Here's how to best secure your data now that the NSA can crack almost any encryption

The latest Snowden-supplied bombshell shook the technology world to its core on Thursday: The NSA can crack many of the encryption technologies in place today, using a mixture of backdoors baked into software at the government’s behest, a $250 million per year budget to encourage commercial software vendors to make its security “exploitable,” and sheer computer-cracking technological prowess.

To some extent, it’s not surprising to hear that the U.S. spy agency is doing spy agency stuff but, given the recent surveillance revelations and the fact that other countries likely have similar capabilities, the news is certainly worrying. To make matters worse, it came just a day after Pew reported that 90 percent of Internet users have taken steps to avoid surveillance in some way.

All is not lost, however. While the stunning reports failed to name exactly which companies and encryption technologies have been compromised by the NSA, you can minimize the chances that your encrypted communications will be cracked by the government—or anyone else. Read on.

Now that we know that corporations—or at least individuals in corporations—have worked with the NSA to build backdoors into encryption technology, privacy buffs should give commercial encryption technology (such as Microsoft’s BitLocker) the hairy eye.

NSA headquarters.

You’re better off using tools that employ open-source or public-domain encryption methods, as they need to work with every vendor’s software and, in the case of open-source encryption, can be scrutinized for potential security flaws.

With that in mind, here are some tools worth checking out:

Truecrypt for encrypting sensitive files, folders, and entire drives on your PC.GPG, an open-source implementation of the OpenPGP protocol used to encrypt email communications. Be sure to read up on why standard-compliant email messages can never truly be secure, though.TAILS, a.k.a. The (Amnesic) Incognito Live System, a Linux distribution built with security and anonymity in mind. TAILS comes packed with numerous privacy and encryption tools baked in, including Tor, which allows you to browse the web (mostly) anonymously and access a Darknet of so-called “Hidden Services” that grant anonymity to both web servers and web browsers. Bruce Schneier—a longtime security guru who has actually read the documents detailing the NSA’s encryption-busting methods—recommends using Tor and Hidden Services to thwart NSA surveillance. TAILS is meant to be used as a live CD, which means you can boot it from a disc or USB drive, and your data is wiped when you power off your system.Off-the-record messaging, or OTR, a cryptographic protocol for encrypting and authenticating instant-messaging communications. The protocol uses AES and SHA-1 standards and comes baked into TAILS and is recommended by Schneier even in the wake of the NSA revelations. Here’s a list of IM software that supports OTR.

Proprietary encryption tools created overseas may—may—also be less likely to have installed NSA-friendly backdoors into their software. This morning, I received an email from Boxcryptor, the superb (and Germany-based) cloud-storage encryption tool, reassuring me that there is no way for the company to snoop on its customers, as it encrypts files using private RSA security keys stored only on users’ private PCs, then transmits the already-encrypted files using HTTPs.

Beyond encryption, most of the advice in PCWorld’s How to protect your PC from Prism surveillance still applies. Note, however, that the New York Times report on the NSA’s crypto-cracking abilities suggest that VPN technology and the ever-popular SSL web protocol have been two encryption methods particularly targeted by the government. (Schneier suggests using TLS and IPsec whenever possible on the web-communication front.)

Even so, using the tips in that article will make your browsing much more secure in general, not just the NSA or foreign governments.

Also check out PCWorld’s guide to encrypting (almost) everything, which is chock full of handy-dandy encryption tips, though many rely on proprietary—not open-source—technology. While closed-source solutions may not protect against The Man and his super-encryption-cracking eyes, they’ll help keep everyone else out of your business.

Brad Chacos spends the days jamming to Spotify, digging through desktop PCs and covering everything from BYOD tablets to DIY tesla coils.
More by Brad Chacos

View the original article here

Secure your small-business network without spending a dime

You have a target on your back. In 2012, 31 percent of cyberattacks were aimed at small businesses, and that staggering number is 100 percent attributable to inadequate—or nonexistent—security measures at many of these firms, which might as well be an open invitation to hackers.

Now, we’re not going to hit you with another eat-your-veggies imperative to secure the computers and networks at your business. We understand that it’s all too easy to view security as a discretionary expense.

But what if we told you that there were security controls in the tools you already own that could vastly improve your protection if you just used them? And that you could fill any gaps in protection with free security programs that are every bit as effective as their commercial counterparts?

Below are several ways to fend off cyberthreats. The only investment is your time.

The quickest—and cheapest—way to beef up your defenses is to understand and employ the security measures you already have at your disposal.

Start with the simple things. Make sure that all your user accounts are protected with strong passwords and that only those employees who need administrative privileges have administrator accounts on their PCs.

