September 2023 Summaries

This intriguing exploration of Differential Cryptanalysis (DC) highlights its pivotal role in the evolution of encryption standards, particularly in relation to the Data Encryption Standard (DES) and the Advanced Encryption Standard (AES). Initially developed in secret by the NSA and later publicized by Adi Shamir, DC involves analyzing the differences between pairs of plaintexts and their corresponding ciphertexts to uncover vulnerabilities in cryptographic algorithms. The text delves into the historical context of DES's development, revealing how the NSA influenced the design of its Substitution Boxes (S-Boxes) to mitigate DC risks, though it was later criticized by the academic community for potential backdoors. Despite DES's vulnerabilities to DC, AES emerged as a robust successor, employing a more secure S-Box based on Kaisa Nyberg's concept of low n-uniformity, which resists DC more effectively. The discussion underscores the delicate balance between practical and theoretical considerations in cryptographic design, emphasizing the continued relevance of DC in shaping secure encryption methods.

Encryption at rest is often marketed as a top-tier security feature, yet it primarily protects against the infrequent threat of physical hard drive theft rather than more common cyberattacks like phishing. This piece critiques the overreliance on encryption at rest in security marketing, arguing that while it's a necessary measure, it shouldn't overshadow more critical security practices like encryption in transit, encryption by proxy, and protection against phishing. The article emphasizes the need for more comprehensive security strategies, such as mandating multi-factor authentication, encrypting data before it reaches databases, regular encryption key rotation, and implementing just-in-time access controls. While encryption at rest is not inherently negative, its portrayal as a "military-grade" security solution can mislead buyers into overestimating its effectiveness against modern cyber threats. The article calls for a shift in security marketing to focus on more robust and proactive measures that better protect against today's prevalent attack vectors.

In a podcast episode of Decrypt, Liz engages in a conversation with Damir Mehic, Director of Engineering at heyData, a Berlin-based company focused on simplifying compliance, particularly for small and medium-sized businesses. Damir, whose career spans various roles in SaaS applications, e-commerce, telecom solutions, and legal tech automation, discusses the fulfillment he derives from helping clients, especially with GDPR compliance. He emphasizes the importance of educating engineers on data privacy and how identifying private data can prevent issues from the start. Damir reflects on the challenges and satisfaction of solving complex engineering problems, such as deploying distributed systems with zero downtime, and shares insights on the evolving role of AI in compliance, predicting the emergence of AI compliance assistants and self-healing systems. He advocates for curiosity and consistent learning through side projects and resources like Educative and the book "Clean Code." Damir underscores the increasing significance of data privacy, urging engineers to educate themselves on the topic as it becomes crucial in the age of AI.

In this installment of a threat model series, the focus is on external attacker threats to internet-facing applications, particularly those handling sensitive health and credit card information, using insights from the Mitre Att&ck framework. The application in question operates on a three-layer architecture hosted in a public cloud across data centers in the US and EU. The primary motivations for attackers targeting Software as a Service (SaaS) platforms include monetization through ransomware, extortion, and data exfiltration, often exploiting vulnerabilities in internet-facing components and cloud misconfigurations. The level of sophistication required for these attacks is relatively modest due to widely available tools like Evilginx, making even Multi-Factor Authentication-enabled targets vulnerable. Key threats include data theft, service disruption, and extortion, with vulnerabilities such as weak authentication mechanisms and insecure configurations. Common attack vectors include phishing for administrative credentials, leading to data access and exfiltration. Mitigations focus on preventing lateral movement and identifying anomalous behavior, with encryption being pivotal in minimizing breach impact. Foundational controls for cloud-based infrastructures include robust authentication with hardware-based MFA, web and mail filtering, patching, robust backups, and incident response planning, all of which can be enabled by most Cloud Service Providers. The effectiveness of encryption is contingent on implementation, with field-level encryption being crucial to protecting against network-based attacks. The series will continue to explore threats posed by malicious administrators.

Evervault has introduced several updates and new features, including the Card Reveal feature, revamped solutions pages, and enhancements to their Cages. The Card Reveal allows businesses to display plaintext cardholder data without expanding their PCI compliance scope, utilizing a secure iframe hosted by Evervault. Their end-to-end PCI Compliance solution has been improved to include new product features, enabling faster compliance through consultations, technical integrations, and auditor introductions. Additionally, their PII Encryption solution now offers enhanced capabilities for securing customer data across various environments, ensuring compliance with privacy regulations. Updates to Cages include the use of publicly trusted TLS certificates and a new trusted_headers option, providing clearer transaction logs and better observability. Evervault also emphasizes the importance of threat modeling in identifying system vulnerabilities and devising mitigation strategies, advocating for a proactive security approach from project inception.

In a podcast episode, Liz interviews Paul Conroy, the Chief Technology Officer of Square1, a leading digital transformation company based in Dublin. Paul shares his career journey, starting with a passion for computing as a child and leading to roles such as managing the UK's busiest cinema and becoming a product development leader in Ireland. He discusses the challenges of transitioning from a developer to a leadership role, the importance of empathy in customer interactions, and how AI tools can aid developers. Paul emphasizes the need to understand the core problems behind customer feedback rather than just implementing requests, and he highlights the significance of security in handling sensitive data, noting the benefits of using trusted third-party services like Stripe to manage security challenges. Throughout the conversation, Paul reflects on the balance between maintaining technical skills and managing a growing team, sharing insights into his experiences and the evolving landscape of software development.