# data[].attributes.body
Cryptography is our digital immune system

A fifth, man-made domain serving as a great force multiplier for commerce and free expression, cyberspace has also made us more vulnerable. The internet has survived as the critical backbone of our democratic process and free market because we are continuously strengthening our online connectivity’s immune system, which protects us from global pandemic threats including computer hacks and viruses.  The conclusion of this article is talking about understanding cryptographic protocols and tracking network vulnerabilities is as challenging as it is vitally important to ensuring consumer confidence.
https://www.scmagazine.com/home/opinions/blogs/executive-insight/cryptography-is-our-digital-immune-system/

# data[].attributes.body
Intel announces new chip designs with built-in security.
So, we will have more protection from hardware.

The first measure promises to improve security by using Accelerated Memory Scanning to free up graphics hardware resources so they can be used to scan computer memory for malware

The second feature will combine platform telemetry with machine learning algorithms to improve the detection of advanced threats while reducing false positives and minimizing performance impact.

The third measure involves a consistent set of critical root-of-trust hardware security capabilities across Intel processors for secure boot, hardware protections (for data, keys and other digital assets), accelerated cryptography and trusted execution enclaves to protect applications at runtime.
https://www.scmagazine.com/home/news/rsa-2018/intel-announces-new-chip-designs-with-built-in-security/

# data[].attributes.body
https://www.scmagazine.com/home/news/vulnerabilities/adobe-issues-critical-patch-after-flash-zero-day-bug-actively-exploited-in-middle-east/

With cryptography so present in our everyday lives, compromises to the security that cryptography offers can often have detrimental consequences. As in any other aspect of security, the best defense against such compromises is maintaining awareness be being proactive. One recent attack from June of this year capitalized on the curiosity of users, resulting in an exploit for Flash Player being abused to spread malware that used asymmetric cryptography to hide its nefarious nature.

Things like apps, clients and programs from big companies are usually safe for use and with a bit of awareness anyone can be safe using them but to the general public this may not always be the case. As shown with the exploit used within adobe program, we saw that even if a website is generally safe to use, attackers will find ways to use it to their advantage. In the case of Qatar’s Bayt.com, attackers sent malware that download malicious files that spread by opening emails impersonating job inquiries. To help prevent this basic awareness would be ideal. Knowing that there is a malicious malware attacks going on could be very helpful as well as pop up blockers to prevent websites from opening links automatically without permission. While the site might benefit from sending emails with certificates. This would ensure verification that a public key is truly associated with a particular individual.

For a more thorough prevention of these kind of attacks, it would be useful to use multi layered defenses. Having authenticity certificates from the users would help catalog and maintain traffic. Using this information through a private key to match up with a public key would give the next layer of defense. On top of this, anything that needs to be downloaded should go to a monitored pop-up equipped with a sandbox that can scan and detect any version of malware that will alert the user and the website. These alerts should be analyzed on a priority basis and handled immediately so as to locate and stop the corrupted files from affecting the user, giving us the ability to track the location that the malware is being outputted and shut it down. Consistent auditing should be in place to secure the website, labeling users from trusted to high risk and dealt with within the parameters of internal procedures and legal requirements. Technology malware changes all the time, so certificates should always be kept up to date.

# data[].attributes.body
Found this article about cryptography scandals.

# data[].attributes.body
This article is about a scam that has been on the rise, ATM wiretapping, which is installing 3rd party hardware to collect user data so they can later drain an ATM of its contents using said data. Many of these hardware additions are just tiny cameras which is why its always recommended to cover your hand while entering your PIN.

https://www.scmagazine.com/home/news/secret-service-warns-banks-of-atm-wiretapping-attacks/

# data[].attributes.headline
Group 2 (Jesse Roberts and Jared Futral)

# data[].attributes.subject
Group 2 (Jesse Roberts and Jared Futral)

# data[].attributes.body
Our article chosen was about
major vulnerabilities in hardware and firmware. The vulnerability allowed hackers to impersonate users. Fits to our topic perfectly and is an informative read.

# data[].attributes.attachment_link.readable_text
Less than a day after the KRACK vulnerability scare affecting all Wi-Fi devices using the WPA2 protocol security pros once again have their hands full to update patches for the ROCA vulnerability which could allow an attacker to circumvent RSA encryption.

