STE WILLIAMS

Security teams are torn between the quest to encrypt everything and the technical feasibility of doing so. The advantage of encryption is that it obscures data, even after a breach, and satisfies privacy regulations. But it can also obstruct application performance, especially when applied to data in cloud services. 

Concerns over government inspection of data, service provider breaches, and insufficient access controls all drive interest in encryption in the cloud. Many companies have internal policies or regulatory compliance standards that require data to be encrypted, with keys managed by the company (rather than the cloud provider) before it leaves their control. Security teams look for encryption schemes with the strongest possible data protection capabilities. Business and application owners want to preserve the functionality of underlying cloud applications. So what’s the “best” type of encryption?

The Functionality vs. Security Trade-off
A scheme’s security is always at odds with functionality in the cloud. No encryption scheme offers full cloud application functionality and performance with unmatched crypto strength. When implementing the strongest security, critical features of SaaS applications may fail. For example, search, document preview, graphically rendered data, and logical operations may break when data is encrypted. In other words, it’s possible to secure data to the point where it’s no longer useful. 

Teams charged with evaluating encryption in the cloud should take a three-step approach: 

• Understand their company’s functionality and security requirements 
• Understand the best security level an encryption type can achieve
• Select the type of encryption that balances all goals for their intended uses

Let’s examine the relative strengths and weaknesses of various encryption approaches. 

Regular (Unstructured) Encryption
The primary goals of regular symmetric key encryption are data confidentiality, data integrity, and sender authenticity. 

The strongest schemes hide all useful information about the data: the key, the message, any bit of the message, and any function of the message. Schemes can also provide data integrity and sender authenticity, meaning an attacker can’t create a valid ciphertext or modify a legitimate ciphertext without the user noticing. Regular encryption should be used for any data that requires the highest security, even at the price of losing search and other functionality.

Selective Encryption
Selective encryption only encrypts noncompliant substrings of a larger piece of data. This category of scheme might be used to encrypt sensitive data to ensure regulatory compliance while leaving other data unencrypted to preserve as much functionality as possible. This method is commonly used to encrypt data within collaborative content-sharing cloud applications, intranets, or extranets where personnel may be working jointly on a project. 

Sensitive data fields such as a Social Security number can be encrypted with regular encryption. Assuming one’s inspection and identification policy catches all references to the sensitive value, its security ends up fully protected. At the same time, end users may lose search functionality on this data.

Format-Preserving Encryption
Format-preserving encryption (FPE) retains the format of the original text. Using FPE, a company may take a credit card number and encrypt it so that the resulting ciphertext is a 16-digit number — helpful when an application requires a specific format. Typical scenarios requiring format preservation involve protection of credit card numbers and Social Security numbers. With FPE, the application field validation rules still function correctly while the underlying data remains encrypted. FPE leaks equality between plaintexts — that is, patterns between plaintexts and ciphertexts — and fails to provide data integrity and sender authenticity. Equality leakage allows some forms of statistical attacks, which take advantage of frequency information observed in large sets of ciphertexts to make guesses about plaintexts. So, if attackers know that the most frequent plaintext was “cat,” they can look for the ciphertext that arises most frequently in the database and infer that its plaintext is “cat.” Email addresses are a typical application of FPE. 

Searchable Encryption
Regular encryption hides data so well that search becomes impossible. But searching on encrypted data is possible if one sacrifices some security. This category of encryption leaks the equality of keywords, enabling certain statistical attacks similar to the frequency attacks discussed above. Different types of searchable encryption result in different extents of leakage, exposing data to varying levels of risk. 

Order-Preserving Encryption
Order-preserving encryption (OPE) is a searchable encryption method by which ciphertexts preserve the order of plaintexts. The ability to index, search, and sort encrypted data in external servers gives enterprises flexibility in their use of cloud services. Using OPE, an organization can protect numeric or alphanumeric fields while preserving functionality such as sorting and range queries.

Practitioners should realize that leaking order means other related information is leaked. A worst case for security arises when all possible plaintexts are encrypted: an attacker can sort the ciphertexts and know that the first ciphertext encrypts the first plaintext, the second encrypts the second plaintext, and so on. Even when smaller amounts of data are encrypted, some specific OPE algorithms have even been shown to leak up to half of the plaintext. One should tread carefully when considering using it to protect high-value data. 