Windows’ Local Group Policy Editor lets you administrate policies, restrictions, and more for groups of users and computers.

Next, take a look at the Local Group Policy Editor in Windows. This power tool gives you granular control over groups of users and computers, so it makes sense that Microsoft placed the utility where people can’t easily find it. (One way to find it is to type group in the search field in either Windows 7 or Windows 8. ‘Edit Group Policy’ should appear as one of the top few options available.) From the Editor, you can set password and account lockout policy, firewall policy, software restrictions, and more. Spend a couple of hours learning about the Local Group Policy Editor, and wield its power judiciously.

Zero-day attacks make for ominous headlines, but the reality is that known vulnerabilities are a much bigger threat. Most attackers don’t have the skill or the devotion to ferret out new security holes. Once a vendor releases a patch, though, lazy attackers can reverse-engineer it to identify the vulnerability it fixes and figure out how to exploit that flaw.

The longer you go without implementing an applicable patch, the more at risk you are. You should have automatic updates turned on in Windows, as well as in any other applications you use that offer such a function. If you can’t take advantage of this feature, you’ll have to make a serious effort to stay informed about new updates and test and apply them as soon as they’re available.

Once you’ve exhausted all the resources you have on hand, it’s time to explore outside options. Some of the best security tools available are free and can go toe-to-toe with features offered in big-brand security suites. Here are a few to get you started.

Microsoft Security Essentials: Windows 8 includes Windows Defender, but prior versions of the operating system didn’t come with antimalware protection. If you need to protect computers running Windows XP or Windows 7, you can download Microsoft Security Essentials to get comprehensive real-time protection gratis.

Cain and Abel: Using network-packet sniffing, dictionary attacks, and a variety of other methods, Cain and Abel captures and cracks passwords. You can use this handy utility to reveal vulnerabilities, determine whether your policy requirements are secure enough, and recover passwords, which is its primary function.

Cain and Abel can reveal weak passwords that leave you open to security breaches.

Aircrack and Kismet: Want to know how secure your wireless network really is? Try Aircrack or Kismet. Aircrack captures wireless network traffic and attempts to crack your WEP or WPA encryption. Kismet is a wireless-network detector, sniffer, and intrusion detection system. Both tools are free, and both are highly rated by those who use them.

Nikto: If your business has a Web server, you might want to put Nikto to use. An open-source Web-server scanner, Nikto can help you identify weaknesses that may expose your server to exploits. It scans for outdated servers, specific vulnerabilities, and known configuration errors to help you protect your server from attack.

For a complete list of the best security utilities, visit SecTools.org, which maintains a regularly updated list of the top 125 as rated by the user community. The list includes both open-source and commercial software, but you’ll see that many of the most respected tools don’t cost a thing.

If implementing these free options has whetted your appetite, consider investing in some pay software to bolster your complimentary security measures. We recommend the following three open-source tools. All are still available as free versions, but subscriptions are required to unlock their full power.

Nessus is a vulnerability scanner that examines and monitors your network and PCs for more than 50,000 vulnerabilities and potential configuration errors that may expose your systems to compromise. It also includes specific scans to help ensure compliance with regulatory and industry frameworks such as HIPAA (Health Insurance Portability and Accountability Act) or PCI-DSS (Payment Card Industry Data Security Standard).

The Nessus vulnerability scanner is available as a free download, but you need a subscription to unlock all its capabilities.

Metasploit is a penetration-testing platform that lets you test exploits against your network and computer-security defenses and applications, to determine what impact they might have and to identify weaknesses you should address.

Snort is an intrusion detection and prevention platform that monitors network traffic to find and identify suspicious or malicious activity.

Cybercrime is costly, but defending against it doesn’t have to be. Basic protections are built into the operating system and applications you use every day, and if you support them with free and open-source tools, you can protect your PCs and data without so much as bruising your budget. Who says you can’t put a price on peace of mind?

Tony is principal analyst with the Bradley Strategy Group, providing analysis and insight on tech trends. He is a prolific writer on a range of technology topics, has authored a number of books, and is a frequent speaker at industry events.
More by Tony Bradley

View the original article here

Cisco fixes critical remote command execution vulnerability in Secure Access Control Server

Cisco Systems released security patches for Secure Access Control Server (Secure ACS) for Windows to address a critical vulnerability that could allow unauthenticated attackers to remotely execute arbitrary commands and take control of the underlying operating system.

Cisco Secure ACS is an application that allows companies to centrally manage access to network resources for various types of devices and users. According to Cisco's documentation, it enforces access control policies for VPN, wireless and other network users and it authenticates administrators, authorizes commands, and provides an audit trail.

