Posted by Kalyani M. on May 21, 2014
Enterprises invest huge sums of money on developing security mechanisms to protect company assets and networks against cyber attacks. With ever-emerging security threats, it becomes imperative for any organization to bolster their security controls. Organizations tend to focus on introducing new technical upgrades, improving encryption technologies, better threat detection, and prevention tools for preventing unauthorized access to their company resources. However, there is one popular means of gaining access that completely bypasses technologies and security systems. Social Engineering is a form of attack in which the attacker uses a variety of psychological tricks on a user to gain access to a computer or network.
Posted by Kalyani M. on May 15, 2014
In today’s age of technology, it is safe to say that the mobile phones have surpassed desktop PCs in terms of popularity and usability. You can get all your tasks accomplished on a small portable device, rather than sitting in front of a static computer for hours. You can surf the Internet, pay your bills, do shopping, and socialize with your friends, all from your smartphone. Besides being easy and convenient to use, another major reason behind the popularity of mobile devices is the availability of apps. There is an app for almost everything these days, from banking to health and fitness. With smartphones, all kinds of services are just a click away. However, because of their widespread use and popularity, mobile phones are vulnerable to cyber attacks.
Posted by Kalyani M. on Apr 24, 2014
With the recent flurry of concern over the Heartbleed bug, many are now questioning if the vulnerability truly went undetected. The PRISM revelations brought into light how the NSA has been exploiting security controls over the Internet to gain access to user data. According to the documents leaked by former NSA contractor Edward Snowden, the NSA has been successful in cracking the majority of encryption standards on the web by exploiting vulnerabilities in commercial products, through backdoor methods, or by sending legal notices to Internet companies. They have tried a myriad of ways to get access to the sensitive information of millions of Americans. Given the surveillance activities of the NSA, people have become extremely cautious about what to share and what to keep private regarding electronic medium. Internet companies like Yahoo, Google, and Apple have implemented strong security controls to protect their customer data from government surveillance.
Posted by Kalyani M. on Apr 17, 2014
In my last post, we examined the ins and outs of the HeartBleed security vulnerability in OpenSSL that has affected about half a million websites and client-side software. This bug being considered as one of the biggest threats the Internet has ever seen. Many popular websites like Yahoo, Flickr, NASA, and OKCupid are vulnerable to the HeartBleed bug. That means the information passing through these websites could also be targeted by cyber attacks, even though they are encrypted. The HeartBleed bug allows an attacker to get access to sensitive personal information like private keys, user keys, passwords, usernames, and credit card details. Security expert Bruce Schneier has termed HeartBleed as a “catastrophic” bug, and “on the scale of 1 to 10 gives it 11” in terms of severity.
Posted by Kalyani M. on Apr 15, 2014
A major security bug, “Heartbleed”, has been making major headlines recently. The security vulnerability has infiltrated many well-known websites, and affected millions of users. It was discovered in some versions of OpenSSL, utilized by thousands of websites. OpenSSL is an encryption technology that uses TLS/ to secure communication over the Internet, and protect sensitive user information like usernames, passwords, credit card numbers, and financial data. Therefore, the exploitation of this critical bug allows cyber criminals to gain access to personal details of millions of Internet users. More information makes an attacker stronger, and opens the door to many more intrusions.
The bug was identified by a group of security engineers at Codenomicon while they were working on improving the security features of the company’s security testing tools. Heartbleed could be considered as one of the biggest security threats in Web security, because it exposes the contents of a server’s memory, where most sensitive user data is stored. This vulnerability allows anyone on the Internet to read the memory of systems protected by vulnerable versions of OpenSSL. It can compromise the private keys used for encrypting communication and identifying trusted sources on the Internet. The most worrisome aspect of this news is that this vulnerability existed for two years and was not detected until recently.
Posted by Kalyani M. on Mar 27, 2014
The recent major data breach at Target has been an eye-opener that showed how malware infected Point-Of-Sale (PoS) devices can be exploited to gather huge amounts of credit and debit card data. Malware attacks are on the rise these days. The reason why most of these attacks are successful is because most of the malware being used is new and unknown, and no defense mechanisms are in place to counter it. Another new form of malware, called Ploutus, is targeting ATM machines and allowing cyber criminals access cash. In order to install this malware, the hacker needs to be able to physically access the ATM machine. Therefore, in the majority of cases it is seen that standalone ATM machines, especially the ones in convenience stores, become victims of data breaches. The ATM machines in banks are usually more secure than standalone ATM machines, and have a heavy physical shield protecting them from unauthorized access.
Posted by Kalyani M. on Mar 20, 2014
The PRISM revelations have made us more aware and proactive regarding maintaining our privacy in the electronic medium. The NSA has left no stone unturned to monitor and gather millions of user data. They have circumvented almost every security control on the Internet for bulk data collection. When it is not possible for them to break into the system, they provide legal notice to companies to access sensitive user information. In such a situation, how can we expect to maintain the security of our data? How can businesses retain the trust of their consumers that their data is safe from surveillance?
Recently, Edward Snowden spoke at the Southwest Interactive technology festival in Austin via satellite video, regarding the importance of encryption for data privacy. He said encryption works if it is implemented properly. This practice has time and again proved to be one of the most effective ways of protecting data. Snowden emphasized that encryption should not only be implemented by businesses, but active research and analysis should also be done on this security control at an academic level. The best method is end-to-end encryption. It ensures complete security of data against unauthorized access. However, often times it is seen that end-to-end encryption is not implemented in mainstream commercial products. Across the majority of the Internet, online companies are hesitant to implement end-to-end encryptions in their products.
