|By Zafar Khan||
|June 29, 2013 07:00 AM EDT||
There has been quite a buzz around the power of the alleged NSA eavesdropping considering the insights that the NSA Whistleblower, Edward Snowden, presented to the American public.
The NSA Whistleblower exposed how our digital identities are being captured, stored, analyzed, and categorized, allegedly by NSA, as well as companies that publicly state that they store and analyze your data (Facebook, Linkedin, Google email, etc.). The power of the NSA system, according to Snowden, is that they aggregate your digital communications across telephone, internet, web, mobile app, and email data.
With regards to email, email encryption works, to keep your email message content private. As The Guardian reported on Monday, June 17, the NSA Whistleblower said:
"Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on."
But, encryption is a broad term. Not all email encryption and methods of use are the same, in terms of privacy. Not all are "strong crypto systems".
What type of "encryption" works, for whom, what, and when?
"Caesar Cipher" and "Pig Latin" are Forms of Encryption
Suppose Alice wants to send a secret message to her friend Bob but worries that her snoopy Big Brother may intercept it. Alice needs a way to scramble her message so that only Bob can read it. A simple way to do this would be for Alice to replace each letter in her message with the next highest letter; shifting it by one (think "Caesar Cipher" or "Pig Latin").
But, of course, that is too simple. If Big Brother intercepts the message he'll be able to easily decipher it by looking for hidden patterns in the letters it contains. All it will take to crack the code is a little mathematics and a little trial and error.
And, of course, if Big Brother uses a computer he'll be able to crack the code even faster. So just shifting the first letter to the end and adding "ay" as a suffix (turning "HELLO" into "ELLOHAY" for example) isn't a very strong cipher. What can Alice do?
Well, she can try to think up a more complicated mathematical formula to scramble the letters and numbers. And maybe she could use a computer herself to apply the formula. This will help, but the problem is still that if Big Brother hires clever mathematicians, or if he just has a big enough computer, he will be able to crack the code eventually. So it looks like it's going to be an arms race with Big Brother to see who can come up with the biggest computers and the most complicated formula. But because Big Brother is big, it is a race Alice and Bob are bound to lose.
What is Considered "Strong Crypto"?
Then, what did the NSA Whistleblower mean by "strong crypto systems" when he said, according to The Guardian, "Properly implemented strong crypto systems are one of the few things that you can rely on."
We have established that more complex patterns used to encrypt are harder to read by Big Brother but capable of being read if Big Brother has a powerful computer to figure out the pattern; yet easy for Bob to read with knowledge of the pattern (the decryption key). Most technicians understand that more complex algorithms are harder to "crack", or said another way, take more computing power to crack.
How does Computing Power Impact the Time to Crack the Encryption?
Let's consider the example of using computing power to try to guess a 10 digit seemingly random alpha numeric password, such as: tjo9i0982d using a "Brute Force" attack (i.e. trial and error). This would be similar to trying to find a pattern in a universe of combinations of 36 digits (26 possible letters and 10 possible numbers). According to Gibson Research Corporation, in this example, there are 3700 trillion combinations, and the time to guess and test the right combination using trial and error in an online environment is one thousand centuries (assuming one thousand guesses per second). However, in what Gibson Research calls a "Massive Cracking Array Scenario" with one hundred trillion guesses per second offline, this password can be guessed in just 38 seconds.
Computing power does matter. But, not many, if any (today), can implement a "Massive Cracking Array Scenario".
Is Today's Commercial Encryption Readable by the NSA with its Computing Power?
This is a question that clearly some people know the answer to. I do not. Most commercial encryption uses algorithms that the NSA has "approved" for "civilian, unclassified, non-national security systems". These algorithms are what encrypt your email or financial transactions when using email encryption or secure HTTP web based connections with commercially available systems. Some of these NSA approved (unclassified) algorithms include DES, Triple DES, AES, DSA and SHA.
Note: it is not only use of encryption that is important, but as Snowden added, "properly implemented strong crypto systems". Those who encrypt email should be sure to use "properly implemented strong crypto systems".
So, let's explore this notion of "properly implemented strong crypto systems".
Security by Obscurity
Bringing this back to Bob and Alice, or you and me, would our use of commercial (NSA approved for unclassified use) encryption be strong enough for our general commercial purposes? I suppose you could consider it so, as long as those who you think may be trying to read your information do not have the computing power, financial resources, and incentive to try to crack the method of encryption you use in your correspondence. To get a sense of the scale in terms of NSA computing power, NPR reported that the NSA is putting the finishing touches on its biggest data farm yet, a $1.2 billion complex in Utah with 1.5 million square feet of top secret space including high-performance NSA computers alone filling up 100,000 square feet.