Data Tokenization
Tokenization creates tokens for each plaintext, stores data and tokens locally, and then passes the tokens to the cloud application. This approach preserves a great deal of application functionality, such as searching for keywords. 

This method works well for satisfying compliance rules for data residency. The security drawbacks are similar to those of searchable encryption. Local storage of data and corresponding tokens should be protected. Users must have access to the tokenization database, potentially causing issues for remote or mobile users. 

Fully Homomorphic Encryption
In theory, fully homomorphic encryption (FHE) lets the client ask the server to search encrypted data for any function of the plaintexts or to compute, say, the average of all encrypted numbers in a database field; the server won’t learn anything about the data. While the theory is appealing, higher-level operations and real-world functionality are many years away. Even when FHE becomes feasible to use, linear search times are likely to be unacceptable for large databases.

Security teams need to communicate the trade-offs that come with technology decisions, and that road leads to encryption. While security suggests use of regular encryption for as much data as possible, functionality and legacy constraints may impede this. Newer approaches such as OPE and searchable encryption can potentially satisfy requirements when data can’t be left in the clear. In the end, practitioners must weigh the trade-offs between security and functionality to arrive at the best implementation for their needs. 

Related Content:

• Learning To Trust Cloud Security
• 5 Reasons Enterprises Still Worry About Cloud Security
• 7 Critical Criteria for Data Encryption In The Cloud

Thomas Ristenpart is on the Skyhigh Networks Cryptography Advisory Board and is a professor in the Department of Computer Sciences at the University of Wisconsin. His research spans a wide range of computer security topics, most recently focusing on new threats to, and … View Full Bio

Article source: http://www.darkreading.com/cloud/theres-no-one-perfect-method-for-encryption-in-the-cloud/a/d-id/1327972?_mc=RSS_DR_EDT

A 2016 study by security company Webroot reveals that there is no connection between the population of a city and the number of malware-infected devices it has. The conclusion comes from its list of the top 10 most malware-infected US cities.

Top on this list is Houston with 60,801 infected devices, followed by Chicago with 49,147 infected devices, and Phoenix with 42,983 infected devices. Devices include laptops, PCs, tablets, and smartphones, with each found to have between six and 24 pieces of malware on them.

From the top 10 list of most densely populated US cities, only Los Angeles is in the top 10 list of most infected.

“Our most infected cities list shows that cybercriminals have no geographical bias,” says David Dufour of Webroot. “Whether you live in a big city or small town, from east coast to west coast and everywhere in between, you are susceptible to being a victim of malware,” he adds.

For details, check out this link.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/most-malware-infected-us-cities-list-shows-size-doesnt-matter/d/d-id/1327982?_mc=RSS_DR_EDT

Cybersecurity startup SentinelOne has raised $70 million in another round of funding aimed at research and development and also infusing capital into its sales and marketing efforts, Reuters reports. Total cash collection has gone up to over $110 million, with the latest round led by new investors Redpoint Ventures and Sound Ventures, Ashton Kutcher’s and talent manager Guy Oseary’s firm.

SentinelOne, which is targeting over 400% sales growth this year, is a next-generation endpoint security technology firm that focuses on proactive rather than reactive protection for devices – using machine learning and behavioral analysis.

Other investors in this round included Third Point Ventures, Data Collective, and Granite Hill Capital Partners.

Read full story on Reuters.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/endpoint/sentinelone-raises-$70-million-in-latest-funding-round/d/d-id/1327981?_mc=RSS_DR_EDT

It’s still not mandatory to set up multifactor authentication on Facebook, but the social media giant today announced it now supports Universal 2nd Factor (U2F) standard-based hardware security keys as an extra layer of security for user accounts.

Users must purchase the keys from hardware vendors.

“Starting today, you can register a physical security key to your account so that the next time you log in after enabling login approvals, you’ll simply tap a small hardware device that goes in the USB drive of your computer. Security keys can be purchased through companies like Yubico, and the keys support the open Universal 2nd Factor (U2F) standard hosted by the FIDO Alliance,” said Facebook security engineer Brad Hill in a post today.

