Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/19/2012
02:28 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Silent Circle's Military-Grade Encryption: BYOD Tool?

Silent Circle's encryption tools for smartphones and tablets are a boon for privacy enthusiasts--but enterprises could find them useful too.

Silent Circle's suite of apps for smartphones and tablets is designed to make calls, text messages, video chats, and, in coming months, emails virtually invulnerable to surveillance efforts.

It's no surprise the company sensed a market for this sort of service. As technology and terrorist threats have evolved over the last decade, lines between national security efforts, invasive data mining, civil liberties, and Big Brother-like policies have become increasingly difficult to discern. A few recent examples: Carrier IQ debate, the FBI's attempts to gain backdoor access to various electronic communication and social media platforms, ramped-up domestic surveillance initiatives at both the federal and local levels, contentious court rulings around businesses that spy on customers, and an explosion of data-pilfering malware. Privacy concerns have ballooned beyond the ranks of conspiracy theorists to include an increasing number of ordinary citizens.

But what about businesses? As much as average users have reason to proactively protect their privacy, enterprises--thanks in large part to the BYOD phenomenon--arguably need to be even more diligent. Many businesses are already invested in a slew of precautions, including next-gen firewalls, mobile application management tools, and more. Does Silent Circle bring something new to businesses that have already deployed such measures?

Absolutely, according to co-founder Mike Janke, a former Navy SEAL and--along with email encryption pioneer Phil Zimmermann--one of the company's co-founders.

"It's great that people want to use VPN," he said during a phone interview, "but there are nation states and criminal groups breaking them open like coconuts." These ubiquitous encryption tools usually connect to a server where security keys are stored, he explained, making them less than fully secure.

[ Were key details omitted from the FTC's privacy audit of Google? Read more at Google Privacy Audit Leaves Lingering Questions. ]

Infiltrating such enterprise-grade perimeters demands a certain level of sophistication, of course. But elaborate viruses, many ostensibly designed to breach complex targets such as industrial control systems, are already roaming the Internet. Free access to this malware not only demonstrates that high-level sophistication is already being applied but it also allows less skilled hackers to piggyback on these more accomplished efforts.

The issue of government-sponsored espionage, meanwhile, has been a hot topic, with recent headlines focusing on Iran and China. The United States, as Stuxnet revealed, also has an active stake in cyber-warfare's evolution. While these developments can lead to overstated rhetoric, risks remain: data loss can be incredibly damaging, and as strong as some security measures are, they have to contend with talented but unscrupulous people working against them.

Silent Circle isn't a panacea against all of those threats, of course, but it does offer an alternative to the security key dilemma. The products' encryption is peer-to-peer, meaning that it is uniquely generated every time a data transfer is initiated and also deleted, either immediately or after a user-defined period, afterward. Silent Circle doesn't store a key that can be used to decrypt data. The result is information that's not only much more difficult to intercept but also more challenging to use if an attacker actually gets his or her hands on it.

What's more, the interface generally preserves the native app experience, making it user-friendly. As some frustrated IT managers will no doubt agree, security protocols are sometimes subverted by employees who either don't understand all the measures they need to observe or opt for workarounds because they think the policies get in the way of productivity. Janke remarked that Silent Circle deliberately avoided anything "too geeky" in order to make the experience "just like what [users] are used to."

Currently, Silent Circle's products work on iOS devices (except for first- and second-generation versions of the iPhone and iPod Touch). Support for additional operating systems, starting with Android, will come online in the coming months.

The company's encryption tools offer potentially powerful capabilities for those who need to secure sensitive data. However, broader MDM and MAM capabilities currently aren't included, which means that Silent Circle could be a component in an enterprise's security policy but not a complete solution. Given the products' focus on privacy, it's not likely that this larger set of capabilities is in the cards, but Janke said there are plans for additional features that will appeal to enterprises. He mentioned that real-time collaboration tools and encrypted data storage, for example, should join the suite in 2013.

Time to patch your security policy to address people bringing their own mobile devices to work. Also in the new Holes In BYOD issue of Dark Reading: Metasploit creator HD Moore has five practical security tips for business travelers. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.