Skip to content

The difference between Cyber Security and just Security

The concept of “Cyber Security” is surely the attention grabber of the year. All security products and services enjoy a boost in their perception of importance, and sales, by merely prepending the word “cyber” to their description. But how is cyber security different than just security?

It differs, but it is not an entirely different domain, at least not from the technology perspective.

Security protects against malicious attacks. Attacks involve an
attacker, an attack target, and the attack method, which exploits one or more vulnerabilities in the target. When speaking of cyber attacks, it is common to refer to a nation state attacking another, or to an organization attacking a state. Referring to unorganized individual hackers as executing “cyber attacks", while being a common trend, is a blunt misuse of the “cyber” term in its common meaning. And still, cyber security is not as dramatically different than traditional security.

Continue reading "The difference between Cyber Security and just Security"

Improving the security provided by Yubikey for local encryption

In the previous post, I discussed the use of Yubikey for local encryption. I noted that Yubikey can store a long string that can be used as an encryption key, or a password. It provides no extra protection against key-loggers, but still allows to use strong passwords without remembering and typing them. Today, I would like to discuss a technique that makes Yubikey based encryption more secure; still not resistant to a key-logger, but resistant to having the Yubikey “borrowed” by a thief.

Continue reading "Improving the security provided by Yubikey for local encryption"

Using Yubikey with constant keys

Yubikey is the first one-time password generator I saw that can also emit a static password. When you press the button, a constant pre-defined string is entered, just as if it was typed on the keyboard. Is it more secure than typing the password on the keyboard? Not at all (unless shoulder-surfing is an issue.) So how does it differ from entering a long key yourself? It does not. And still, local encryption is a valid use-case just for such a function.

Continue reading "Using Yubikey with constant keys"

The case for supporting one-time passwords in conjunction with regular ones

A few days ago I got a Yubikey. While exploring use-cases for it, it occurred to me that there is a strong case for a mode of operation which is seldom (never?) used by IT departments: using the token while also supporting static passwords for the same services. It is not suitable for everyone, but it is suitable for the security-aware users. I will now introduce Yubikey in a few words, and then explain the purpose of adding support for one-time password to services that already support static passwords, without eliminating the latter.

Continue reading "The case for supporting one-time passwords in conjunction with regular ones"

CAcert as a certification alternative

A few months ago, I wrote about the problem that emerges from having to rely on digital certificates that are issued by Certification Authorities of which we, the relying parties, are not the paying customers. As a result, we rely on the CA (Certification Authority) certification process, while there is no economic incentive for the CA to actually maintain a robust certification mechanism and to justify our trust.

Unexpectedly, this post, titled “The Inevitable Collapse of the Certificate Model”, quickly became the favorite post on my blog, pulling more views than all other individual posts.

One alternative that was suggested is by
CAcert.org, a community based certification organization. Here are my thoughts on the ability of such a mechanism to solve the certification problem.

Continue reading "CAcert as a certification alternative"

Understanding the Impact of the RSA SecurID Breach

A few days ago, we were notified (e.g., here and here) that a hack into the network of RSA Security (the security division of EMC) has led to someone stealing something that is related to the SecurID token product.

We cannot determine the real impact of this security breach until RSA Security tells us what exactly got stolen. I believe that this information will be made available, as a result of legal or public pressure, if for no other reason. Until this data becomes available, let us examine the two most probable options, and how we may respond to each.

Continue reading "Understanding the Impact of the RSA SecurID Breach"

The Effect of Wikileaks

Wikileaks did evil. It published stuff that should not have been published. Julian Assange acted carelessly, I think. Still, the impact of Wikileaks is not what we usually think it is. The security of citizens was not affected by Wikileaks, but by the leak itself, and the publicity given to those leaks, in itself, may bring citizen security to a higher standard in the long run. The problem with Wikileaks is that it created a new market for leaked documents; a market which may increase the appeal of low-risk data theft.

Continue reading "The Effect of Wikileaks"

Overcoming Distrust in CAs Using External Quality Enforcement

A few weeks ago, I wrote about the inherent limitations of the certification model. This model cannot be expected to provide a solution to the binding of entities to public keys, primarily because Certification Authorities (CAs) have no financial incentive in performing thorough investigation on who they issue certificates to; and often on the contrary.

There is probably more than one solution to this problem. Let us examine one of them:
External quality enforcement

Continue reading "Overcoming Distrust in CAs Using External Quality Enforcement"

Preventing the Evil Maid Attack on FDE

The attack referred to as the ”Evil Maid Attack”, or the “Cleaning Maid Attack” against full disk encryption (FDE), is considered as one of the serious attacks concerning people who travel with laptops full of confidential information. This attack involves an attacker, who can obtain physical access to an FDE-protected laptop. The attacker boots the laptop from a second drive, and modifies the boot-sector so that subsequent boot-ups, e.g., by the owner, will cause the execution of malicious code that will capture the passphrase and/or key that is used to boot the system. Then, the attacker should get the laptop again to collect his loot. This attack was discussed everywhere, including in the PGP Blog, LWN.net, ZDNet, and the blog of Bruce Schneier.

Some people claimed that there are no feasible countermeasures against this attack, other than making sure your laptop is never left alone for too long. A while ago, I traveled to a place where laptops were not allowed; I had to leave it at the hotel every day for two weeks. This made me devise a practical solution which can be dubbed as:
be the cleaning maid yourself.

Continue reading "Preventing the Evil Maid Attack on FDE"

The Inevitable Collapse of the Certificate Model

Many had high expectations from the SSL/TLS certificate model. At least on paper it sounded promising and worthwhile. Keys are used to protect traffic; for this to be effective, keys shall be bound to business entities; for the binding to be trustworthy by the public, binding will be signed by Certification Authorities (CAs), which the public will recognize as authoritative. Once the trusted CA signs the binding between a business entity (represented by a domain name) and a key — every user can tell he is communicating securely with the correct entity.

In practice, it got all messed up. It is difficult to form authorization hierarchies on the global Internet, this is one thing. However, the model failed also due to the economics behind it.

Continue reading "The Inevitable Collapse of the Certificate Model"