DOCSLIB.ORG

Sicheres Coworking in Zeiten Von Corona

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Sicheres Coworking in Zeiten Von Corona Sicheres Coworking in Zeiten von Corona Ein Leitfaden von PwC Cyber Security & Privacy 20. März 2020 Herausforderungen Pandemie Sicherheit Viele Unternehmen stehen auf Grund der aktuellen Ad-hoc aufgebaute Strukturen sind anders als die etablierten Strukturen Bedrohungslage von Covid-19 vor der Herausforderung, nicht auf Sicherheitslücken getestet und bergen damit nicht zu ihre Mitarbeiter remote anzubinden. unterschätzende Risiken in Bezug auf Datenschutz und Datensicherheit. Infrastruktur Lösung Üblicherweise sind die Infrastrukturen von Firmen nicht auf die Dieser Leitfaden soll Sie Anbindung aller Mitarbeiter an das Firmennetz ausgelegt. unterstützen, die richtige Eine Möglichkeit zur Fortführung der Tätigkeiten der Mitarbeiter Coworking Lösung für Ihr muss schnellstmöglich zur Verfügung gestellt werden. Unternehmen zu finden. Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 2 Risiken, Prioritäten und Compliance Risiken bei der Bereitstellung von Ad-hoc Lösungen Auslastung Monitoring Nachvollziehbarkeit Evtl. sehr hohe Auslastung Verlagerung der Prioritäten Fehlende Koordination und von IT-Services, IT-Infrastruktur, innerhalb der IT-Organisation mangelhafte Kommunikationswege. Bandbreiten durch vermehrte und dadurch fehlendes oder Fehlender Fokus auf die Remote-Zugriffe auf das unzureichendes Monitoring von Dokumentation der Implementierung Unternehmensnetzwerk. Sicherheitsvorfällen. von Ad-hoc Lösungen. Fokus auf der Bereitstellung von Services, nicht auf Funktions- und Sicherheitstests vor Inbetriebnahme. Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 4 Welche Prozesse sind essentiell für den Fortbestand des Unternehmens? Kernprozesse Welche Unternehmensbereiche bzw. Prozesse sind auf Ad-hoc Lösungen angewiesen (und geeignet)? Welche Prozesse erbringen für das Unternehmen bzw. dessen Kunden essentielle Leistungen? Personal Welche MitarbeiterInnen bzw. Benutzerzugänge sind für die Aufrechterhaltung dieser Prozesse zwingend erforderlich? Priorisierung Welche Bereiche und Prozesse werden priorisiert für Coworking freigeschaltet? Priorisierung dafür notwendiger IT-Services und ggf. Entlastung dieser, durch Sperrung nicht benötigter Services und Benutzerzugänge? Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 5 Compliance Abgleich der Lösungsansätze mit Sicherheitsrichtlinien innerhalb der Organisation. Einhaltung geltender Gesetze (z.B. Datenschutz) und vertraglicher Regelungen zur Cyber Security (z.B. Kundenverträge). Berücksichtigung von Sicherheitsstandards bei der Beschaffung von Lösungen für den Notfallbetrieb. Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 6 Leitfaden Sind Coworking Möglichkeiten vorhanden? JA NEIN Ausbau und Verwendung Auswahl und Implementierung Dinge, auf die Sie nun achten müssen: Dinge, auf die Sie nun achten müssen: • Systemressourcen • Auswahl der richtigen Produkte/Lösungen • Beschränkungen • Geeignete Skalierung • Lizenzen • Lizenzen und Vertragslaufzeiten • Information der Mitarbeiter • Implementierungsaufwand • Einhaltung der Richtlinien • Information der Mitarbeiter • Sicherheitsrisiken durch Last • Sicherheitsaspekte und Risiken • Eventueller Rückbau der Lösung Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 8 Upscaling von vorhandenen Möglichkeiten des Remote-Arbeitens. Eine Coworking Möglichkeit EXISTIERT. Implementierung Richtlinien Sind genügend Systemressourcen Werden die vorhandenen Richtlinien (WAN, LAN, CPU, RAM) (Umgang mit Firmeninformationen, etc.) Dinge, auf die Sie nun achten müssen: für alle nötigen Mitarbeiter vorhanden? eingehalten? Wo sind die Bottlenecks der Lösung? Müssen Richtlinien angepasst