[ InfoWorld's expert contributors show you how to secure your Web browsers in a free PDF guide. Download it today! | Learn how to protect your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]

Cisco Secure ACS supports two network access control protocols: Remote Access Dial In User Service (RADIUS) and Terminal Access Controller Access-Control System Plus (TACACS+).

The newly patched vulnerability is identified as CVE-2013-3466 and affects Cisco Secure ACS for Windows versions 4.0 through 4.2.1.15 when configured as a RADIUS server with Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling (EAP-FAST) authentication.

"The vulnerability is due to improper parsing of user identities used for EAP-FAST authentication," Cisco said Wednesday in a security advisory. "An attacker could exploit this vulnerability by sending crafted EAP-FAST packets to an affected device."

"Successful exploitation of the vulnerability may allow an unauthenticated, remote attacker to execute arbitrary commands and take full control of the underlying operating system that hosts the Cisco Secure ACS application in the context of the System user for Cisco Secure ACS running on Microsoft Windows," the company said.

The vulnerability received the maximum severity score, 10.0, in the Common Vulnerability Scoring System (CVSS), which indicates that it is highly critical. Cisco Secure ACS for Windows version 4.2.1.15.11 was released to address the flaw.

There are no known workarounds, so upgrading to the patched version of the application is recommended.

View the original article here

Feds developing guidelines to help businesses to better secure their IT systems

Following through on an order earlier this year from U.S. President Barack Obama, the National Institute of Standards and Technology (NIST) is rapidly developing a set of guidelines and best practices to help organizations better secure their IT systems.

The agency has released a draft of its preliminary cybersecurity framework and is seeking feedback from industry.

The agency is scheduled to release a full preliminary draft in October, for public review. It will then issue the final 1.0 version of the framework in February 2014 and continue to update the framework thereafter.

When finished, the framework will provide guidance for organizations on how to manage cybersecurity risk, “in a manner similar to financial, safety, and operational risk,” the document states.

In February the White House issued an executive order tasking NIST to develop a cybersecurity framework, one based on existing standards, practices and procedures that have proven to be effective.

In July, NIST issued an outline of the framework and held a workshop in San Diego to fill in some details. This draft incorporates some of that work, and was released to gather more feedback ahead of the next workshop, to be held in Dallas starting on Sept. 11.

“The Framework complements, and does not replace, an organization’s existing business or cybersecurity risk management process and cybersecurity program. Rather, the organization can use its current processes and leverage the framework to identify opportunities to improve an organization’s cybersecurity risk management,” the draft read.

When finished, the framework will consist of three parts. One component, called the core functions, will be a compilation of commonly practiced activities and references. The second component, the implementation tiers, provides guidance on how to manage cybersecurity risks. The third component, the framework profile, provides guidance on how to integrate the core functions within a cybersecurity risk strategy, or plan.

On Twitter, framework ideas are being submitted and discussed with the hashtag #NISTCSF.

Joab Jackson covers enterprise software and general technology breaking news for the IDG News Service.
More by Joab Jackson

View the original article here

Usage for Tor doubles in wake of secure email shutdowns, arrival of the PirateBrowser

The Tor anonymity network is enjoying a massive uptick in popularity after two significant privacy-minded events took place earlier this month

First, there were the sudden shutdowns of Lavabit and Silent Circle, two secure email providers that voluntarily closed their doors on Thursday, August 8, rather than allow the U.S. government access to their users’ messages.

On August 10, mere days after Lavabit and Silent Circle took one for the team, the popular Pirate Bay file-sharing site released its PirateBrowser, a web browser that allows users to hop onto the Tor network in order to circumvent government firewalls to access torrent sites and other banned parts of the Web.

By August 18, the number of users accessing the Tor network started creeping up, and it has only climbed higher and higher (and higher) since. Tor now regularly sees more than twice as many daily users as it did before the email shutdowns and the PirateBrowser’s release.

Tor ProjectTor’s daily users skyrocketed just after Lavabit and Silent Circle shut down.

While the PirateBrowser and standard Tor software both rely on the Tor network, they use it in very different ways.

Once you’ve installed Tor’s software on your PC—most often in the form of the Tor browser bundle—the service allows you to surf the web anonymously by encrypting your Internet connection requests and bouncing them between numerous “relay nodes” before finally sending them on to the final destination.

No node knows the identifiable information of any nodes in the chain aside from the ones they’re taking information from and passing information to and., just to be on the safe side, each hop along the way gets a whole new set of encryption keys.

