News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
GET RECOGNIZED
Let an ISACA® certification elevate your career.
Register today and save
You are here: Home / Communications / What Enterprises Can Learn from NSA
DDoS Protection Powered By Verisign
What Enterprises Can Learn from NSA Encryption Cracking
What Enterprises Can Learn from NSA Encryption Cracking
By Jennifer LeClaire / NewsFactor Network Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
SEPTEMBER
06
2013



With a little help from supercomputers, court orders, arm twisting, and technical prowess, the National Security Agency (NSA) can beat your encryption. So says a report from the New York Times.

Specifically, the paper reports that secret documents show that the NSA has circumvented or cracked much of the encryption, or digital scrambling, that guards global commerce and banking systems, protects sensitive data like trade secrets and medical records, and automatically secures the e-mails, Web searches, Internet chats and phone calls of Americans and others around the world.

"Two decades ago, officials grew concerned about the spread of strong encryption software like Pretty Good Privacy, designed by a programmer named Phil Zimmermann," Times' reporters Nicole Perlroth, Jeff Larson and Scott Shane wrote in the article they penned together. "The Clinton administration fought back by proposing the Clipper Chip, which would have effectively neutered digital encryption by ensuring that the NSA always had the key."

Focusing in Network Layer

For insight into the headlines, we turned to Kevin O'Brien, an enterprise solution architect at CloudLock. He told us the lesson here is that the network layer is the principle means of access for the NSA, through its backdoor arrangements to capture data as it flows through various providers' systems.

"In analyzing that data, much of which is encrypted on the wire, their approach is to exploit systemic vulnerabilities rather than attempting brute-force attacks on the encryption keys themselves," O'Brien said.

"Calling these approaches 'groundbreaking analytic capabilities' is a stretch: dictionary attacks on poorly chosen passwords, well-known vulnerabilities in insecure protocols, and other recognized vectors of encryption breaking are not new," he said. "The scale and scope of these attacks by the NSA are noteworthy, however."

Troubling Secret Arrangements

But here is what's more trouble to O'Brien: There appears to be secret arrangements with platform providers. In other words, the NSA is apparently exerting pressure for software companies to design in mechanisms through which the NSA's monitoring network can gain access to data, presumably post-decryption, removing the need to crack the algorithms being used.

"While the full scope of what constitutes 'groundbreaking' is not known, it's probably safe to assume that the NSA is taking advantages of these mechanisms -- likely built-in flaws in random number generators, or software backdoors that externalize data during decryption -- to simply bypass strong cryptography," O'Brien said.

If anything, he noted, this new set of revelations should be starting a conversation around just what constitutes strong cryptography, and how to implement it securely. As he sees it, part of that entails using open standard algorithms from reputable organizations, and avoiding vendor-locked encryption that is susceptible to NSA influence.

"Similarly, making it more difficult to be a target for network-level access is important, as it increases the cost and challenge for the NSA -- or any other interested party -- to obtain the encrypted stream of data in the first place," O'Brien said. "One of the first principles in network and signal security is that defense-in-depth works, the maxim holds true even in light of revealed weaknesses in one layer of -- what should be -- a sophisticated data privacy strategy."

Tell Us What You Think
Comment:

Name:

Brandt Hardin:

Posted: 2013-09-06 @ 5:25pm PT
The dystopian fantasies of yesteryear are now a reality. We’ve allowed the coming of an age where the civil liberties our forefathers fought so hard for are being eroded by the day. Freedom of Press, Freedom of Speech and Freedom of Assembly are mere ghostly images of their original intent. We’ve woken up to an Orwellian Society of Fear where anyone is at the mercy of being labeled a terrorist for standing up for rights we took for granted just over a decade ago. Read about how we’re waging war against ourselves at http://dregstudiosart.blogspot.com/2011/09/living-in-society-of-fear-ten-years.html

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.
MORE IN COMMUNICATIONS
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Dairy Queen Latest Retailer To Report Hack
Known for its hot fries and soft-serve ice cream, Dairy Queen just made cyber history as the latest victim of a hack attack. The fast food chain said that customer data at some stores may be at risk.
 
Lessons from the JPMorgan Chase Cyberattack
JPMorgan Chase is investigating a likely cyberattack. The banking giant is cooperating with law enforcement, including the FBI, to understand what data hackers may have obtained.
 
Who Is the Hacker Group Lizard Squad?
Are they dangerous or just obnoxious? That’s what many are wondering about the hacker group Lizard Squad, which tweeted out a bomb threat that grounded a flight with a Sony exec aboard.
 

Enterprise Hardware Spotlight
AMD's New FX Series CPU Breaks Processing Speed Record
The new FX-8370 processor from Advanced Micro Devices has set a record for silicon processor speed, the company announced. Overclocked, the eight-core chip was measured at 8722.78 MHz.
 
Intel Intros Lightning-Fast PC Processors
Call it extreme. Intel just took the covers off its first-ever eight-core desktop processor, which is aimed at hardcore power users who expect more than the status quo from their computers.
 
HP Previews ProLiant Gen9 Data Center Servers
Because traditional data center and server architectures are “constraints” on businesses, HP is releasing new servers aimed at faster, simpler and more cost-effective delivery of computing services.
 

Mobile Technology Spotlight
Rumor Mill Puts Mobile Wallet in iPhone 6
Apple is moving toward the mobile wallet world with its next iPhone. The tech giant has partnered with retailers, banks and major payment networks to make it happen, according to Bloomberg.
 
Will iPhone Finally Catch Up with NFC Mobile Payment Ability?
Apple's latest version of the iPhone may have a mobile wallet to pay for purchases with a tap of the phone. The iPhone 6 reportedly is equipped with near-field communication (NFC) technology.
 
Visual Search To Shop: Gimmick or Game Changing?
Imagine using your phone to snap a photo of the cool pair of sunglasses your friend is wearing and instantly receiving a slew of information about the shades along with a link to order them.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech | Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.