Do you know if your child is being cyberbullied? These are the red flags

By Ondrej Kubovič

For some countries, the summer holidays are just around the corner and most school kids are looking forward to taking a break from homework and waking up early. Some of them, however, will enjoy being away from school for altogether less pleasant reasons – to get away from­ bullies, who bother them offline or online over social networks.

Unfortunately, not every parent can distinguish common teenage difficulties from the red flags raised by insidious peers. As June 17^th is Stop Cyberbullying Day, we have prepared a list of indicators that can help parents recognize whether their offspring is being (cyber)bullied.

Snappy answers and moods swings

Frequent moods swings do not necessarily mean that your child is being bothered by their peers. However, if these are accompanied by jumpy and nervous reactions to common questions, especially after disconnecting from the virtual world, it’s time to ask if they are having any trouble.

Parents should not be satisfied with “good” and “fine” responses, as these don’t always mean good and fine. Sometimes you have to dig deeper to find out how your kid really feels about his/her experience online. Watch out for snappy responses – these are another common denominator for many cases of cyberbullying.

Deleted social network account

If your child suddenly quits one of their favorite social networks, be aware. In an age where young people invest significant time to being online and engaging with social media, deleting an account might be a signal that something serious is going on in their lives. Parental control tools, installed on a child’s device, will give parents a good overview of which apps he/she prefers and frequently uses.

Withdrawing from friends and family in real life

It is only natural that teenagers are trying to become more independent from their parents and thus devote more time into building their own network of friends. Yet, if they distance themselves from the latter, hide from the outside world in their rooms and avoid social media as well as their devices, something is amiss.

Dramatic physical changes

Has your child suddenly lost weight or their appetite? Does he/she have trouble sleeping during the night and look stressed out in the morning? Again, this might be a sign of many things, but if combined with some of the aforementioned points, there is a good chance they are being bullied either offline or online.

Pretending to be sick trying and to avoid school

“I don’t feel so good.” “My tummy hurts.” “Can I skip school today?” Almost every child uses these excuses from time to time. Be it an exam he/she is not prepared for or just a difficult day at school, it is common that they may try to avoid whatever is causing them distress. However, if your child pretends to be ill too often, there might a more serious issue behind it, such as a fear of an inevitable conflict with their bully.

Nato: Cyberspace is an operational domain of warfare

By Narinder Purba

Nato has acknowledged that cyberspace is now an operational domain of warfare, along with air, sea and land.

Recognizing that this particular threat is growing in prominence in the 21st century, its secretary general Jens Stoltenberg said that cybersecurity must be an important part of “collective defence”.

Speaking at the recent North Atlantic Council meeting in Brussels, Belgium, he went on to say that “most crises and conflicts today have a cyber dimension”.

He added: “Treating cyber as an operational domain would enable us to better protect our missions and operations.”

The intergovernmental military alliance has been considering the threat of cybercrime, cyberterrorism and cyberwarfare for some time.

However, it has had to speed up its response to this complex risk, as the “threat landscape is markedly different from that of a few years ago”.

This is the opinion of Neil Robinson, a policy officer based in the emerging security challenges division at Nato.

Writing in the Nato Review, he said that consensus among experts is that cyberthreats are more sophisticated than ever before.

“Another vital difference lies in their diversity,” Mr. Robinson continued. “Cyber risks threaten the benefits, whether economic, political or social that the human invention of cyberspace can offer.”

During the meeting in Brussels, Mr. Stoltenberg underlined the importance of boosting Nato’s own approach to cybersecurity, as well as that of its member nations.

He admitted a lot of work needs to be done, but that in recognizing cyberspace as an operational domain, Nato has already made a positive step forward in tackling this threat.

Organizational cybersecurity efforts ‘needs bolstering’

By Narinder Purba

Organizations need to take charge of their cybersecurity efforts to ensure they are well-equipped to deal with this growing threat.

This is one of the main findings of the second annual RSA Cybersecurity Poverty Index, which also highlighted the increased risk firms face today.

Its analysis revealed that approximately 75% of organizations worldwide have a “significant cybersecurity risk exposure”.

While many businesses acknowledge that cybercrime and cyberattacks are growing security concerns, many are slow to respond in the most appropriate way, the paper suggested.

For example, approximately half of all firms polled for the study admitted that their incident response capabilities are either “ad-hoc” or “non-existent”.

Further, the authors of the paper touched upon the fact that many organizations are reactive when it comes to bolstering their defenses.

They found that investment in cybersecurity solutions and programs tends to come only after they experience a cyberattack.

“We need to change the way we are thinking about security, to focus on more than just prevention.”

“We need to change the way we are thinking about security, to focus on more than just prevention – to develop a strategy that emphasizes detection and response,” said Amit Yoran, president of the RSA.

“Organizations need to set their agendas early, build comprehensive strategies and not wait for a breach to force them into action.”

While there is still a lot to do, the report did record some progress over the past 12 months.