So, unless (or until, since the NSA Whistleblower says your messages are saved just in case they later need to be read) you elevate yourself the importance of your electronic correspondence to the level that makes your information interesting to the people with this power, your commercially encrypted email should remain private enough...
But if private enough is not good enough, if you are encrypting FOR personal privacy, you should use "properly implemented strong crypto systems" that also consider endpoint security.
As The Guardian reported, the NSA Whistleblower added, "Encryption works... Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it." What does Snowden mean by this? A properly implemented strong crypto system should take into account the endpoints, as well as the transmission.
Google Has an Easier Way to Read Your Email
So, for example, if you take great care to type your email in a Gmail compose page, encrypt the transmission, and then send, you are forgetting that Google may be recording, storing, analyzing, and cross referencing the content of the message you type before you encrypt it (as well as perhaps other personal information on your computer or mobile device).
So, for those encrypting for privacy, endpoint security should be evaluated. Note, you can somewhat control your endpoint security by choices you make, but what about the encrypted email recipient's endpoint security?
What to Do to Keep Your Email Private
So, where does this leave us in the new light of the NSA Whistleblower (and Google privacy disclosures)?
The endpoint security is the most likely source of data exposure; meaning, it may be far less computer intensive to access the metadata stored on your computer hard drive every time you type, or access the messages stored in your mailbox on your desktop, mobile device, email server, or internet mail service provider host before encryption when composing, or after decryption, after reading.
If you use commercial encryption for email, you should consider strong crypto systems that take into account providing endpoint security, in particular at the recipient's end, which is out of your control.
There are generally three types of systems to commercially encrypt email today.
1. Public Key Exchange - Secure but Complex for Many. Exchanging public encryption keys among your contacts (PKI Digital Certificates) and using Microsoft Outlook on your desktop computer is a "strong crypto system", but has proven to be too cumbersome for most to purchase and install these certificates, manage the expiration, ensure your recipients have a copy of your public key and you theirs, and all are using a compatible email program such as Microsoft Outlook desktop software.
2. Secure Store and Forward - "Man in the Middle" Problems. Systems that store your message content in the middle, and send a link to the recipients to download the content, are often used, but are not considered "strong crypto systems", as your most sensitive information is now stored on a third party server with unknown data security and message purge practices (which may differ from their stated policies). Further, there is no protection from unknown recipient endpoint security or lack thereof. Note, systems that wrap your email in an encrypted HTML file and send, often purport themselves to be "direct delivery" but leave out the important point that the process of decrypting, is often sending the data back to the server in the middle, and that server storing the decrypted message and displaying it in a web browser (with the same Man in the Middle storage purge concerns). Further, there is no protection from unknown recipient endpoint security or lack thereof. This is better than simple Secure Store and Forward but still has Man in the Middle issues, and for these reasons, these are also not considered "strong crypto systems".
3. True Direct Delivery - Best Method. Systems that wrap the message in an encrypted PDF file are "strong crypto systems" as (a) the message content is not stored in the middle, (b) content is truly delivered to the recipients' desktops encrypted, AND (c) the content remains encrypted at the recipient endpoint to prevent potential disclosure regardless of the recipient endpoint security. Systems that make this method easy to use and implement for both sender and recipient become the true best method "strong crypto systems" for email encryption (for both compliance and personal privacy).
In his general session at 18th Cloud Expo, Lee Atchison, Principal Cloud Architect and Advocate at New Relic, discussed cloud as a ‘better data center’ and how it adds new capacity (faster) and improves application availability (redundancy). The cloud is a ‘Dynamic Tool for Dynamic Apps’ and resource allocation is an integral part of your application architecture, so use only the resources you need and allocate /de-allocate resources on the fly.
Sep. 27, 2016 09:30 AM EDT Reads: 2,645
Creating replica copies to tolerate a certain number of failures is easy, but very expensive at cloud-scale. Conventional RAID has lower overhead, but it is limited in the number of failures it can tolerate. And the management is like herding cats (overseeing capacity, rebuilds, migrations, and degraded performance). Download Slide Deck: ▸ Here In his general session at 18th Cloud Expo, Scott Cleland, Senior Director of Product Marketing for the HGST Cloud Infrastructure Business Unit, discusse...
Sep. 27, 2016 09:15 AM EDT Reads: 2,290
Much of the value of DevOps comes from a (renewed) focus on measurement, sharing, and continuous feedback loops. In increasingly complex DevOps workflows and environments, and especially in larger, regulated, or more crystallized organizations, these core concepts become even more critical. In his session at @DevOpsSummit at 18th Cloud Expo, Andi Mann, Chief Technology Advocate at Splunk, showed how, by focusing on 'metrics that matter,' you can provide objective, transparent, and meaningful f...