Two-factor authentication long has been considered a best practice for online user accounts, but it’s not in widespread use. Hardware-based key fobs are considered more secure than 2FA using SMS text messages, for example, which can be hijacked via man-in-the-middle attacks.

The move is a big win for the FIDO standard. “Today we cross a major milestone in the growth of the FIDO ecosystem as Facebook endorses FIDO authentication standards by making this capability available to its billions of users,” said Brett McDowell, executive director of the FIDO Alliance.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/cloud/facebook-adds-physical-key-security-for-member-accounts/d/d-id/1327989?_mc=RSS_DR_EDT

There’s been a lot of talk about the recent hacks against the Democratic National Committee and many, many questions and arguments about who was responsible. 

There are some interesting things about this somewhat painful national conversation. First, it’s widely believed that the attacks were launched by Russia. For most people, this resonates because they assume big attacks with big impacts must have been launched by big players. Attribution aside, this is just wrong. These attacks could have been successfully launched by anyone who spent an hour or two learning how to use the Social-Engineer Toolkit, available online.

Second, it shouldn’t matter — at all. We must assume that advanced attackers are going to attack us. Further, we can’t look at every successful attack as something that must have been mounted by an advanced nation-state actor. A few years ago, everyone was blaming China for attacks. Now, it’s Russia. When we do this, it allows us to build a convenient straw man, and it becomes easy for us to brush off the attacks as though they were inevitable. Because surely, if China or Russia were behind the attacks, there is nothing anyone could have done to stop them. The attacks become a force of nature, an act of God.

But here’s the thing: many of these attacks aren’t advanced. Not at all. And, moreover, we should be able to defend against them.

Let’s be very clear: your antivirus (AV) software won’t protect you. Every year, we at Black Hills Information Society do a webcast called Sacred Cash Cow Tipping in which we bypass most of the major AV products and explain exactly how we did it. We do this because it’s important for companies to understand that these points of defense, in and of themselves, aren’t enough to stop a determined attacker. (The most recent video can be found here.)

So, I’m going to break down how, if I were evil, I would attack a network — possibly your network.

First, I will target your user population through phishing. This approach has been in the news quite a bit lately, because of the DNC attacks. It’s interesting that many people are surprised by phishing. However, this is the same attack strategy we’ve been seeing for years. For most of our assessments, we find that roughly 20% to 30% of the user population will click on almost anything. Further, if we can couple our phishing attack with the information we learn from reconnaissance efforts, our probability of success goes way up. For example, if through recon we discover that one of your users is really into politics and often declares his political alliances on Twitter, Facebook, and LinkedIn, then we will use a ruse involving politics. 

That brings us to another point. The more a target posts on social media, the more we will focus on that user. People who are very into social media are more susceptible to targeted attacks. It could be that attackers have more information to work with when attacking. Or it could also be that these people feel the need for some level of affirmation. We feed that. That need makes them a greater risk to your organization.

I will also focus on external interfaces. I will password-spray your Web interfaces, your Outlook Web Access portals, your Secure Shell servers. (For more on password spraying, check out these blog posts by Beau Bullock.) This is where we use a single password (for example, Winter2017) and try that password on any user accounts we can enumerate online. Basically, I will attack things that shouldn’t be exposed externally.

Next, I’ll pivot as much as possible. Please check out Bloodhound and PowerShell Empire — these tools are fantastic for post exploitation, and could be the topic of a full series of articles. These tools allow an attacker to quickly identify other Windows systems and access their files and folders. This is the core goal of pivoting, using access on one system to access the resources on others.

So, How Can You Stop Me?
There has been a shift in security, and the old security fundamentals aren’t effective any longer. The new security fundamentals include implementing application whitelisting, firewalls enabled down to the host level, and user behavioral analytics (UBA). UBA is exceptionally interesting because it is looking at user access patterns for indicators of compromise rather than just looking at program signatures. 

These are just some of the new things that security-minded organizations need to start implementing straight away. I understand that for many organizations, there are massive political and technical complexity challenges in play. But you must start looking into these methods right now. In fact, it’s already too late — you should have started years ago. If you did, good for you. If you haven’t started, get to it.

