Author Archive

Ransomware

By |

What happen if the data encryption is used by fraud, its result in ransomware malware. Ransomware malware will encrypt the data and if you need to decrypt you need to pay for private key else your private key for decryption will be deleted and you will lose your data permanently.

It’s raising peak now a days and most of the companies are subjected to ransomware, it’s also called as cryptovirus, cryptotrojan and cryptowarm.

 

How its spreading ? mostly through E-mail attachments, Infected program, and compromised network.

Preventive Measure is through strong firewall setting, using Sandbox environment, having regular backup of all data, if ransomware malware infected wiping the data is best option and restore the data from back-up.

 

Read more »

Microsoft – WhatsApp Channel

By |

Microsoft announced WhatsApp channel for its new broadcast, It has  released WhatsApp Number +971-50-359-2257  for subscribing. More interesting factor is does not sent more than 3-message per day. Regarding security concern, Microsoft guaranteed it will not share the privacy to others .

Source : From Microsoft

 

Read more »

Cloud Computing

By |



Its an extension and evaluation for virtualization concept,  Cloud Computing is a popular term referring where data  storage and process are performed in an unknown place,accessing cloud network can be done through Internet, Its alternative for having our traditional IT infrastructure in our local lan environment to an unknown place, thus reducing the cost of our data center infrastructure and its maintenance.

As it have some flaws also, as the datas are stored in unknown environment security is the main concern, we should have a strong SLA(service level agreement) for down time and data security.secondly we should have a strong internet bandwidth consumption also.

Some of the service of cloud computing are :

  • Platform-as-a-Service : it’s a concept of providing a computing platform and solution for software in the virtual cloud environment

 

  • Software-as-a-Service : it’s a concept of providing a software as service google drive, Microsoft office 365 all fall on this categories, Microsoft already replaced its exchange server concept with 365 as the corporate email service will be done through 365(as software as a service).
  • Infrastructure-as-a-service: it’s a concept of providing or outsourcing full infrastructure to the cloud environment. Famous amazon AWS, Microsoft azure, google compute engine are all the famous service providers of Infrastructure-as-a-service and most of the corporate are moving to IaaS service environment

Read more »

BYOD(Bring Your Own Devices)

By |

Bring Your Own Devices is a new service, which is an increasing trend hitting in Business, the concept is employee can bring their own devices to the Business entity. As the emergence of smartphone system has made the corporate to accept user can use their own devices in business Environment.
Smartphone is the best example for BYOD devices, other than BYOD, BYOC (Bring your Own Computer), BYOL (Bring your own Laptop) are some of the similar services are also emergence with BYOD.
Security risk for BYOD is very high, as users are allowing to accesses corporate network result in security attack and breaches. High restricting security policy will minimize the risk in corporate network.
·         A well training to the users about the value of the data to provide for the BYOD users, such Business Impact if their devices is not full secured.
·         Policy should be made for data ownership even though their devices having personal data, having ownership like remote wiping to factory default setting of the stolen devices which is under BYOD policy.
·         Patch management, for those BYOD devices updating of Patch file should be done only by the management approach only, like the administrator have check the positive and negative site of the batch and recommend for new update.
·           If the devices are under violation or illegal activates, it should be clearly mentioned to the users about legal investigation of the devices.
·          Antivirus management also maintained through the policy, BYOD devices users should install recommended antivirus software in order to have a secure environment.
·         There should be clear concern about camera and video, as some company will not allow the users to take pictures and videos of their environment this should be clearly mentioned.
·         Finally, the users should accept the policy required by the office, else should not allow the BYOD devices to the offices.

Read more »

Cryptography – Asymmetric Encryption

By |


we already discussed about symmetric encryption in last post, now lets look deep into asymmetric algorithm its worked based on public and private key, where is in symmetric encryption is based only on pre-shared(private keys) only .

How its works? each party will have a unique public key and private key . If A want to communicate with B, it have to encrypt his plain text with B’s public key, once its encrypted,  it can be decrypt only by B’s private key , even A cannot decrypt .

Main advantages of using Asymmetric Algorithm

  •  Key distribution is a simple process
  • Changing key is not required even ,unless private key of the receiving party is compromised.
  • communicating party can leave easily as there is no common pres-hared key .

and disadvantage is ,processing time  is relatively slow comparing to Symmetric Encryption algorithm.

Hash Function,

its a summary of the message content, and its a concept, is used to map arbitrary size of data to the fixed size,and the value got by the hash function called as hash value.

MD2,MD5, SHA are algorithms for hash function.

Read more »

Cryptography – Modern Encryption

By |



Modern Encryption have a common protocol all over the world, only key will kept in secret, modern cryptography divided into three categories.

  • symmetric
  • Asymmetric
  • Hash

SYMMETRIC ENCRYPTION

it uses the same key for encryption and decryption, the key which is used for sharing between two parties commonly know as secret-key or pre-shared key, Main advantages of symmetric encryption its comparatively fast as both end knows same key and key-word should be more complicated if we want to have a secure encryption, Main disadvantages are as key is the only keynote for symmetric encryption transfer of key should be kept highly confidential. below are algorithm support on symmetric encryption

DES – Data Encryption Standard, its also known as data encryption algorithm, it was designed by IBM in 1976 its operating by 5 modes

  • Electric Code Book (ECB)
  • Cipher Block Chaining (CBC)
  • Cipher Feedback (CFB)
  • Output Feedback (OFB)
  • Counter Mode (CTR)

since the growth of advance technology and invention of high processer leads to DES as not secure one, it had a brute force attack , because of this issue had leads to the development of 3des

3DES – its also knows triple data encryption algorithm or TDES, it will encrypt the packet three time than DES algorithm, it was accepted by USA in 1999.