Sep. 27, 2016 09:00 AM EDT Reads: 2,653
SYS-CON Events announced today that Interface Masters Technologies, a leader in Network Visibility and Uptime Solutions, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Interface Masters Technologies is a leading vendor in the network monitoring and high speed networking markets. Based in the heart of Silicon Valley, Interface Masters' expertise lies in Gigabit, 10 Gigabit and 40 Gigabit Eth...
Sep. 27, 2016 08:45 AM EDT Reads: 2,568
Vidyo, Inc., has joined the Alliance for Open Media. The Alliance for Open Media is a non-profit organization working to define and develop media technologies that address the need for an open standard for video compression and delivery over the web. As a member of the Alliance, Vidyo will collaborate with industry leaders in pursuit of an open and royalty-free AOMedia Video codec, AV1. Vidyo’s contributions to the organization will bring to bear its long history of expertise in codec technolo...
Sep. 27, 2016 08:30 AM EDT Reads: 2,636
There is little doubt that Big Data solutions will have an increasing role in the Enterprise IT mainstream over time. Big Data at Cloud Expo - to be held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA - has announced its Call for Papers is open. Cloud computing is being adopted in one form or another by 94% of enterprises today. Tens of billions of new devices are being connected to The Internet of Things. And Big Data is driving this bus. An exponential increase is...
Sep. 27, 2016 08:15 AM EDT Reads: 2,625
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
Sep. 27, 2016 08:00 AM EDT Reads: 3,691
SYS-CON Events announced today that Tintri Inc., a leading producer of VM-aware storage (VAS) for virtualization and cloud environments, will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Tintri VM-aware storage is the simplest for virtualized applications and cloud. Organizations including GE, Toyota, United Healthcare, NASA and 6 of the Fortune 15 have said “No to LUNs.” With Tintri they mana...
Sep. 27, 2016 08:00 AM EDT Reads: 2,782
An IoT product’s log files speak volumes about what’s happening with your products in the field, pinpointing current and potential issues, and enabling you to predict failures and save millions of dollars in inventory. But until recently, no one knew how to listen. In his session at @ThingsExpo, Dan Gettens, Chief Research Officer at OnProcess, will discuss recent research by Massachusetts Institute of Technology and OnProcess Technology, where MIT created a new, breakthrough analytics model f...
Sep. 27, 2016 08:00 AM EDT Reads: 1,991
In his session at @DevOpsSummit at 19th Cloud Expo, Robert Doyle, lead architect at eCube Systems, will examine the issues and need for an agile infrastructure and show the advantages of capturing developer knowledge in an exportable file for migration into production. He will introduce the use of NXTmonitor, a next-generation DevOps tool that captures application environments, dependencies and start/stop procedures in a portable configuration file with an easy-to-use GUI. In addition to captu...
Sep. 27, 2016 08:00 AM EDT Reads: 1,092
More and more companies are looking to microservices as an architectural pattern for breaking apart applications into more manageable pieces so that agile teams can deliver new features quicker and more effectively. What this pattern has done more than anything to date is spark organizational transformations, setting the foundation for future application development. In practice, however, there are a number of considerations to make that go beyond simply “build, ship, and run,” which changes ho...
Sep. 27, 2016 08:00 AM EDT Reads: 2,508
"We have several customers now running private clouds. They're not as large as they should be but it's getting there. The adoption challenge has been pretty simple. Look at the world today of virtualization vs cloud," stated Nara Rajagopalan, CEO of Accelerite, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Sep. 27, 2016 08:00 AM EDT Reads: 2,224
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform and how we integrate our thinking to solve complicated problems. In his session at 19th Cloud Expo, Craig Sproule, CEO of Metavine, will demonstrate how to move beyond today's coding paradigm ...
Sep. 27, 2016 07:45 AM EDT Reads: 3,286
Ask someone to architect an Internet of Things (IoT) solution and you are guaranteed to see a reference to the cloud. This would lead you to believe that IoT requires the cloud to exist. However, there are many IoT use cases where the cloud is not feasible or desirable. In his session at @ThingsExpo, Dave McCarthy, Director of Products at Bsquare Corporation, will discuss the strategies that exist to extend intelligence directly to IoT devices and sensors, freeing them from the constraints of ...
Sep. 27, 2016 07:45 AM EDT Reads: 2,498
From wearable activity trackers to fantasy e-sports, data and technology are transforming the way athletes train for the game and fans engage with their teams. In his session at @ThingsExpo, will present key data findings from leading sports organizations San Francisco 49ers, Orlando Magic NBA team. By utilizing data analytics these sports orgs have recognized new revenue streams, doubled its fan base and streamlined costs at its stadiums. John Paul is the CEO and Founder of VenueNext. Prior ...
Sep. 27, 2016 07:30 AM EDT Reads: 2,974