Egress Switch

Blast from the past: Is resurrecting the fax machine actually helping Sony’s CEO to protect sensitive information?

2016-02-26T11:11:00.002+00:00

In November 2014, Sony Pictures experienced a particularly damaging cyberattack, when information about employees and their families, including executive salaries, was obtained by hacker group, Guardians of Peace. The group also leaked private email exchanges between top executives that left the studio running around doing damage control with the media over use of the material.

As a result, earlier this week, Sony Pictures CEO Michael Lynton revealed that he has reverted back to writing sensitive messages by hand and faxes them to their destination.

However, is this really doing anything to improve data protection at Sony Pictures?

Fax machines have to be viewed as one of the least secure ways to share data. In the last three months of 2015 alone, the ICO reports that sending sensitive information to the incorrect recipient (for example, entering the fax number incorrectly) caused 38% of data breaches in the legal sector, 25% of incidents in the justice sector and 23% of incidents in the health sector.

In addition, even if the information is sent to the correct machine, the data owner – that is, the person sending the information – then has absolutely no control over who picks up the printout and what they subsequently decide to do with it. (Loss of paperwork is another leading cause of data breach incidents.)

Why, then, is the CEO of such a large tech company like Sony trusting in a system that is proven to put sensitive data at risk?

Encryption solutions exist that can protect organisations’ sensitive information to industry and government accredited standards while keeping tools like email usable to all members of the business and third parties. Technology is available with the ability to control what recipient do with shared information – such as save locally or print – and see detailed audit logs of what they’ve done with it. Companies like Sony should therefore be setting an example to the wider industry by adopting data security technology that offers genuine protection and information assurance to their employees and their customers.

If organisations are genuinely going to learn the lessons of the Sony cyberattack, they need to make sure information security is a natural part of how all employees collaborate to ensure they remain productive but to importantly also protect sensitive customer and corporate data.

Why is real-time, online editing a game changer?

2016-01-22T13:35:00.000+00:00

With the latest release of Egress Switch Secure Workspace, users can create and edit documents collaboratively online whilst enjoying the advanced security levels for which Egress Switch is renowned. In this blog post, we explain why Switch Secure Workspace 3.0 is a game changer for the secure collaboration and file sharing space.

Working in a digital world

The 21^st Century workplace faces a dilemma. The digital revolution has brought about three trends:

Organisations are embracing remote, even transnational, working practices
More and more data is being created and communicated electronically
Threats to information security are more widespread and insidious than ever

As workers collaborate on tasks over the internet, the vast amounts of data transferred makes it tremendously difficult to maintain control of and protect sensitive information. Alongside this, organisations are going paperless and moving workflow to the cloud, bringing cost savings and efficiency – but how do you balance maintaining quick and easy access to documents whilst upholding security? When the data is out of sight, it can sometimes be easy to keep information security out of mind – however security infrastructure must keep pace with the current trends in working practices if organisations are to avoid data breach catastrophe.

With online editing, Switch Secure Workspace solves this dilemma.

The compromise with file sharing and collaboration products has always been between usability, security and cost, but with Switch Secure Workspace there is no more compromising. No more cost-cutting at the expense of security or paying more for a secure solution that’s left unused due to its technical complexity.

Teamwork made easy

Real-time, online editing is an instrumental feature in Switch Secure Workspace’s innovative solution to these crucial issues. Microsoft Word, Excel and Powerpoint files can be edited within Switch Secure Workspace in an easy-to-use editing window. All the main features you associate with MS Office products are there, from chart creation and complex formulas to presentation animation.

Using the discussion and chat features it’s simple for colleagues to discuss the work they are producing. All document changes are tracked and highlighted so you can see who’s been working on the documents.

Detailed auditing of all editing and collaboration is another impressive feature not seen in other products, and something of an Egress Switch trademark. Throughout a document’s lifecycle, you’ll always know who’s viewed or edited it, while fine-grained permissions controls mean documents always stay within trusted circles.

Switch Secure Workspace works on any modern browser, as well as on tablets and mobiles; it’s remote working without resorting to email and getting lost in version mismatches, or worse still, using insecure FTP services. No additional software needs downloading, so there’s no stepping outside the secure platform to edit – everything happens within a workspace and within your control.

Collaboration without compromise

Switch Secure Workspace 3.0 is the first solution to bring all these features together and satisfy the plea for a user-friendly collaborative platform that doesn’t sacrifice security, reduce efficiency or negate cost savings with exorbitant deployment expenditure. The online, real-time editing is the best of its kind, and the auditing and permissions controls are powerful and unique. That’s why Switch Secure Workspace 3.0 is a game changer.