werden? • Systemressourcen Last als Sicherheitsrisiko? • Beschränkungen Risiken Lizenzen • Lizenzen Welche Risiken entstehen? Wo werden Lizenzen benötigt? Wie können Risiken vermieden werden? • Information der Mitarbeiter Sind genügend Lizenzen vorhanden? • Einhaltung der Richtlinien Wer benötigt Lizenzen? Mitarbeiter Werden neue Lizenzen benötigt? Wie werden die Mitarbeiter über • Sicherheitsrisiken durch Last Wer beschafft die Lizenzen? die Möglichkeiten informiert? Welche Informationen benötigen die Mitarbeiter Monitoring (Handout, Anleitung)? Wie werden die Anforderungen der Nutzer bedient? Wie werden die Lösungen überwacht? Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 9 Planung Welche Anforderungen existieren? Welche Produkte kommen in Frage? Eine Coworking Möglichkeit Systemressourcen Richtlinien EXISTIERT NICHT. On Premise vs. Cloud Werden die vorhandenen Richtlinien Wie schnell lässt sich die Lösung bereitstellen? (Umgang mit Firmeninformationen, etc.) eingehalten? Dinge, auf die Sie nun achten müssen: Kann die Lösung remote ausgerollt werden? Müssen Richtlinien angepasst werden? • Auswahl des richtigen Produkts Lizenzen Risiken • Geeignete Skalierung Kommerziell vs. Open Source Wo werden Lizenzen benötigt? Welche Risiken entstehen? • Lizenzen und Vertragslaufzeiten Sind genügend Lizenzen vorhanden? Wie können Risiken vermieden werden? • Implementierungsaufwand Wer benötigt Lizenzen? Werden neue Lizenzen benötigt? Mitarbeiter • Information der Mitarbeiter Wer beschafft die Lizenzen? Wie werden die Mitarbeiter über die Möglichkeiten informiert? • Sicherheitsaspekte und Risiken Monitoring Welche Informationen benötigen die Mitarbeiter • Eventueller Rückbau der Lösung (Handout, Anleitung)? Wie werden die Anforderungen der Nutzer bedient? Wie werden die Lösungen überwacht? Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 10 Mögliche Lösungen In der Regel fallen für die gewerbliche Nutzung der genannten Lösungen Lizenzkosten an. Bei der Auswahl der Lösung sollte stets geprüft werden, welche Versionen im gewerblichen Kontext eingesetzt werden dürfen. Da einige Lösungen bzw. Dienste nicht in Einklang mit den Anforderungen der DSGVO stehen, sollte darüber hinaus geprüft werden, ob im Anwendungsfall personenbezogene Daten verarbeitet werden. Die hier aufgeführten Angaben zum Datenschutz beziehen sich auf die Angaben der Hersteller und wurden nicht explizit durch PwC geprüft. Collaboration – Voice and Video Lösung Sicherheit Risiko Implementierung Sicherheitsaspekte / Best Practice Niedrig Mittel Hoch Lizenzierung Deployment Standards Website (GSM-)Telefonie Kommunikation erfolgt unverschlüsselt Nicht notwendig Bereits Offen - × vorhanden Microsoft Skype P2P-Kommunikation, verschlüsselt, MFA 2 $/Nutzer/Monat, kostenlos Installation/ Proprietär .skype.com (for Business) × enthalten in Office 365 schnell Google Hangouts Nur Transport-Verschlüsselung, MFA Ab 4,68 €/Monat, Browser/ WebRTC hangouts.google.com (Meet)/Chats × Lizenzierung über GSuite schnell Cisco Webex Ende-zu-Ende Verschlüsselung, MFA Ab 12,85 €/Monat/Gastgeber Browser/ WebRTC/proprietär webex.com × Installation Zoom Transport-Verschlüsselung, Ende-zu-Ende Für kurze Meetings mit Installation Proprietär zoom.us Verschlüsselung(optional) × wenig Teilnehmern kostenlos Slack Nur Transport-Verschlüsselung, MFA Ab 6,25 € für Teams Installation WebRTC slack.com × bis 15 Mitglieder Microsoft Teams Nur Transport-Verschlüsselung, MFA Ab 4,20 €/Monat/Nutzer Browser/ Proprietär products.office.com/de- × für Office 365 Installation DE/microsoft-teams Jitsi Ende zu Ende Verschlüsselung, selbst gehostet Open Source Server- Offen www.jitsi.org × installation In der Regel fallen für die gewerbliche Nutzung der genannten Lösungen Lizenzkosten an. Bei der Auswahl der Lösung sollte stets geprüft werden, welche Versionen im gewerblichen Kontext eingesetzt werden dürfen. Da einige Lösungen bzw. Dienste nicht in Einklang mit den Anforderungen der DSGVO stehen, sollte darüber hinaus geprüft werden ob im Anwendungsfall personenbezogenen Daten verarbeitet werden. Die hier aufgeführten Angaben zum Datenschutz beziehen sich auf die Angaben der Hersteller und wurden nicht explizit durch PwC geprüft. Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 12 Collaboration – Voice and Video – Aktuelle Empfehlungen Wegen der aktuellen Situation bieten zahlreiche Hersteller ihre Software für einen begrenzten Zeitraum kostenlos an. So darf beispielsweise TeamViewer aktuell auch ohne Lizenz unbegrenzt kommerziell genutzt werden, CISCO bietet eine vollwertige Testversion kostenlos für 90 Tage an. Mit der Open Source Lösung jitsi.org bietet sich die Möglichkeit, Videokonferenzen selbst zu hosten. Weitere Lösungen sind Google Hangouts und In der Regel fallen für die gewerbliche Nutzung der genannten Lösungen Lizenzkosten an. Bei der Auswahl der Lösung sollte stets geprüft werden, welche Versionen im gewerblichen Kontext eingesetzt werden dürfen. Da einige Lösungen bzw. Dienste nicht in Einklang mit den Anforderungen der DSGVO stehen, sollte darüber hinaus geprüft werden ob im Anwendungsfall personenbezogenen Daten verarbeitet werden. Die hier aufgeführten Angaben zum Datenschutz beziehen sich auf die Angaben der Hersteller und wurden nicht explizit durch PwC geprüft. Sicheres Coworking in Zeiten von Corona 20. März 2020 PwC Cyber Security & Privacy 13 Collaboration – Data Exchange Lösung Sicherheit Risiko Implementierung Sicherheitsaspekte / Best Practice Niedrig Mittel Hoch Lizenzierung Deployment Risiken Partner Email (On Premise) • Webzugang zum Emailpostfach Es sind normalerweise keine Schnell • Angriffe von Außen OWA (Enduser / Technical Staff) ist von extern erreichbar zusätzlichen
Load more

Recommended publications
  • Self-Encrypting Deception: Weaknesses in the Encryption of Solid State Drives
    Self-encrypting deception: weaknesses in the encryption of solid state drives Carlo Meijer Bernard van Gastel Institute for Computing and Information Sciences School of Computer Science Radboud University Nijmegen Open University of the Netherlands [email protected] and Institute for Computing and Information Sciences Radboud University Nijmegen Bernard.vanGastel@{ou.nl,ru.nl} Abstract—We have analyzed the hardware full-disk encryption full-disk encryption. Full-disk encryption software, especially of several solid state drives (SSDs) by reverse engineering their those integrated in modern operating systems, may decide to firmware. These drives were produced by three manufacturers rely solely on hardware encryption in case it detects support between 2014 and 2018, and are both internal models using the SATA and NVMe interfaces (in a M.2 or 2.5" traditional form by the storage device. In case the decision is made to rely on factor) and external models using the USB interface. hardware encryption, typically software encryption is disabled. In theory, the security guarantees offered by hardware encryp- As a primary example, BitLocker, the full-disk encryption tion are similar to or better than software implementations. In software built into Microsoft Windows, switches off software reality, we found that many models using hardware encryption encryption and completely relies on hardware encryption by have critical security weaknesses due to specification, design, and implementation issues. For many models, these security default if the drive advertises support. weaknesses allow for complete recovery of the data without Contribution. This paper evaluates both internal and external knowledge of any secret (such as the password).
