Security of Solid-State-Drive Encryption

Schneier on Security

Interesting research: " Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs) ": Abstract: We have analyzed the hardware full-disk encryption of several SSDs by reverse engineering their firmware.

GDPR Compliance – Encryption

Perficient Data & Analytics

Nowhere GDPR Articles mention that encryption is necessary but implementing such measures can reduce the occurrence of a data breach. GDPR Compliant Encryption Methods. The two most commonly stated GDPR-compliant encryption methods mentioned in the GDPR Articles are as follows, 1.

The GDPR: Requirements for encryption

IT Governance

Six months since the GDPR (General Data Protection Regulation) came into force, pseudonymisation and data encryption remain the only technology measures specifically mentioned in the famously technology-agnostic Regulation. But what exactly is meant by ‘pseudonymisation’ and ‘encryption’?

Intel Patches Firmware Flaw That Leaks ME Encryption Keys

Data Breach Today

It has issued yet another patch for its Management Engine after a researcher was able to extract two types of encryption keys. Researcher Finds Intel's Previous Management Engine Patches Weren't Foolproof Intel has had a challenging time of late on the vulnerability front.

Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain

Security Affairs

The encryption system implemented by popular solid-state drives (SSDs) is affected by critical vulnerabilities that could be exploited by a local attacker to decrypt data. “We have analyzed the hardware full-disk encryption of several SSDs by reverse engineering their firmware.

More on the Five Eyes Statement on Encryption and Backdoors

Schneier on Security

Earlier this month, I wrote about a statement by the Five Eyes countries about encryption and back doors. backdoors cryptowars cryptography encryption intelligence lawenforcement privacy

Is All Encryption Equal?

Thales Data Security

Data encryption has been around almost since the age of computers. In truth, anyone with minimal experience can write a simple script that uses default services built into virtually every OS to encrypt data. The answer to these question changes your encryption strategy.

Cracking Down on Criminals' Use of Encrypted Communications

Data Breach Today

An analysis of a crackdown on criminals' use of encrypted communications leads the latest edition of the ISMG Security Report. Also: a preview of ISMG's Healthcare Security and Legal & Compliance summits, including expert insights on vendor risk management

IEEE Statement on Strong Encryption vs. Backdoors

Schneier on Security

The IEEE came out in favor of strong encryption: IEEE supports the use of unfettered strong encryption to protect confidentiality and integrity of data and communications. backdoors encryption keyescrow nationalsecuritypolicy vulnerabilities

FBI: Encryption Blocked Access to 7,800 Devices

Data Breach Today

Director Calls For 'Responsible' Solution That's Not a Backdoor FBI Director Christopher Wray says the agency was unable to access nearly 7,800 devices in fiscal 2017 because of encryption, which he alleges will pose ever-increasing complications for law enforcement.

Virginia Beach Police Want Encrypted Radios

Schneier on Security

This article says that the Virginia Beach police are looking to buy encrypted radios. Virginia Beach police believe encryption will prevent criminals from listening to police communications. backdoors encryption lawenforcement police

NEW TECH: DataLocker introduces encrypted flash drive — with key pad

The Last Watchdog

One sliver of the $90 billion, or so, companies are expected to spend this year on cybersecurity products and services is an estimated $85 million they will shell out for encrypted flash drives. DataLocker honed its patented approach to manufacturing encrypted portable drives and landed some key military and government clients early on; the company has continued branching out ever since. The encryption in our products is handled by a chip inside the actual hardware itself.

Is Payments Industry Ready for New Encryption Protocols?

Data Breach Today

PCI-DSS Requirement Looms on June 30 New PCI requirements that go into effect June 30 are pushing payment card acquirers, processors, gateways and service providers worldwide to implement more secure encryption protocols for transactions.

Database Encryption Key Management

Thales Data Security

Large data scale breaches have led an increasing number of companies to embrace comprehensive encryption strategies to protect their assets. Solutions for Transparent Database Encryption. Streamlining operations and improving security.

