Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

NSA Fallout: Encrypt Everything, Enterprises Advised

The NSA may have cracked crypto and added product backdoors, but businesses must focus on internal security practices as well.

20 Great Ideas To Steal In 2013
20 Great Ideas To Steal In 2013
(click image for larger view)
The National Security Agency -- and by extension, some foreign intelligence agencies and perhaps even criminal syndicates -- can silently intercept encrypted communications and access off-the-shelf products that were thought to be secure.

In the wake of those NSA Bullrun program revelations -- courtesy of documents leaked by whistleblower Edward Snowden -- businesses are now asking: How should we react?

Here are five related recommendations from information security and cryptography experts:

1. Don't Blame NSA For Poor State Of Business Security

Start by looking inwards. "This is a great time to focus on ourselves," said encryption expert Ivan Ristic, director of engineering at Qualys, via email. "First of all, the mess with security is almost all ours. Yes, the NSA helped a bit by subverting security in any way it could, but it couldn't have done it without us focusing on time to market, performance and profit, rather than on security."

[ Here is another security tool to think about. Read iPhone 5s Fingerprint Scanner: 9 Security Facts. ]

"Thus, if we are to blame anyone, we can only blame ourselves," he said. "We didn't need the NSA to tell us that our security was bad. That was obvious -- if you wanted to hear."

2. Now Encrypt Everything

Information security professionals would do well to use the NSA revelations as a catalyst for improving their own business information security defenses. "Now that everyone is paying attention, it is a great time to start taking security seriously," said Ristic. "What specifically [is there] to do? Encrypt everything. Don't worry about what might be broken; we can fix those things once we learn the facts," he said, referring to as-yet-vague reports about precisely which crypto systems or products the NSA has either weakened or cracked.

Encrypting everything, of course, will take time and money. But consider the alternative: leaving businesses as sitting ducks for any adversary -- looking here beyond the NSA -- that might want to steal their intellectual property.

On that front, when adding more levels of encryption to better secure data in transit and at rest, security experts recommend first identifying what information business competitors or foreign adversaries would be most interested in stealing, then securing that first.

3. Channel Google's Security Moves

In terms of proactive security, businesses might take inspiration from Google, which this week announced that it has accelerated plans to encrypt all traffic flowing between its data centers.

Does that seem excessive? Consider that what Google does today, most businesses emulate at some later date. For example, Google made HTTPS the default for Gmail, and later all of its services, while rival Facebook didn't follow suit until nearly three years. Likewise, Google added two-step log-in verification for account access back in 2010. But Twitter didn't roll out a similar feature until earlier this year, in the wake of an account takeover onslaught courtesy of the Syrian Electronic Army.

4. Focus On Internal Security, Not NSA

Today, encryption experts are raging over reports that the NSA purposefully subverted strong crypto that businesses and others -- dissidents in autocratic regimes, for example -- have been relying on to keep communications safe. But to date, many businesses haven't been doing what it takes to secure their communications, said David Jevans, CTO of enterprise mobile security firm Marble Security, via email.

"Most email, Web searches, Internet chats and phone calls are not encrypted. The NSA -- or anyone else -- merely needs to scan Internet traffic to read most of it," said Jevans, who's also chairman of the Anti-Phishing Working Group and a member of the Department of Homeland Security ID Theft Technology Consortium.

Qualys' Ristic echoed that assessment. "Why are we still using unencrypted protocols?" he said. "There are gaps at every level: IP, DNS, email, the Web. Only a fraction of the traffic is encrypted. Why are we still developing using tools that are painfully vulnerable to well-understood security issues, such as buffer overflows?"

Even when strong tools are available, not all businesses and technology vendors are using them. For example, take Transport Layer Security, which leaked Bullrun documents revealed that the NSA can defeat, thus allowing the agency to decode encrypted HTTPS traffic. But that doesn't mean that the protocol -- and by extension Internet security -- is permanently broken. "It needs to be upgraded more than redesigned," said PGP co-founder Jon Callas, who's CTO of Silent Circle, in a recent interview. "TLS 1.2 is not bad, and if everything were there, we'd be a lot better off," he said.

5. Keep Believing In Strong Crypto

Despite the NSA revelations, and as the above recommendations suggest, the prevailing wisdom continues to be that strong encryption remains effective. "Snowden said that himself. It's the rest of the systems that need careful examination," Callas said.

Security researcher and encryption expert Adam Caudill echoed that assessment. "I still trust strong cryptography," he said via email. "I trust AES-256, I trust ECC with non-NSA curves, I trust RSA with keys that are at least 2048 bits."

Just what is the NSA likely capable of cracking? "I suspect they can factor 1024-bit RSA keys in a fairly short amount of time, and some of the success they noted is based on that," Caudill said. "Actually, I'd be shocked and a bit disappointed if they can't."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WKash
50%
50%
WKash,
User Rank: Apprentice
9/12/2013 | 9:56:06 PM
re: NSA Fallout: Encrypt Everything, Enterprises Advised
An RSA executive I spoke with this week agreed that NSA has the computing power, but also the talent, to break just about any encryption it runs into. But a source who spoke directly with a senior NSA IT official very recently told me that NSA is concerned that it could be entering an arms race with private industry over encryption -- and resource constraints could make it harder for even the NSA to keep up with the private sector.
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
9/12/2013 | 8:53:36 PM
re: NSA Fallout: Encrypt Everything, Enterprises Advised
Security experts were saying as much when Heartland Payment Systems was hacked several years ago.
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
9/12/2013 | 5:57:29 PM
re: NSA Fallout: Encrypt Everything, Enterprises Advised
Re. #3 your points about Google wising up early are interesting. How widely is such traffic encrypted between data centers today? Are many companies there already?
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18980
PUBLISHED: 2019-11-14
On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's operation. Anyone can turn the bulb on or off, or change its color or brightness remotely. There is no authentication or encryption to use the control API. The o...
CVE-2019-17391
PUBLISHED: 2019-11-14
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and sec...
CVE-2019-18651
PUBLISHED: 2019-11-14
A cross-site request forgery (CSRF) vulnerability in 3xLogic Infinias Access Control through 6.6.9586.0 allows remote attackers to execute malicious and unauthorized actions (e.g., delete application users) by sending a crafted HTML document to a user that the website trusts. The user needs to have ...
CVE-2019-18978
PUBLISHED: 2019-11-14
An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
CVE-2019-14678
PUBLISHED: 2019-11-14
SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects t...