Consensus at last - but what does the EU General Data Protection Regulation mean for you?

2015-12-17T09:22:00.000+00:00

Discussions over the EU General Data Protection Regulation (GDPR) have rumbled on since 2012. Consequently, it's understandable that this week's breaking news about a final agreement over the legislation already seems like old news. However, while it may have been almost three years since the need for change was acknowledged, the regulation as it stands today is vastly different to that under which organisations currently operate.

As a result, there is an inevitable widespread need for an update to policy, procedure and technology. With the regulation on track to be formally adopted in January 2016 and enforced a short two years later, organisations need to evaluate, implement and adopt processes and technology now, so they don’t fall foul later.

Two points to watch out for

Across the board, two of the most significant changes to be introduced are mandatory reporting of data breaches that are 'likely to harm individuals' within 72 hours and hefty fines of up to 4% of global turnover for non-compliance (the ICO's current maximum of £500,000 will pale in comparison for many large organisations).

Mandatory notification is expected to result in a rise of in the number of data breaches being reported - not because more breaches are happening but because fewer can be swept under the carpet. Consequently, organisations will be forced to open themselves up to scrutiny, with regulatory bodies looking at how the sensitive data they handle is protected throughout its lifecycle. Any shortcomings will be exposed and will count against them.

As we recently examined, TalkTalk's data breach from October 2015 is estimated to cost them £35m in one-off costs alone. We need only add 4% of their global turnover to that and we can see why the EU GDPR will be keeping CFOs awake at night!

The good news is that now there's clarity, there can be action. Boards across Europe need to immediately start planning and implementing the right processes, training and technologies to protect the entire lifecycle of their data so they're prepared for when the regulation is enforced. We can see from previous breaches that it is the small slip ups, caused by human error, that have been the most common and largely the most damning. As a result, security policy need to be matched with user training and education, and underpinned by smart, intuitive technology. Getting a head start on this now can only pay dividends in the future.

There’s no job security when your job is security

2015-12-11T14:00:00.002+00:00

“There’s no job security when your job is security”. That’s the kind of line that would be enough for any CSO, CIO or even CEO to start penning their resignation letter.

The reality is obviously somewhat different. However if the history of the last 12-18 months has taught us anything, it is that no-one is exempt from a high-profile data breach. Breaches so severe that jobs can be lost and reputations so badly damaged that businesses are put at risk.

Finally, it seems, the penny has dropped. Organisations including the likes of TalkTalk, Facebook, Gmail and Twitter now accept that no set of security measures is completely infallible to a breach.

As a result, they are starting to assess two things.

The cost of a data breach

Research carried out by IBM and the Ponemon Institute earlier this year found that on average, the global total cost of a data breach increased from $3.52m to $3.79m within the last year. The average cost paid for each lost or stolen record with sensitive data rose as well, to $154, from $145 in 2014. In the case of TalkTalk, it is estimated their breach could cost as much at £35m.

Of course, a monetary value also tells us nothing about the inconvenience and emotional cost of a breach to the real victims of PII loss – you and me. Consumers are now much more aware both of the risks of a breach and their rights if the worst happens. For example, research by Deloitte warns that three-quarters of customers would reconsider using a company in the event of a breach.

What to do when the inevitable happens

Probably as annoying, if not worse than an actual breach, is a company who appears to have no grip on exactly what happened or how bad the breach was. Again, take TalkTalk as an example. Their high-profile breach and the subsequent media circus that followed it was made worse by their own confusion about what had happened and the lack of communication to their already worried customers. In fact, it was more than 24 hours before customers were even notified there had been a breach. What then followed was confusion about what data had been stolen, the number of accounts affected and whether the stolen data had been encrypted in the first place. TalkTalk’s CEO continues to cling onto her job and claims to currently have the support of the founder and the board. However, one has to question how long this will be the case, particularly once the true implications of the breach are felt through lost revenue and lack of customer support.

The risk to data extends further than just a cyber-attack

Organisations need to consider the complete lifecycle of the data they own and manage, therefore understanding where the vulnerabilities lie. This could, of course, be an external cyber-attack orchestrated by a third party intent on accessing and profiting from sensitive data. However, it could also be an inexperienced employee sending highly sensitive information in a clear text email to the wrong recipient, as highlighted by the recent email breach at the North Carolina DHHS.

As research shows, often the biggest risk to any business is human error.

So what does a CSO, CTO or CEO make of this? In time I think we will reflect on these high-profile breaches and realise that they signalled a gear change in data security. At an exec / board-level, suddenly focus and – more importantly – budget are being allocated to better understand all aspects of data security across a business. No longer will complacency rule, because everyone knows that in all likelihood at some point they will be forced the answer the question:

“You had one job: Secure the data. What happened?”