    [Show full text]
  • Computer and Information Security Pointer​ to Homework 2
    Computer and Information Security (ECE560, Fall 2020, Duke Univ., Prof. Tyler Bletsch) Pointer to Homework 2 Updated 2020-09-07:​ Clarified SSH key format Question 0: Accessing the Homework (0 points, but necessary) Homework 2 is encrypted with three stages of encryption. You’ll need to use both your Windows VM and a new Kali Linux VM. The stages are: 1. The inner layer is a VeraCrypt encrypted disk image to be opened in Windows that ​ ​ contains a link to Homework 2; I explain how to find the key for this later in this document. You get to the inner layer by decrypting the outer layer. 2. The outer layer is encrypted with AES and is available for each student on the course ​ ​ site; the secret key is randomly generated per each student and is distributed by the Encrypted Thing Giver web app. ​ 3. The Encrypted Thing Giver accepts an RSA public key, encrypts the random secret ​ ​ key using this public key. As owner of the corresponding private key, you’ll be able to decrypt it in order to obtain the AES key for the outer layer. The steps below will walk you through this crypto journey. You will need to show your work later, so keep notes! Make an SSH key pair You will need an SSH key pair. If you already created one, you can use it as-is (provided it is RSA-based, but most are). If you don’t have an SSH key pair, research how to create one with ssh-keygen. You may wish to do this on your local system, as you can set it up to let you SSH into Duke machines without a password (optional -- see Appendix A at the end of this document).
    [Show full text]
  • CEH: Certified Ethical Hacker Course Content
    CEH: Certified Ethical Hacker Course ID #: 1275-100-ZZ-W Hours: 35 Course Content Course Description: The Certified Ethical Hacker (CEH) program is the core of the most desired information security training system any information security professional will ever want to be in. The CEH, is the first part of a 3 part EC-Council Information Security Track which helps you master hacking technologies. You will become a hacker, but an ethical one! As the security mindset in any organization must not be limited to the silos of a certain vendor, technologies or pieces of equipment. This course was designed to provide you with the tools and techniques used by hackers and information security professionals alike to break into an organization. As we put it, “To beat a hacker, you need to think like a hacker”. This course will immerse you into the Hacker Mindset so that you will be able to defend against future attacks. It puts you in the driver’s seat of a hands-on environment with a systematic ethical hacking process. Here, you will be exposed to an entirely different way of achieving optimal information security posture in their organization; by hacking it! You will scan, test, hack and secure your own systems. You will be thought the Five Phases of Ethical Hacking and thought how you can approach your target and succeed at breaking in every time! The ve phases include Reconnaissance, Gaining Access, Enumeration, Maintaining Access, and covering your tracks. The tools and techniques in each of these five phases are provided in detail in an encyclopedic approach to help you identify when an attack has been used against your own targets.
    [Show full text]
  • Fbi Fbi Flash
    TLP: GREEN FBI FLASH FBI FBI Liaison Alert System #M-000045-TT The following information was obtained through FBI investigation and is provided in conjunction with the FBI’s statutory requirement to conduct victim notification as outlined in 42 USC § 10607. In furtherance of public-private partnerships, the FBI routinely advises private industry of various cyber threat indicators observed during the course of our investigations. This data is provided in order to help cyber security professionals and systems administrators to guard against the persistent malicious actions of cyber criminals. This product is released at TLP: GREEN. The information in this product is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share this information with peers and partner organizations within their sector or community, but not via publicly accessible channels. SUMMARY The FBI is providing the following information with HIGH confidence: A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity against public and private U.S. organizations, including Cleared Defense Contractors (CDCs), academic institutions, and energy sector companies. The actors typically utilize common computer intrusion techniques such as the use of TOR, open source reconnaissance, exploitation via SQL injection and web shells, and open source tools for further network penetration and persistence. Internet-facing infrastructures, such as web servers, are typical targets for this group. Once the actors penetrate a victim network, the actors exfiltrate network design information and legitimate user credentials for the victim network. Often times, the actors are able to harvest administrative user credentials and use the credentials to move laterally through a network.