It observed that since 2015’s index, there has been a noticeable increase in the number of businesses now benefiting from “mature cybersecurity programs”.

News of this comes on the back of a similar study from Gemalto, which found that 69% of IT decision-makers are unconfident that their companies data would be secure following a data breach.

http://www.welivesecurity.com/2016/06/16/organizational-cybersecurity-efforts-needs-bolstering/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Windows 10 security and privacy: An in-depth review and analysis

By Aryeh Goretsky

As Windows 10 approaches its one year anniversary, it is interesting to take a look at how far the operating system has come. Microsoft has promised greater security in Windows. During the past 12 months I have been kept very busy researching and documenting Windows 10’s security, as well as its privacy issues. I have now completed a white paper on the subject: Microsoft Windows 10 Security and Privacy: An ESET White Paper.

Windows 10 represents a sea change for Microsoft: the realization of its Windows as a Service (WaaS) strategy initiated by its predecessor, Windows 8. With WaaS, Microsoft is able to update its Windows operating system with additional features and functionality throughout its life, instead of only at service point releases or new versions. In the past, new features and functionality have had to wait for one of these events. With Windows 10, these will now appear at various operating system “point” releases, which will occur two to three times a year, according to Microsoft.

Lest anyone think that Microsoft’s commitment to making changes to Windows in order to improve its security and privacy is mere sophistry, allow me to share my own experience over the course of writing this white paper. Of the 35 pages originally turned in, 18 had to be rewritten completely due to changes made by Microsoft after Windows 10’s release less than 12 months ago.

Despite this, I have endeavored to provide a comprehensive analysis of Windows 10 from a security and privacy perspective, as you can see from this selection of top level section headings from the white paper. Bear in mind these are just the main sections:

Windows Adoption by the Numbers	Windows 8: The Security Story So Far
What's Improved in Windows 10	Windows Update
Windows Branches	Windows Defender
Defending Windows Defender	BitLocker
SmartScreen Filter	What's New in Windows 10
Conditional Access	Control Flow Guard
Device Guard	Virtualization-Based Security
Microsoft Edge	Microsoft Passport
Windows Hello	Windows 10 Mobile
Privacy	Cortana Search Agent
Government issues	Microsoft on Privacy

I trust this white paper will help organizations that are currently evaluating the role of Windows 10 in their operating system and security strategies. To the best of my ability I have referenced all of the information that is provided in the paper, hot-linked through the more than 120 footnotes it took to do that. However, if you think something is missing, or you have any questions about Windows 10’s security or privacy, be sure to let me know in the comments below.

Aryeh Goretsky, MVP, ZCSE
Distinguished Researcher, ESET

Have you installed Windows 10 yet? Will you upgrade before July 29th to take advantage of the free upgrade, or wait until afterwards? What concerns you about Windows 10 security? It’s privacy? Let us know your thoughts and opinions below!

Quantum Computation, a Cryptography Armageddon (?)

Cryptography is a cornerstone of information security. It is used to encode and decode data in order to fulfill the requirement for confidentiality, integrity, authenticity as well as non-repudiation. Together, these are frequently referred to as cryptography services.

Advances in cryptanalysis, computer science and engineering are always pushing the limits of what is considered secure. RSA, which once was believed secure under 129 bit-keys, nowadays is not considered secure using keys smaller than 2,048 bits. MD5, which was designed in 1992 and had been one of the most widely used hash functions, was proven to be breakable (in the sense of collision-attack) in 2004.  Likewise, freestart collision against SHA-1, which is somewhat easier to find than standard collisions,  was demonstrated and published at Eurocrypt 2016.

One of the resources in the toolkit of cryptanalysts is quantum computing. Quantum computing is based on physical quantum properties to perform operations, which behaves differently than the electronic properties we are used to find in today’s computers and its basic unit of information, instead of bit, is called quantum bit or qubit. It started to be used in theoretical attacks against cryptosystems back in 1994, when Peter Shor published a quantum algorithm to find the prime factors of a given integer. This algorithm enables the solving of integer factorization and discrete logarithm problems, which are the basis of most (not to say all) widely used public-key cryptography algorithms. Less devastating in its impact but still of major importance, Grover’s quantum algorithm enables a huge speedup in search algorithms that impacts the security of many cryptosystems, including AES. This leads us to make a fairly surprising statement: all major cryptographic algorithms in use today are (virtually) broken!

Today, the only mitigating factor is the absence of a quantum computer large enough to run such algorithms against the parameters currently in use by crypto algorithms.

In the landscape of quantum computing everything is evolving fast. In April 2016, the European Commission announced plans to invest one billion euros in an EU project for a “large-scale EU-wide quantum technologies flagship”. As with this program, many others have been launched to fund the development of large-scale quantum computers.

Also in April 2016, researchers in Canada established a new record in quantum computer factorization, after factoring the number 200,099 using a D-Wave 2X processor, although it is not clear whether D-WAVE produces universal quantum computers able to run the Shor’s algorithm. Furthermore, 200,099 is only an 18-bit number, way too small to need the computation power required to factor a 2,048-bit integer to break current RSA parameters.