If this results in greater information assurance, more vigorously tested security measures and processes, then it has to be a positive for our data and our confidence as consumers in the market.

Underpinning Public Sector reform with smart and secure communication

2015-11-25T11:08:00.000+00:00

The major spending reviews of the last eight years have put the Public Sector under unprecedented pressure to preserve high levels of citizen service and support, whilst battling reductions in budget and staff resources. This situation is not set to change any time soon, with George Osborne today announcing further spending cuts for this parliament.

Alongside this, the Public Sector has also been challenged with transforming the way it delivers services, moving away from a traditional ‘vending machine’ approach towards one based on insight, intelligence and early intervention.

So, how can public sector workers face these challenges and, as seems to be their common rhetoric, do more with less?

Delivering the new vision for public services

Let’s take a (simplified) example of child suffering from recurrent chest infections, probably linked to damp living conditions. In a traditional, fragmented system it is harder for a GP or health worker to make a meaningful change to the child. The correct medical intervention is to tackle the infection, however this does not resolve the underlying cause.

The new vision for public services calls for a more coherent and integrated approach to service delivery that tries to get to the root of the problem. Integrated networks of organisations and individuals able to work together seamlessly are key to this.

However as many areas are finding, this is easier said than done. What’s clear is that these new place-based models cannot work if the information flows needed to support them are stagnant and fractured.

This, therefore, puts the need for intuitive and easy-to-use communication solutions at the heart of public service delivery, bringing together professionals from across health, education, blue light, local authorities, and increasingly third and private sector organisations. What’s more, information security must be built into this from the start, meaning citizens’ personal data – be that name, contact information, health details, etc – can only be accessed by approved individuals.

As the public sector is increasingly asked to tailor service delivery to meet individual’s unique needs, it will inevitably require secure communication solutions that can support this level of flexibility, while also providing sophisticated information security, and truly delivering cost and efficiency benefits.

How can schools share sensitive pupil data securely?

2015-07-07T11:25:00.002+01:00

Schools are expected to process and share increasing amounts of information about pupils – from exam results being sent to governing bodies, to information about ethnicity, special educational needs and medical conditions being shared with approved organisations such as local authorities, and health and social care providers. This is necessary to ensure that not only are curriculum standards being met but that schools are providing holistic care for the pupils in their charge.

Yet schools need to be aware of the types of data they are sharing – and how to do this securely.

Most of the information shared is personal data, as it includes of names, gender and dates of birth. However, sensitive personal data, including ethnicity, physical and mental health, sexuality, and criminal records, can also be shared with these external organisations. Therefore, it is essential that schools ensure the correct technical steps are being taken in order to protect this information as it leaves their institutions.

Sharing pupils’ data outside of schools

Despite the sensitive nature of this data, a concerning number of schools still continue to utilise unsecure mechanisms for sharing this information. Data exchanged via plaintext emails, fax and even post could not only compromise children’s privacy but also expose institutions to fines up to £500,000 by the Information Commissioner’s Office (ICO) if a data breach takes place.

To resolve this issue, in ‘Inspecting e-safety’, Ofsted has declared that it is inadequate practice to send pupils’ information without using encryption technology to protect this highly sensitive data. In addition, according to the ICO, email and file encryption solutions certified via CESG’s CPA scheme are best suited to meet the appropriate security levels required by schools, as well as help them remain DPA compliant.

Top tips for secure pupil data exchange

In order to protect pupils’ data that is shared over the internet, schools need not only implement risk management policies and procedures (such as staff training and / or the shredding of all confidential paper waste) but also ensure appropriate technical measures (such as encryption software) are put in place, including:

Email and file encryption

Mechanisms for secure electronic transfer vary widely, however it is important that they offer robust encryption, sophisticated functionality and ease of use – all without affecting existing work processes and infrastructure. In practice, this looks like:

Capabilities that integrate seamlessly with existing email clients, such as Microsoft Outlook, so school staff don’t need to log into separate systems to send emails and files securely
Ability to provide real-time access control over encrypted emails and file attachments, as well as time-based access restrictions, to reduce the impact of sending information in error and / or third parties mishandling data
Embracing cloud technology securely. As an increasing number of schools move their systems to the cloud via Office 365 Education and Google Apps, they need to provide the highest level of assurance around who can access this data both in transit and when stored in users’ mailboxes
Easy for recipients to use. Uptake of any encryption solution depends on recipients being able to not only understand its necessity but actually be able to intuitively use it