Samsung, Crucial’s Flawed Storage Drive Encryption Leaves Data Exposed

Threatpost

Cryptography Privacy Vulnerabilities Bitlocker crucial data encryption physical access raboud university Samsung solid state drives vulnerabilityFirmware updates won't address the problem, so admins need to take other action.

Apple to Store Encryption Keys in China

Schneier on Security

Apple is bowing to pressure from the Chinese government and storing encryption keys in China. apple china cloudcomputing encryption iphone keyescrow privacy

Two New Papers on the Encryption Debate

Schneier on Security

Seems like everyone is writing about encryption and backdoors this season. Policy Approaches to the Encryption Debate ," R Street Policy Study #133, by Charles Duan, Arthur Rizer, Zach Graves and Mike Godwin. Encryption Policy in Democratic Regimes ," East West Institute.

Amazon, Google Block Trick That Let Encrypted Chats Flow

Data Breach Today

Collateral damage is already being felt by the likes of Signal, a popular, encrypted-messaging app blocked by some governments

FBI Director's Encryption Comments Prove Controversial

Data Breach Today

An analysis of FBI Director Christopher Wray's comments about how encryption poses complications for law enforcement officials leads the latest edition of the ISMG Security Report. Also featured: The former CISO of the state of Michigan sizes up cybersecurity forecasts

‘Significant’ FBI Error Reignites Data Encryption Debate

WIRED Threat Level

FBI stats about inaccessible cellphones were inflated, undermining already controversial bureau claims about the threat of encryption. Security

Why Enterprises Should Control Their Encryption Keys

Thales Data Security

Cloud providers have done a good job of integrating default encryption services within their core infrastructure. However, as discussed in previous blogs , the encryption service is only as secure as the keys that are used to encrypt the data.

An Encryption Upgrade Could Upend Online Payments

WIRED Threat Level

encryption will benefit the payments ecosystem, it'll be rough going for those with older devices. While ditching TLS 1.0 Security

When Encryption Meets Flash Arrays

Thales Data Security

To combat threats and keep data safe, IT teams must employ robust encryption, key management, and access controls. To secure storage, many organizations have been leveraging native encryption offerings from their storage vendors.

To Go Native, Or Not to Go Native. A Cautionary Tale About Database Encryption

Thales Data Security

As a result, database encryption has never been more crucial in order to protect the massive amounts of information that is held in the diverse mix of databases that large enterprises rely on today, including relational, SQL, NoSQL and big data environments. Database Encryption

Multi-cloud use, regulatory compliance and information protection drive new era of encryption and key management in France

Thales Data Security

Now in its 13 th year, our Global Encryption Trends Study that is performed by the Ponemon Institute reveals interesting findings that span a dozen different geographies. Below I have highlighted other key trends revealed in the 2018 France Encryption Trends Study. Encryption

Q&A: The troubling implications of normalizing encryption backdoors — for government use

The Last Watchdog

Should law enforcement and military officials have access to a digital backdoor enabling them to bypass any and all types of encryption that exist today? The disturbing thing is that in North America and Europe more and more arguments are being raised in support of creating and maintaining encryption backdoors for government use. Here are excerpts edited for clarity and space: LW: What’s wrong with granting governments the ability to break encryption?

Cloudflare's New Encryption Service Adds Privacy Protection

WIRED Threat Level

Internet infrastructure company Cloudflare appears to be preparing to launch a service to encrypt traffic to the computers that look up web addresses. Business Security

Does Encryption Really Protect My Cloud Data?

Thales Data Security

To address this, many regulations and enterprise policies turn to encryption as a safe and efficient way to protect data. Encryption adds security at the root of the risk, which is not at the client, server, or device layer but rather at the data itself.

