors and nonprofit collaborators to promote cybersecurity awareness, NCSA board members include representatives from ADP, AT&T, Bank of America, BlackBerry, Comcast Corporation, EMC Corporation, ESET, Facebook, Google, Intel, Logical Operations, Microsoft, PayPal, PKWARE, Raytheon, Symantec, Verizon and Visa. Through collaboration with the government, corporate, nonprofit and academic sectors, NCSA’s mission is to educate and empower digital citizens to use the Internet securely and safely, protect themselves and the technology they use, and safeguard the digital assets we all share. NCSA leads initiatives for STOP. THINK. CONNECT., a global cybersecurity awareness campaign to help all digital citizens stay safer and more secure online; Data Privacy Day, celebrated annually on January 28 and National Cyber Security Awareness Month, launched every October. For more information on NCSA, please visit staysafeonline.org/
About STOP. THINK. CONNECT.
STOP. THINK. CONNECT. is the national cybersecurity education and awareness campaign. The campaign was created by an unprecedented coalition of private companies, non-profits and government organizations with leadership provided by the National Cyber Security Alliance (NCSA) and the Anti-Phishing Working Group (APWG). The Department of Homeland Security leads the federal engagement in the campaign. Learn how to get involved at STOPTHINKCONNECT.org.
Media Contact
Tola St. Matthew-Daniel
Thatcher+Co.
917-818-6196
ncsa@thatcherandco.com
Obama, Xi vow cooperation on cybersecurity
WASHINGTON — President Obama and Chinese counterpart Xi Jinping vowed Friday not to engage in economic cyber espionage, to cooperate more on climate change, and to work out disputes in the South China Sea region while indicating that differences remain in what has become a tense relationship between key global powers.
Obama said he told Xi about the “serious concerns” that U.S. officials and businesses have over cyberspying by China, and “I indicated that it has to stop.” He said the two nations have reached “a common understanding” against certain cyber activities, but “I have to insist that our work is not yet done” and “the question now is are words followed by actions.”
The United States and China have also struck a renewed deal to battle climate change, and to open “new channels of communications” designed to avoid confrontations between American and Chinese surveillance flights over the South China Sea, Obama said.
“The United States welcomes the rise of a China that is peaceful, stable, prosperous and a responsible player in global affairs,” the president said during Xi’s state visit. “And I’m committed to expanding our cooperation even as we address disagreements candidly and constructively.”
Xi, speaking with an interpreter, described his talks with Obama as “constructive and productive,” deigned to avoid “conflict” and “confrontation.” He also praised the planned cooperation on climate change.
Urging “dialogue” on the question of cybersecurity, Xi said that “confrontation and friction are the not the right course.” As for the South China Sea, Xi said China would respect lawful surveillance flights but would also protect “territorial sovereignty” as U.S. allies protest the apparent development of Chinese military bases in the region.
Read more here.