IDEA – International Data Encryption Algorithm, its also a symmetric Encryption algorithm and current one which approved and used in most the devices are AES

AES – Advanced Encryption Standard Algorithm ,its support 256 key bits ,still now this algorithm is never hacked, AES was designed to   replace DES ,3DES and IDEAS type algorithm.

AES was approved by NIST in 1997 as the replacement for DES algorithm, is more secure than DES/3DES and its fast and efficient in both hardware and software

other type of symmetric algorithms are bluefish and two fish

Stay with us for more post on encryption technology…

 

 

 

Read more »

Cryptography – Classical Crypotography

By |

welcome back friends, we are discussing the concept of cryptography and its continuation and we are looking on history of cryptography. Classical cryptography is used before computer era.

caser cipher or rotation cipher

its used during the period of Julius caser. they used to rotate the character in order to confuse the enemies during communication and the receivers should know the same key to decrypt it back .

Lets takes an example of rotate by 3 ,  a become d, b become e . “hai”  the character will become “kdm” after rotation . receivers should know how to rotate it back.

 

 

Cipher disk

Cipher disk normally has two concentric disks, each with an alphabet with the periphery, two parties has to agreed with the common character set, for example “s will set d” and the character will be encrypted ,below picture show the cipher disk with we can adjust the character with inner circle “a will set to c” the character will be rotated same like caser cipher.

lot other cryptographic devices are used, during the second world war period also for secure communication. some of the devices used are mentioned below .

  • Enigma – used by Germany
  • Sigaba –  used by united states
  • Purble –  used by Japanese . after  the second world war , common laws are made for having a common encryption and concept also changed in history of encryption.

In the next post we will see the cryptography concept in Computer era.

 

 

Read more »

Cryptography

By |




Data security is not full-filled without knowing cryptography concept, even if u can see in social networking software like whats app,viber you can see end to end encryption are all falls in cryptography only.

Now let us look what is cryptography, its a secret writing. Its a type of secure communication whose meaning is kept secret, crypto-analysis is the process of breaking secure communication and reading the secret message.

Below are the some of the definition,which we are going  to use in cryptographic technique. Plain text  is the term refer to readable message before applying cryptographic algorithm. chipper is the encrypted message after applying Cryptographic algorithm.

Encryption steps in cryptography :

  • Plain text –> Encryption Key–> chipper text

Decryption Steps in cryptography :

  • Chipper text –> Decryption key  –> Plain text

A good encryption will contain a strong cryptographic, which cannot be easily break it, crypto graphic concept is not a new technology, its has be rooted back to old ages its concept is used during medieval  period also. but the technology and algorithm is changed over period of time

It has been differentiated into two categories

  • Classical Cryptography
  •  Computer era cryptography

We will look on deep into above two cryptography on upcoming posts

 

Read more »

Data Secure Communication

By |



In our last two threads I mentioned how data are secured in Production Environment and in data stored state.

What about the data’s while in transaction state, like office in one country and regional office in another country and how the data’s are transferred securely?

Think about voice/video communication all communication is made through IP packets only. Do you think its secured and it cannot have hacked by others?

We need all the data should be secured in either form of communication through data, voice or video mode.

Even accessing remote devices through command prompt or remote desktop are replaced by SSH access.

In corporate network, most secured form of transaction is done through Encrypted VPN connection either client access the network i.e. users is accessing from his own laptop. Or for site to site access.

Organizations often enable remote access solutions such as virtual private networks(VPNs). VPNs allow employees to access the organization’s internal network from them home or while traveling. VPN traffic goes over a public network, such as the Internet, so encryption is important. VPNs use encryption protocols such as TLS and Internet Protocol security (IPsec).

What is VPN?  VPN stands for Virtual private network, connecting to private through a secured tunnel in public Environment (through worldwide internet), which is an unsecured. we need to understand what is tunnel for complete understanding of VPN connectivity.

What is tunneling? it’s a network communication process, it protects the content of the packet by encapsulating with another protocol. Encapsulation and encapsulation will be done by both the end, by using a VPN device. Normally this services will come along with all the firewall devices.

Common VPN protocols are PPTP, L2F, IPSEC VPN technology.

In SSH mode of communication all the data will be encapsulated, old form of remote accessing like telnet has a serious of security issue, which result in accessing Encrypted session like SSH. Putty is the software commonly used for accessing remotely.

Read more »

Data Storage

By |



 

In my previous thread we discussed about , labelling of data’s and privileges to accessing of data in secured way.

Let us look on how the data’s are secured in the stored environment, below are the storage places where data’s are stored .

  • Hard-disk
  • External Hard-disk
  • USB Flash drive
  • CD-Drive
  • Memory Card etc.
  • Tape drive

CD-Drive/Floppy disk now a days most of the peoples are stopped using this as data’s are moving in terabyte sizes now a days, so let us ignore this devices .

Devices like hard, flash drive can be protected by password mechanism, privilege level access to the storage devices are also provided ,like the Administrator can only able to access all area in the hard drive. End users was restricted to access it .

In USB type storage ,users are restricted with passwords . so high security devices can be accessed only through the required credentials.

A common and recommended form of  protecting mechanism is through Encrypting the devices, You can see the encryption software in external hard drive by default , the data will get encrypted with the encryption only it will be decrypted  with the same key .we will see deeper into encryption and decryption on my future threats.

How about the recovering of erased data ? yes it can be recovered using a recovering software and lot other technologies .

Data should be permanently deleted as the data should not disclosed to anyone. Below are the some common form of deleting data’s

  • Erasing
  • Clearing
  • Purging
  • Declassification
  • Sanitization
  • Degaussing
  • Destruction

 

Read more »

Skip to toolbar