Encrypted Messaging Apps Have Limitations You Should Know

WIRED Threat Level

As recent events have shown, using an encrypted messaging app like WhatsApp or Signal is no privacy panacea. Security

EFail: Encrypted Email Has a Major, Divisive Flaw

WIRED Threat Level

An attack called eFail overcomes the protections of encrypted email standards PGP and S/MIME. Security

FBI Director Calls Smartphone Encryption an ‘Urgent Public Safety Issue’

Threatpost

The debate over the government's authority to access private encrypted data on digital devices was amplified when the Federal Bureau of Investigation Director Christopher Wray called unbreakable encryption an 'urgent public safety issue.'. google iPhone 5c iPhone encryption San Bernardino smartphone encryption terrorist U.S.

Pixek App Encrypts Your Photos From Camera to Cloud

WIRED Threat Level

Pixek, an end-to-end encrypted photo app, could point to the future of searchable cloud data storage. Security

The 'Doublespeak' of Responsible Encryption

WIRED Threat Level

It's a new name for an old argument: that public agencies fighting crime and terrorism must have access to our private communications—for our own good. Security

Skype Introduces End-to-End Encrypted Texts and Voice

WIRED Threat Level

After years of lingering questions about Skype's commitment to protecting user data, it will soon offer end-to-end encryption to its 300 million monthly users. Security

Microsoft Adds Direct Trust for Let’s Encrypt

Threatpost

Let’s Encrypt certificates can now stand on their own for almost all newer versions of operating systems, browsers and devices. Web Security browsers digital certificates direct trust HTTPS Let's Encrypt Microsoft

A RESTful API Delivers Flexibility for Vormetric Application Encryption

Thales Data Security

One of the long standing challenges with security applications that involve data encryption has been key management. Vormetric Application Encryption. Today’s Vormetric Application Encryption provides a library that provides the PKCS #11 interface as a dynamically loadable library (.DLL)

Australia drafts laws forcing Facebook and Google to reveal encrypted data

The Guardian Data Protection

Security agencies would be given access to encrypted messaging apps under bid to ‘modernise’ laws Technology companies such as Facebook and Google would be forced to give Australian security agencies access to encrypted data under legislation to be introduced by the Turnbull government. Related: Encryption keeps us safe. Data protection Australia news Australian security and counter-terrorism Technology Encryption Facebook Google Social networking

macOS QuickLook Feature Leaks Data Despite Encrypted Drive

Threatpost

Researchers demonstrate how an encrypted macOS hard drive can still leak unprotected data via the operating system’s Finder and QuickLook feature. Cryptography Hacks Privacy Apple File System containers encrypted hard drive macOS Patrick Wardle QuickLook VeraCrypt container

As Personal Encryption Rises, So Do Backdoor Concerns

Dark Reading

Geopolitical changes drive personal encryption among security pros, who are increasingly worried about encryption backdoors

SEVered Attack Extracts the Memory of AMD-Encrypted VMs

Threatpost

Virtual machines that use AMD’s hardware-based encryption scheme are vulnerable to attacks that can extract the full contents of their main memory – in plaintext. Uncategorized AMD attack Encryption Hypervisor Research Secure Processor sev severed virtual machine virtualization VM

Telegram loses bid to stop Russia from getting encryption keys

Information Management Resources

The maker of an encrypted messaging app that’s prized by those seeking privacy lost a bid before Russia’s Supreme Court to block security services from getting access to users’ data. Encryption Data security Cyber security

Australian bill to create back door into encrypted apps in 'advanced stages'

The Guardian Data Protection

Government moves ahead with legislation despite criticism from the opposition The Australian government is pushing ahead with controversial legislation it says will create “back doors” into encrypted communication services – but still can’t say when it will introduce the bill. Related: We need to build a new social contract for the digital age | Kevin Keith Related: New law would force Facebook and Google to give police access to encrypted messages Continue reading.

WhatsApp Encryption Security Flaws Could Allow Snoops to Slide Into Group Chats

WIRED Threat Level

German researchers say that a flaw in the app's group-chat feature undermines its end-to-end encryption promises. Security