    [Show full text]
  • Encryption Disk Full Disk and Hidden OS in EFI V1.2 Revisions N Date Name Comment
    Encryption disk Full disk and hidden OS in EFI v1.2 Revisions N Date Name Comment 1.2 28-mar-17 kavsrf Hidden OS. Simplified 1.1 28-feb-17 kavsrf Hidden OS. Developer way. 1.0 28-jan-17 kavsrf Started. Encryption disk..............................................................................................................................1 Full disk and hidden OS in EFI..................................................................................................1 v1.1.............................................................................................................................................1 1 Full disk encryption....................................................................................................................1 1.1 Boot from local hard disk....................................................................................................1 1.1.1 Final disk structure........................................................................................................1 1.1.2 Installation scenario (It is proposal)..............................................................................1 1.1.3 Developer way. To test PoC..........................................................................................2 2 Hidden OS installation................................................................................................................2 2.1 Installation in addition to already encrypted OS..................................................................2 2.1.1 Prepare disk state..........................................................................................................2
    [Show full text]
  • Analysis and Processing of Cryptographic Protocols
    Analysis and Processing of Cryptographic Protocols Submitted in partial fulfilment of the requirements of the degree of Bachelor of Science (Honours) of Rhodes University Bradley Cowie Grahamstown, South Africa November 2009 Abstract The field of Information Security and the sub-field of Cryptographic Protocols are both vast and continually evolving fields. The use of cryptographic protocols as a means to provide security to web servers and services at the transport layer, by providing both en- cryption and authentication to data transfer, has become increasingly popular. However, it is noted that it is rather difficult to perform legitimate analysis, intrusion detection and debugging on data that has passed through a cryptographic protocol as it is encrypted. The aim of this thesis is to design a framework, named Project Bellerophon, that is capa- ble of decrypting traffic that has been encrypted by an arbitrary cryptographic protocol. Once the plain-text has been retrieved further analysis may take place. To aid in this an in depth investigation of the TLS protocol was undertaken. This pro- duced a detailed document considering the message structures and the related fields con- tained within these messages which are involved in the TLS handshake process. Detailed examples explaining the processes that are involved in obtaining and generating the var- ious cryptographic components were explored. A systems design was proposed, considering the role of each of the components required in order to produce an accurate decryption of traffic encrypted by a cryptographic protocol. Investigations into the accuracy and the efficiency of Project Bellerophon to decrypt specific test data were conducted.
    [Show full text]
  • Download CVS 1.11.1P1-3 From: Ftp://Ftp.Software.Ibm.Com/Aix/Freesoftware/Aixtoolbox/RPMS/Ppc/Cvs/ Cvs-1.11.1P1-3.Aix4.3.Ppc.Rpm
    2003 CERT Advisories CERT Division [DISTRIBUTION STATEMENT A] Approved for public release and unlimited distribution. http://www.sei.cmu.edu REV-03.18.2016.0 Copyright 2017 Carnegie Mellon University. All Rights Reserved. This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The view, opinions, and/or findings contained in this material are those of the author(s) and should not be con- strued as an official Government position, policy, or decision, unless designated by other documentation. References herein to any specific commercial product, process, or service by trade name, trade mark, manu- facturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute. This report was prepared for the SEI Administrative Agent AFLCMC/AZS 5 Eglin Street Hanscom AFB, MA 01731-2100 NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribu- tion. Please see Copyright notice for non-US Government use and distribution.