The vulnerability (CVE-2017-15361) infects vulnerable keys found in about 760,000 products from major vendors including Microsoft, Google, HP, Lenovo, and Fujitsu who have already released software updates and guidelines for a mitigation and is caused by cryptographic chips produced by Infineon Technologies AG, according to an advisory detailing the attack.

ROCA stands for Return of Coppersmith's Attack and wasdeveloped by Researchers at the Centre for Research on Cryptography and Security using an old technique to exploit a vulnerability in NIST FIPS 140-2 and CC EAL 5+ certified devices and has been present since at least 2012.

The exploit allows an attacker to carry out a practical factorization attack to compute the private part of an RSA key for commonly used key lengths for $76 to decrypt 1024 bits in a matter of hours and about $40,000 for the 2048-bit version in a matter of days.

"A remote attacker can compute an RSA private key from the value of a public key," researchers said in the advisory. "The private key can be misused for impersonation of a legitimate owner, decryption of sensitive messages, forgery of signatures (such as for software releases) and other related attacks."

The impact of the vulnerability varies depending on the venders' implementation of the encryption however a large number of Google Chromebook and Windows devices created by Fujitsu, HP and Lenovo are amongst those affected.The vulnerability also impacted Estonia ID cards which were recently shown to be vulnerable to a proof of concept attack.

"The authors have made it clear that this flaw is embedded into the hardware and firmware of many devices widely used across the globe," Synopsys Security Consultant Jesse Victors said. "This makes it difficult to completely patch, but there are some mitigating controls."

Victors added that RSA turned 40 years old this year and we still seem to struggle with using and implementing it correctly however RSA is one of our best public key encryption schemes, so it isn't going away any time soon.

The revelation is similar to the problem Sony's PlayStation software download system suffered in 2010, and exactly what happened to the Taiwan National ID registry in 2013, Thales e-Security Chief Technology Officer Jon Geater said.

"While the effects of this latest flaw are concerning, it's interesting to note that this is far from the first time it's happened," he said. "Generating high quality signing keys from high quality entropy and key generation processes is absolutely fundamental, especially in large scale systems where lots of public keys are available to sample."

Geater added that crypto is harder than it looks and that it's important to employ experts and use quality specialist equipment to generate, store and use your keys. Furthermore, encryption is only secure if implemented correctly.

"In this case, where private keys can be derived from public keys, the implementation was flawed," Bitglass Chief Technology Officer Anurag Kahol said. "For organizations and governments that choose to encrypt data, key management - storing keys securely, rotating master keys and aliases to that master key - can be invaluable in protecting data."

Infineon Technologies AG has been notified and is reportedly working on a fix for the vulnerable chips.

# data[].attributes.attachment_link.title
ROCA vulnerability threatens RSA encrypted devices on heels of KRACK scare | SC Media

# data[].attributes.attachment_link.description
Less than a day after the KRACK vulnerability scare affecting all Wi-Fi devices using the WPA2 protocol security pros once again have their hands full to update patches for the ROCA vulnerability which could allow an attacker to circumvent RSA encryption.

# data[].attributes.body
This is an article that shares some information about a bill that would require stricter encryption and security laws on a federal level, pertaining to encryption standards, and it would require by law that no agency require or force a company to create a backdoor for their product to be granted special rights or be sold at all. Eliminating the threat of anyone nefarious finding the government's backdoor into a product or software.

# data[].attributes.attachment_link.readable_text
A bipartisan group of representatives has put forth a bill to create a national standard encryption that would supersede any similar standards created on the state or local levels.

Representatives Ted W. Lieu D-Calif., Mike Bishop R-Mich., Suzan DelBene D-Wash. and Jim Jordan R-Ohio reintroduced the Ensuring National Constitutional Rights for Your Private Telecommunications (ENCRYPT) Act. If enacted the bill would ensure a uniform, national policy for the interstate issue of encryption technology.

"As a computer science major, I can tell you that having 50 different mandatory state-level encryption standards is bad for security, consumers, innovation, and ultimately law enforcement," Lieu said.

Bishop agreed saying the concept of having a central repository is key to defending the nation against cyberattacks.

"The ENCRPYT Act is a critical first step in adopting a national approach - instead of the patchwork of encryption standards that our tech industry and law enforcement face today," he said.

The act was originally introduced in February 2016 and has the additional goal of ensuring that state and local government do not pass any legislation that would require manufacturers to put backdoors or other technology in place that would allow access to a device.