The current stage of large-scale deployment of public key cryptosystems counts on pretty elderly algorithms like Diffie-Hellman (1976), RSA (1977) and Elliptic Curves (1985). The latter was first published more than 30 years ago, but has recently started to be deployed on a large scale.

To tackle the cryptography Armageddon imposed by large-scale quantum computers, cryptographers around the world have been working for at least a decade to design and improve cryptosystems resistant to quantum attacks, known as post-quantum cryptography or PQCrypto. Many cryptosystems have been designed and even standardized, like NTRU, nonetheless confidence in such new cryptosystems takes time to earn by being thoroughly scrutinized over and over again until they are proven to be ready for large-scale deployment.

What is the current state of PQCrypto?

 In 2006 the first PQCrypto Conference was hosted, bringing  together researchers to look for secure alternatives against quantum computing attacks. At the time, some alternatives were already at hand, such as McEliece encryption (1978), and ever since many programs to fund research in PQCrypto have been launched, such as European Commission’s SAFECrypto, a program for the development of quantum-resistant lattice-based cryptography, or CryptoWorks21, a Canadian program to develop next-generation quantum-safe cryptographic tools for the 21^st century. The outcome of all these efforts towards PQCrypto is a huge advance in the field that has already provided post-quantum candidates that meet all desired features of like efficiency and key-size comparable to classic algorithms.

PQCrypto does not entail any special hardware. It is like classic crypto, but built on problems that are infeasible even for large quantum computers. PQCrypto algorithms have been designed to fulfill the services provided by classic crypto and many of them are able to run even on the most limited platforms.

How will PQCrypto evolve?

Even in a quantum world, current security protocols will continue to be as secure as they are today if their design assumptions are fulfilled using post-quantum cryptosystems. Thus, we should see a gradual adoption of modern PQCrypto algorithms by existing protocols over the coming years.

We should see a decline in the use of public-key algorithms most used nowadays, such as RSA and Elliptic Curves; in the cases like symmetric crypto and hash functions, the current parameters will have to be revisited (usually doubled) to ensure that they stay secure in a quantum world. This shift to modern algorithms should happen transparently to end users; however, whoever is responsible for development or configuration of security applications should be ready for the coming changes – in particular, those who support these functionalities in legacy systems.

By way of speculating on how long it will take until large quantum computers are able to perform attacks on cryptosystems set with today’s parameters, let’s assume that Moore’s law will be valid throughout the development of quantum computation. Shor’s algorithm requires roughly 3 log₂(N) qubits to factor an integer N (it means that Shor’s algorithms require roughly 6K qubits to break RSA-2048), whereas Moore’s law states that the number of bits - qubits here - that can be packed into a circuit doubles every 12-24 months. As an exercise, let’s take a 5-qubit quantum computer such as the one made available online by IBM this month; then the total number of qubits available to run Shor’s algorithm after M cycles of Moore’s law can be calculated as 5 * 2^M, therefore taking 18 months as an average cycle span of Moore’s law, we end up with approximately sixteen years from now until attacks against RSA-2048 become feasible – it takes 16.5 years to go over 11 cycles of Moore’s law; this results in the availability of 10K qubits (more precisely 10240=5*2¹¹) after this period,  which is able to supply the 6K qubits required to run the aforementioned attack. The same magnitude of qubits goes for Grover’s algorithm (“between around 3,000 and 7,000 logical qubits”) to mount attacks against AES, so that their security level will be halved within that period of time. It means that if our assumptions hold, in sixteen years AES-256 will be as secure as AES-128 is today and AES-128 will be broken. Therefore, if we recall the time taken by Elliptic Curves until it was ready for wide deployment, we realize that clock is ticking for PQCrypto.

What should I care about and what should I do?

A topic that will have major impact along with the advance of quantum computing is long-term security, which can be related to:

·         Long-term authenticity; such as the life span of a digitally-signed contract;

·         Long-term confidentiality; on legal grounds – for instance, the German Legal Code stipulates that medical data must remain confidential even after the patient´s death – or for strategic reasons, such as organization or government secrets;

Long-term authenticity can be accomplished using simple techniques, like re-signing a document using secure algorithms for as long as needed. Nonetheless, this possibility has to be foreseen and guaranteed by the underlying laws or any system of rules in place; otherwise it will also be threatened by the advance of quantum computation.

Yet, long-term confidentiality is a much more difficult task. There is no established way to address this issue and it is fair to state that none of the current public-key cryptosystems can fulfill this task. It might be a good choice to encrypt these data using strong symmetric ciphers using keys of at least 192 bits to stay secure even if their security level is halved by quantum computers .

Finally, if you expect long-term security for your information, then you should start looking for alternatives or planning for these changes right away. Adversaries who cannot overcome the security of your information today, by decrypting your data or forging your signature, can nevertheless keep a record of the data until they have quantum computers, at which point their attacks will succeed.