Let’s summarize. First, your AV won’t be a problem for me and will easily be bypassed. Second, I will phish your employees by using as much social media and reconnaissance as I can. Third, I will exploit all externally facing interfaces, portals, and servers. Finally, I will pivot as much as possible. How do you defend against me? Stop using your AV as a crutch, keep a smarter social media image (and encourage employees to do the same), implement whitelisting and firewalls, even at the host level, and UBA. Good luck.

(Note: John Strand will be giving a talk on this topic at upcoming SANS events in Scottsdale, Ariz., and Tysons Corner, Va.)

Related Content:

• Researchers Shoot Down Yahoo Claim Of Nation-State Hack
• Deconstructing Connected Cars: A Hack Waiting To Happen
• 91% Of Cyberattacks Start With A Phishing Email

John Strand is a senior instructor with the SANS Institute. He teaches SEC504: Hacker Techniques, Exploits, and Incident Handling; SEC560: Network Penetration Testing and Ethical Hacking; SEC580: Metasploit Kung Fu for Enterprise Pen Testing; and SEC464: Hacker Guard: … View Full Bio

Article source: http://www.darkreading.com/cloud/how-i-would-hack-your-network-(if-i-woke-up-evil)-/a/d-id/1327985?_mc=RSS_DR_EDT

A new survey by the Pew Research Center on how Americans view cybersecurity finds that most people are concerned about online security but forgo the necessary steps to protect themselves.

The survey of 1,040 US adults shows that 41% of them have shared the password to one of their online accounts with friends or family members. Young adults are especially likely to engage in this behavior – 56% of online adults ages 18- to 29 have shared passwords.

Along with sharing passwords, 39% say they use the same password or very similar passwords for many of their online accounts. And 25% often use passwords that are less secure than they’d like because simpler passwords are easier to remember than more complex passwords.

“When it comes to passwords, very few of us are acing the test,” says Aaron Smith, a co-author of the report, and associate director, research, at Pew. “And no age group is doing particularly well.”

Smith says the study also found that people feel that they have lost control over their personal information. For example, the study found that 64% have directly experienced some type of significant data theft or fraud and 49% think their personal data has become less secure in recent years.

Americans have also lost confidence in major institutions to protect their data, mostly notably the federal government (28%) and social media sites (24%).  In contrast, 42% of respondents say they are “somewhat confident” and another 27% say they are “very confident” that their credit card companies can be trusted to protect their data.

“In some ways it’s not a fair comparison because social media sites especially don’t have a full customer service staff and 1-800 numbers to call,” says Eddie Schwartz, board director at ISACA. “Social media sites like Facebook are free and you get what you pay for.”

Schwartz adds that for the most part the Pew data meshes with a recent ISACA/RSA study from last year where 74% of respondents said they expected to fall prey to a cyberattack in the next year, and 60% hsf experienced a phishing attack.

“So yes, we know these cyberattacks are happening, we know they are bad, we’re afraid, but not always willing to do something about it,” Schwartz says.

On a more positive note, the Pew study found that 52% of those surveyed use two-factor authentication on at least some of their online accounts. And 57% say they vary their passwords across their online accounts.

Here’s a sampling of some of the other findings of the report:

• Roughly 10% of those surveyed say they never update the apps on their smartphone, and only 32% do so automatically. Another 14% say they never update the operating system.
• 51% surveyed say a major attack on our nation’s public infrastructure will “probably” happen in the next five years, while 18% say it will “definitely” happen.
• 75% of American have heard at least something about the Target breach, and 47% has heard “a lot” about it. Only 33% of those surveyed are aware of the OPM attack with only 12% hearing “a lot” about it.
• Americans are divided over encryption. 46% believe that the government should be able to access encrypted communications to investigate crimes, while 44% says that technology companies should be able to use encryption tools that are unbreakable to law enforcement. Democrats and younger adults tend to support strong encryption, while Republicans side with law enforcement. 

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: http://www.darkreading.com/cloud/pew-research-study-exposes-americas-poor-password-hygiene/d/d-id/1327980?_mc=RSS_DR_EDT