Posted by Kalyani M. on Mar 18, 2014
Cloud computing is attracting many enterprises because of its easy deployment, cost effectiveness, and flexibility. One of the major advantages of cloud computing is its disaster recovery approach. With this system, enterprises have a cost effective disaster recovery plan in place, and do not have to worry about deployment and maintenance of IT infrastructure or resources for disaster recovery. Cloud computing gives a completely different approach to disaster recovery. In this approach, the operating system, data and applications are integrated into a single software bundle or virtual server. This virtual server can be easily copied and backed up on an off-site data center within minutes. In comparison to the conventional disaster recovery approaches, this is extremely beneficial because it is hardware independent and therefore it is easy to transfer information from one data center to another without the burden of installing every component of the server. Cloud-based disaster recovery approach is extremely cost effective and dramatically reduces recovery time compared to traditional approaches.
Posted by Kalyani M. on Feb 20, 2014
Recently we have examined both the conveniences and concerns regarding cloud services, and the conversation is most likely far from over. National Security Agency surveillance has definitely raised concerns about privacy of user data in cloud services. Documents leaked by Edward Snowden indicate that the NSA has been collecting huge amounts of user data by cracking encryption technologies, using backdoor methods, and in some cases providing legal notice. As enterprises are using well-known cloud services like Amazon or Google, the PRISM revelations might lead to a negative impact on U.S. cloud storage companies, as the surveillance activities of the spy agency have taken a toll on the reputation of technology companies. People are becoming increasingly concerned about the privacy and security of their data stored in the cloud.
The NSA is basically devising all possible ways to break the security controls on the web to track and collect huge amounts of user data. The news about the NSA cracking encryption of common online security products and placing secret doors at the access points can further undermine the confidence of foreign businesses. The NSA has been successful in cracking the majority of the encryption codes on the Web, by using supercomputers, technical trickery, court orders, and behind-the-scenes persuasion. Apart from deciphering the encryption of online products, the NSA has devised programs to deliberately insert vulnerabilities in commercial products, so that they may collect more information by exploiting those vulnerabilities. The NSA asks these companies to deliberately make changes to their products in undetectable ways like leaking encryption keys, making random number generator less random, adding a common exponent to a public-key exchange protocol, and so on.
According to research done by the information technology and innovation foundation (IITIF), NSA surveillance may end up costing U.S. cloud service companies $22 billion through 2016. The prediction by IITIF assumes that the U.S. might lose about 10% of its cloud computing market to European and Asian competitors. The United States is considered a leader in cloud computing usage and innovation, but PRISM revelations might cause a shift away from leading data storage providers like Google, Yahoo, and IBM. Salesforce.com recently lost one of their major clients due to government surveillance activities. This is just one example showing the negative impact of surveillance on cloud services. In the future, if the government does not take a stand on reforming the surveillance programs, cloud service companies in this country might have to bear huge loss.
Taking all of the security concerns into consideration, many companies have requested the government to allow them to publish a transparent report of mass data collection requests made my the NSA. In order to gain the trust of their customers, it is extremely important for cloud service providers to be transparent regarding the storage and sharing of sensitive user information. The government needs to take action towards reforming the surveillance program, and allow companies to reveal more details about what data has been requested of them by the government. It also needs to establish international transparency to gain the trust of foreign customers.
Similarly, cloud service providers also need to implement strong security controls to ensure better safety of their customers from surveillance programs. It would be wide for them to construct strong encryption standards such as 256 bit-AES for better security. Encryption has time and again proved to be the most secure method for protecting data in the cloud. The keys used for encrypting sensitive customer data should be managed effectively by periodic key rotation and re-encryption of data with new keys. Employees should be not be given more access than what is needed to complete their tasks. Cloud storage companies should require strong passwords, longer keys, or complex hash algorithms to make it difficult for anyone to access user data.
I believe by implementing security measures and being transparent data usage, companies can gain the trust of their customers, and those who have been enjoying the benefits of U.S. cloud services might think twice before moving to alternate services. Under the light of NSA surveillance, cloud startups whose prime goal is to secure their customer data will see a huge growth in their business in the near future.
Protect your personal data from NSA surveillance with SpiderOak: SpiderOak encrypts the files in your computer before uploading them to the server. As a result, you, and only you, have access to your unencrypted data. Even SpiderOak cannot read your data because the keys used for encryption only belong to you. It is impossible for someone to gain control of your data by hacking into SpiderOak. This way, even if programs like NSA’s PRISM continue to stand unchallenged, people can rest easy knowing that their data is truly protected. SpiderOak offers amazing products like SpiderOak Hive and SpiderOak Blue to secure consumer and enterprise data. SpiderOak Blue provides enterprises with a fully private cloud service featuring all of the benefits of cloud storage along with 100% data privacy. And for the average web user, SpiderOak offers the same protections with lower costs and smaller storage space. You can sign up for this product now.
Posted by Kalyani M. on Feb 18, 2014
Cloud services are becoming increasingly popular these days, both among the public and business enterprises. While convenient, Cloud services can be extremely vulnerable to Denial of Service attacks (DoS). As more organizations are relying on cloud computing technology for their business operations, denial of service attacks, one of the most common forms of attack on the cloud, can prove extremely damaging. A DoS attack makes your network or machine unavailable to the intended users by flooding them with connection requests. Within the eighth annual Worldwide Infrastructure Security Report from security provider Arbor Networks, it was revealed how cloud services increase the risk of attacks. The report indicated: “94% of data center operators reported security attacks, 76% had suffered distributed denial of service (DDoS) attacks towards their customers, while just under half (43%) had partial or total infrastructure outages due to DDoS and yet only 14% of respondents had seen attacks targeting any form of cloud service.”