    [Show full text]
  • Private Contact Discovery
    Security Now! Transcript of Episode #631 Page 1 of 32 Transcript of Episode #631 Private Contact Discovery Description: This week we discuss some aspects of iOS v11, the emergence of browser hijack cryptocurrency mining, new information about the Equifax hack, Google security research and Gmail improvements, breaking DKIM without breaking it, concerns over many servers in small routers and aging unpatched motherboard EFI firmware, a new privacy leakage bug in IE, a bit of miscellany, some long-awaited closing-the-loop feedback from our listeners, and a close look into a beautiful piece of work by Moxie & Co. on Signal. High quality (64 kbps) mp3 audio file URL: http://media.GRC.com/sn/SN-631.mp3 Quarter size (16 kbps) mp3 audio file URL: http://media.GRC.com/sn/sn-631-lq.mp3 SHOW TEASE: It's time for Security Now!. I'm back. Steve Gibson's here. And we have a lot to talk about, including a little more information about how Apple's Face ID works. A judge who says, no, the FBI doesn't have to tell you anything about how it unlocked that iPhone. And Moxie Marlinspike in another discovery, this time Signals the victim. Plus the secret life of bees. It's all coming up next on Security Now!. Leo Laporte: This is Security Now! with Steve Gibson, Episode 631, recorded Tuesday, October 3rd, 2017: Private Contact Discovery. It's time for Security Now!, the show where we cover the latest news from the security front. It is a front. It's a war out there.
    [Show full text]
  • Data Acquisition Systems), Section 1
    INST 260 (Data Acquisition systems), section 1 Lab Data acquisition and transport over Ethernet: Question 91, completed objectives due by the end of day 6, section 3 Exam Day 6 of section 3 – only a simple calculator may be used! Complete mastery of these objectives due by the next exam date Specific objectives for the “mastery” exam: Electricity Review: Calculate and annotate voltages and currents in a DC series-parallel resistor circuit • given source and resistor values Sketch proper wire connections for a data acquisition unit to measure an analog sensor signal • Convert between different numeration systems (decimal, binary, hexadecimal, octal) • Calculate ADC (analog-digital converter) input and output values given calibrated ranges • Solve for a specified variable in an algebraic formula • Determine the possibility of suggested faults in a simple circuit given measured values (voltage, current), • a schematic diagram, and reported symptoms Motor/relay/3phase/PLC Review: Determine status of a relay logic circuit given a schematic diagram • and switch stimulus conditions INST241 Review: Identify (American) wire colors for different thermocouple types • INST250 Review: Convert between different pressure units (PSI, ”W.C., bar, etc.) showing proper • mathematical cancellation of units (i.e. the “unity fraction” technique) Recommended daily schedule Day 1 Theory session topic: Signal coupling, shielding, and wiring practices Questions 1 through 20; answer questions 1-9 in preparation for discussion (remainder for practice) Day 2 Theory session
    [Show full text]
  • Draft Version
    Zurich of University the at Security IT on lecture the for reading complementary as ISBN: 978-1-63081-846-3 used be can This text is extracted from the book “Cryptography 101: From Theory to Practice” that was writtentext by Rolf Oppliger and published by Artech House in June 2021 (in its Information Security and Privacy book series). This Zurich of Chapter 1 University the at Introduction Security In this chapter, we pitch the field and introduce the topicIT of the book, namely cryp- tography, at a high operating altitude and level ofon abstraction. More specifically, we elaborate on cryptology (including cryptography) in Section 1.1, address crypto- graphic systems (or cryptosystems for short) in Section 1.2, provide some historical background information in Section 1.3, andlecture outline the rest of the book in Section 1.4. The aim is to lay the basics to understand and put into proper perspective the the contents of the book. for 1.1 CRYPTOLOGY reading The term cryptology is derived from the Greek words “krypt´os,” meaning “hidden,” and “l´ogos,” meaning “word.” Consequently, the term cryptology can be paraphrased as “hidden word.” This refers to the original intent of cryptology, namely to hide the meaning of words and to protect the confidentiality and secrecy of the respective data accordingly. As will (hopefully) become clear throughout the book, this viewpoint is too narrow,complementary and the term cryptology is currently used for many other security- related purposesas and applications in addition to the protection of the confidentiality and secrecy of data. More specifically, cryptology refers to the mathematical science and field of used study that comprises cryptography and cryptanalysis.