“The idea is similar to using a twisty, hard-to-follow route in order to throw off somebody who is tailing you—and then periodically erasing your footprints,” explains the Tor website. All the hip-hopping makes for a very secure (yet very slow) browsing experience, assuming you’re smart about your usage habits. It’s also great for bypassing government firewalls.

Tor’s “onion-routing” technology also enables the creation of “hidden services,” or websites that can also hide their server identity from its users and are only accessible while using Tor. This extreme level of anonymity makes the so-called “Onionland” darknet a haven—not only for seedy types, but also for people who want (or need) to stay anonymous, such as political dissidents and whistleblowers—the type of people who may have relied on Lavabit and Silent Circle previously.

[Now read: Meet the Darknet, the hidden, anonymous underbelly of the Web]

The PirateBrowser behaves a bit differently, however. From its website:

No, it’s not intended to be a TOR Browser, while it uses the Tor network, which is designed for anonymous surfing, this browser is ONLY intended to circumvent censorship. The Tor network is used [in the PirateBrowser] to help route around the censoring/blocking of websites your government doesn’t want you to know about.

To drive home the point that the PirateBrowser isn’t designed for anonymity, it doesn’t include the encryption-providing “HTTPS Everywhere” plugin found in the Tor Bundle.

Additionally, the PirateBrowser only accesses Tor when you’re using the browser to try to access a blocked website. Non-blocked websites are delivered to your browser normally, rather than hopping all around.

While the drastic uptick in usage is probably mostly attributable to the PirateBrowser—the Pirate Bay’s custom browser was downloaded more than 100,000 times in a matter of days—the Lavabit and Silent Circle shutdowns likely also drove privacy-minded people further underground.

Tor itself isn’t an email provider, though—it’s just anonymizing routing technology, pure and simple. What’s more, the most popular Hidden Service email provider in Onionland, Tormail, was recently killed by the U.S. government. It was collateral damage in the takedown of a service provider hosting many of the Web’s child pornography sites.

That’s not to say Tor can’t be used to send secure messages online, however.

Signing in to a webmail account while using Tor will obviously give your identity away, but using Tor in conjunction with dummy email accounts and PGP encryption would deliver a relatively strong level of privacy. Privacy buffs can also take advantage of Onionland’s messaging services, which deliver a very high level of anonymity.

No matter what accounts for Tor’s dramatic spike in popularity, one thing’s for certain: More people than ever are turning to technology to spite Big Brother.

Via Reddit

Brad Chacos spends the days jamming to Spotify, digging through desktop PCs and covering everything from BYOD tablets to DIY tesla coils.
More by Brad Chacos

View the original article here

NSA-dodging mail service explains why email can never truly be private and secure

Earlier this month, Lavabit and Silent Circle—two privacy-minded email providers—decided to shut up shop rather than give the U.S. government the chance to access to their customer data. Shortly thereafter, Lavabit owner Ladar Levison told Forbes, "If you knew what I knew about email, you might not use it."

This weekend, Silent Circle's Louis Kowolowski dropped the cryptic comments and explained a major, inherent vulnerability with email: metadata.

While encryption technologies like PGP and SMIME can be used to obscure the actual contents of a message, assuming you use a desktop program that supports encryption software, current email protocols don't allow you to secure the "header" metadata details that are used to shuffle email from point to point. The sender, recipient, subject, date and time, and even server path information is all sent along in clear text.

That's enough to be a liability to people who truly need privacy, according to Kowolowski.

If your goal is to not have metadata leakage in your otherwise secure communications, you may wish to avoid email altogether. Email leaks the information about who is communicating, and how often. This information may be just as damaging as the content of the email.

Snowden's leaks have shown that the U.S. government is aware of the power of metadata. The NSA collects Verizon's phone records to examine metadata and analyze call patterns, and the government does not need individual warrants to do so, as courts have classified metadata as "transactional data" rather than actual communications. Again, here's Kowolowski:

With the tapping of backbone internet providers, interested parties can now see all traffic on the internet. The days where it was possible for two people to have a truly private conversation over email, if they ever existed, are long over.

Since text, video, and messaging communications don't suffer from the same header needs as email, they're able to be secured from end-to-end, with all encryption and decryption handled on the client machines—and indeed, Silent Circle still offers "Silent Phone," "Silent Eyes," and "Silent Text" services that do just that. Check out our guiding to protecting your PC from Prism surveillance for more privacy-minded tips and tricks, or if metadata security means less than the message itself, read PCWorld's guide to securing your email.

Brad Chacos spends the days jamming to Spotify, digging through desktop PCs and covering everything from BYOD tablets to DIY tesla coils.
More by Brad Chacos

View the original article here