Willy Leichter, Virsec's VP of marketing, noted that while the bill is a step forward it does nothing to stifle the argument raging between law enforcement, which wants a way to bypass a devices encryption, and privacy advocates who believe weakening encryption's effectiveness will have disastrous results.

"The re-introduction of legislation to not force technologies to implement security backdoors is an unfortunate necessity. Undoubtedly any backdoor that is introduced will be available to both law enforcement and bad actors alike, collectively making us less secure," added Gabriel Gumbs, STEALTHBITS VP of product strategy.

# data[].attributes.attachment_link.title
ENCRYPT Act reintroduced in Congress | SC Media

# data[].attributes.attachment_link.description
A bipartisan group of representatives has put forth a bill to create a national standard encryption that would supersede any similar standards created on the state or local levels. Representatives Ted W. Lieu D-Calif., Mike Bishop R-Mich., Suzan DelBene D-Wash. and Jim Jordan R-Ohio reintroduced the Ensuring National Constitutional Rights for Your Private Telecommunications (ENCRYPT) Act.

# data[].attributes.body
Enterprises have been downloading applications that have no data at rest protection. These applications had been developed without security patches being implemented in the future.

# data[].attributes.attachment_link.readable_text
Medium and large enterprises are developing and using enterprise applications on a large scale for various purposes, but a lack of encryption, coupled with serious security flaws in such applications, is also rendering enterprises vulnerable to sophisticated hacking operations.

An average medium to large scale enterprise uses between 300 to 500 enterprise applications nowadays, with such applications offering ease of use as well as significant savings in terms of time and investments.

From customer relationship management to resource planning to file sharing, today's cloud-based applications can handle tasks ranging from minuscule to large-scale ones. However, if such applications are developed and put into use without being subjected to extensive vulnerability testing, they may render organisations highly vulnerable to malware injections and data breaches.

According to a report released by security firm Trend Micro, enterprises downloaded 81 percent of their data on applications that didn't include encryption for data at rest. At the same time, since most of these applications were developed without keeping IT security departments in the loop, such teams were also not able to find or patch vulnerabilities in vulnerable applications.

Lately, enterprises have been creating 'twin applications' that are made to undergo frequent testing to resolve performance issues. These applications help organisations perfect actual platforms and ensure that the latter would perform optimally at all times. However, such twin applications are also targeted by hackers who seek to exploit security flaws as and when they are discovered.

'[W]e believe that while it's poised to transform operations, the product network can be infiltrated by malicious actors aiming to manipulate the system and cause operational disruptions and damages. By manipulating the digital twin itself, these actors can make production processes look legitimate when they have, in fact, been modified,' noted Trend Micro in its report titled Security Predictions for 2018: Paradigm Shifts.

'If a manipulated piece of data or wrong command is sent to an ERP system, machines will be liable to sabotage processes by carrying out erroneous decisions, such as delivery of inaccurate numbers of supplies, unintended money transfers, and even systems overloads,' the firm added.

The firm also spoke about a significant security weakness that impacts organisations across the world- poor credential management. Employees at medium to large enterprises have routinely used weak and easy-to-guess passwords to log in to enterprise platforms, and this hasn't escaped the attention of hackers.

According to Trend Micro, employees not only use weak passwords but also have a tendency of using the same passwords to log on to multiple applications, thereby rendering all of them vulnerable to security breaches. Once a hacker correctly guesses or steals a password and enters a network, he/she can remain within the infected network and steal data over a long period of time.

'Part of the problem with enterprise applications is that there are just so many- keeping track of which passwords we have used for which apps is tricky. On top of this, many apps have frustrating password requirements, stipulating that users must use a certain number of characters, along with a combination of digits, symbols, uppercase letters, and lowercase letters. Quite rightly, many of us have different passwords for different accounts, but this inevitably means we have even more passwords to remember,' says Oz Alashe MBE, CEO of CybSafe.

'For the sake of ease, staff often choose weak passwords when given the option - a short password is both easier to remember and faster to type. To resolve this, businesses should have a simple password policy that encourages staff to choose secure passwords.