    [Show full text]
  • Veracryptcrypt F R E E O P E N - S O U R C E O N - T H E - F L Y E N C R Y P T I O N User’S Guide
    VERAVERACRYPTCRYPT F R E E O P E N - S O U R C E O N - T H E - F L Y E N C R Y P T I O N USER’S GUIDE veracrypt.codeplex.com Version Information VeraCrypt User’s Guide, version 1.19 Released by IDRIX on October 17th, 2016 Legal Notices THIS DOCUMENT IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. THE ENTIRE RISK AS TO THE QUALITY, CORRECTNESS, ACCURACY, OR COMPLETENESS OF THE CONTENT OF THIS DOCUMENT IS WITH YOU. THE CONTENT OF THIS DOCUMENT MAY BE INACCURATE, INCORRECT, INVALID, INCOMPLETE AND/OR MISLEADING. IN NO EVENT WILL ANY AUTHOR OF THE SOFTWARE OR DOCUMENTATION, OR ANY APPLICABLE COPYRIGHT OWNER, OR ANY OTHER PARTY WHO MAY COPY AND/OR (RE)DISTRIBUTE THIS SOFTWARE OR DOCUMENTATION, BE LIABLE TO YOU OR TO ANY OTHER PARTY FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, ANY DIRECT, INDIRECT, GENERAL, SPECIAL, INCIDENTAL, PUNITIVE, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, CORRUPTION OR LOSS OF DATA, ANY LOSSES SUSTAINED BY YOU OR THIRD PARTIES, A FAILURE OF THIS SOFTWARE TO OPERATE WITH ANY OTHER PRODUCT, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES, OR BUSINESS INTERRUPTION), WHETHER IN CONTRACT, STRICT LIABILITY, TORT (INCLUDING, BUT NOT LIMITED TO, NEGLIGENCE) OR OTHERWISE, ARISING OUT OF THE USE, COPYING, MODIFICATION, OR (RE)DISTRIBUTION OF THIS SOFTWARE OR DOCUMENTATION (OR A PORTION THEREOF), OR INABILITY TO USE THIS SOFTWARE OR DOCUMENTATION, EVEN IF SUCH DAMAGES (OR THE POSSIBILITY OF SUCH DAMAGES) ARE/WERE PREDICTABLE OR KNOWN TO ANY (CO)AUTHOR, INTELLECTUAL-PROPERTY OWNER, OR ANY OTHER PARTY.
    [Show full text]
  • Encryption of Data - Questionnaire
    Council of the European Union Brussels, 20 September 2016 (OR. en) 12368/16 LIMITE CYBER 102 JAI 764 ENFOPOL 295 GENVAL 95 COSI 138 COPEN 269 NOTE From: Presidency To: Delegations Subject: Encryption of data - Questionnaire Over lunch during the informal meeting of the Justice Ministers (Bratislava, 8 July 2016) the issue of encryption was discussed in the context of the fight against crime. Apart from an exchange on the national approaches, and the possible benefits of an EU or even global approach, the challenges which encryption poses to criminal proceedings were also debated. The Member States' positions varied mostly between those which have recently suffered terrorist attacks and those which have not. In general, the existence of problems stemming from data/device encryption was recognised as well as the need for further discussion. To prepare the follow-up in line with the Justice Ministers' discussion, the Presidency has prepared a questionnaire to map the situation and identify the obstacles faced by law enforcement authorities when gathering or securing encrypted e-evidence for the purposes of criminal proceedings. 12368/16 MK/ec 1 DGD2B LIMITE EN On the basis of the information be gathered from Member States' replies, the Presidency will prepare the discussion that will take place in the Friends of the Presidency Group on Cyber Issues and consequently in CATS in preparation for the JHA Council in December 2016. Delegations are kindly invited to fill in the questionnaire as set out in the Annex and return it by October 3, 2016 to the following e-mail address: [email protected].
    [Show full text]