'Managers also need to take care to explain the logic behind maintaining proper security. This eases cognitive dissonance, which arises when people believe one thing but are told to act in another way entirely. If employees believe passwords consisting of random strings of capitals, symbols and numbers are overkill, you're always going to have insecure passwords like Password1, regardless of your security guidelines,' he adds.
This article originally appeared on SC Media UK

# data[].attributes.attachment_link.title
Lack of encryption in cloud applications rendering enterprises vulnerable | SC Media

# data[].attributes.attachment_link.description
Medium and large enterprises are developing and using enterprise applications on a large scale for various purposes, but a lack of encryption, coupled with serious security flaws in such applications, is also rendering enterprises vulnerable to sophisticated hacking operations.

# data[].attributes.body
Found this article that discusses the federal governments preparedness to comply with the homeland security directive BOD 18-01 which requires government agencies to improve handling of transport layer security (TLS) keys and Public Key infrastructure certifications.
https://www.scmagazine.com/home/news/pair-of-surveys-underscore-importance-of-secure-pki-in-government-iot/?utm_source=newsletter&utm_medium=email&utm_campaign=SCUS_Newswire_20180930&hmSubId=FUFh9nCsgA01&email_hash=c35d6939b3039be2d4a42aafa5e29b03&mpweb=1325-2580-1241432

# data[].attributes.body
This interesting piece, co-authored by a former Section Chief with the CIA, talks about how we should consider cryptography the immune system of our worldwide security network and how that fits into the trends we should expect going forward related to global information security.

# data[].attributes.attachment_link.readable_text
A fifth, man-made domain serving as a great force multiplier for commerce and free expression, cyberspace has also made us more vulnerable. We have intertwined nearly every aspect of society including critical infrastructure, business, and communication to internet technology, all of which was not initially designed to be secure in this hyper-connected world.

The internet has survived as the critical backbone of our democratic process and free market because we are continuously strengthening our online connectivity's immune system, which protects us from global pandemic threats including computer hacks and viruses. Cryptography is our digital immune system which authenticates and protects data, money, the health and safety of people and reputation.

During the past few years, the explosive proliferation of digital connectivity-from smartphones to widespread adoption of connected consumer products comprising the Internet of Things-has strained the most commonly used methods of encryption and authentication.

Without cryptography, correspondence, which is sent or received electronically and the links we click on would serve as a contagion agents for virus, attack, threat and data breach.

Solutions abound

For decades, cryptography has been launched piecemeal and without the agility to make necessary changes and updates. Going forward, three key elements will impact how we protect the data, money, and reputation, on which commercial success relies.

First, we should not expect a global, universal adoption of stronger cryptographic protocols and processes. In fact, we should expect the global trend of countries wanting their own cryptographic standards and protocols to increase. Each enterprise must deal with this challenge individually. Businesses should make it a priority to know their risk exposure, as well as the cost and consequences of an attack-for employees, customers, and partners. Compliance, regulations and policies will become stricter for the private sector and the fines associated to companies with things like GDPR (General Data Protection Regulation) in the U.K. will push enterprises to prepare for stronger data protection.

Second, the aftermath of the 2015 San Bernardino attack demonstrated a potential schism between the U.S. government's and the private sector's approaches to cryptography. The advanced cryptographic and encryption that has been used in the government sector is now required for the private sector. While the FBI sought to collect counterterrorism intelligence, Apple was understandably loathed to degrade the security of its device.

U.S. national security relies as much on conducting forensics following a terrorist attack as it does on protecting encryption and by extension security in cyberspace in which we entrust our intellectual property and sensitive data. Cognizant of the importance of encryption to protect its own sensitive communications, the U.S. government should support the same strategy for our private sector.

Third, with digital technology now connecting people around the world instantaneously, we should recognize cryptography is the essence of our immune system. Cryptography and its life-cycle management are critical to countering the growing number of nefarious state and non-state actors who seek to do us harm.

Daniel Hoffman, VP at
SPG, is a retired Chief of
Station with the CIA.

Claire Trimble is the
Chief Strategy Officer at
InfoSec Global.

From the March 01, 2018 Issue of SC Media

# data[].attributes.attachment_link.title
Cryptography is the key to survival | SC Media

# data[].attributes.attachment_link.description
A fifth, man-made domain serving as a great force multiplier for commerce and free expression, cyberspace has also made us more vulnerable. We have intertwined nearly every aspect of society including critical infrastructure, business, and communication to internet technology, all of which was not initially designed to be secure in this hyper-connected world.