Secure web form

While email and file encryption are useful when schools need to share sensitive information externally, a secure web form provide an alternative mechanism for securing pupils’ data flowing back into the network. In particular, this can be of importance, when parents need to provide information, including scans of passport, when pupils join a new school. Some of the key advantages of a secure web form include:

Security: Providing third parties with an encrypted solution to use means that pupils’ sensitive data is always awarded the correct level of information assurance
Simplification and improved efficiency: Web forms provide a single point of contact for numerous third parties and can be integrated internally to populate existing systems and workflows, reducing the admin time schools need to spend simply processing incoming data
Cost-effectiveness: A secure web form can replace the need to send personal data and any other information by post or couriers

Bank of England bans ‘autocomplete’ – but is this really the best way forward?

2015-06-18T09:48:00.001+01:00

We’ve all done it. Hit ‘Send’ and suddenly realised you cc’d in Dave from Marketing instead of Dave from HR, felt that immediate sickening feeling and realised at best you’ve made yourself look a bit foolish. At worst – and likely what we all haven’t done – you’ve managed to send highly confidential information about Britain’s potential exit of the EU (or, ‘Brexit) to a Guardian journalist.

Unfortunately, that’s what happened to the Bank of England’s Head of Press last month. Not only did the email include details about research into the financial implications of Brexit, termed ‘Project Bookend’, it ironically also included instructions on how to fend off enquiries about this top-secret activity.

In an arguably knee-jerk reaction, the BoE have since announced the disabling of ‘autocomplete’ functionality for their email platform – meaning employees will need to repeatedly type individual email addresses every time they send an email.

But is this really the right course of action to take?

In some ways, it is encouraging to see the BoE taking information security seriously. Data protection is relevant for all organisations – whether you’re handling traditionally recognised ‘personally identifiable information’ or, as in this case, commercially sensitive data and intellectual property.

However, it is likely that turning off autocomplete is going to meet with a lot of frustration amongst BoE employees. Not only will it be a time-consuming process for staff to laboriously type every single address for every single email sent, just imagine the bounce rate (and therefore repeated processes) for typos! Plus, this solution won’t actually provide any control over the email addresses BoE employees type in.

Frustratingly for them, the technology exists that would allow the BoE to have the best of both worlds – business convenience and data protection. It is mystifying why they haven’t instead implemented smart technology that could control who confidential information is sent to, and accessed by, and what they can do with it. Data protection doesn’t need to take us back into the Dark Ages of Technology – organisations just need to be aware of what information security solutions are already available.

The future of encryption depends on giving customers choice, flexibility and control

2015-05-28T16:54:00.001+01:00

Whether a government department or multinational enterprise, our customers face the same challenge: How do you share sensitive electronic information internally and externally while maintaining compliance, security and control? For organizations working in highly regulated sectors, including government, financial and insurance services, and private healthcare (where the sensitivity of data is of particular importance), this challenge sits high on the agenda.

A broad platform

Egress Software Technologies provides hosted and on-premises encryption services, designed to secure all forms of electronic information and delivered to customers in the public and private sectors using a single platform: Egress Switch. The award-winning Switch portfolio of products includes Secure Email, Secure File Transfer, Secure Web Form, and the latest online collaboration offering, Secure Workspace.

Increasingly we need to be able to offer our customers a truly flexible and scalable, cloud-based, on-premises or hybrid solution that caters to a variety of complex data-sharing and infrastructure needs.

A scalable platform

We have utilized the Azure-hosted platform to help customers encrypt data and files using a combination of services designed to seamlessly integrate with on-premises Exchange or hosted Office 365 environments, enabling end users to share confidential information securely using desktop, mobile, or web based applications. Azure lets us quickly and easily deliver our award-winning encryption services so that end users can benefit from enhanced information security when sharing sensitive data.

Encryption 101: The Vigenère cipher

2015-04-21T15:28:00.000+01:00

The Vigenère cipher (as it is currently known) was created by Blaise de Vigenère in 1585. However, it is worth mentioning that the cipher has undergone many reinventions over time and its original method is actually believed to have been created by Giovan Battista Bellaso, who first mentioned it in his book ‘La cifra del. Sig. Giovan Battista Bellaso’ in 1553.

A solution to frequency analysis

As you might already know, particularly if you’ve read any of the previous entries in the Encryption 101 series, most of the ciphers we’ve looked at up until now were vulnerable to the cryptanalysis method known as ‘letter frequency analysis’.

The Vigenère cipher, however, is a polyalphabetic substitution cipher and offers some defence against letter frequency analysis. In essence, while the functions of this cipher are very similar to that of the monoalphabetic substitution ciphers that we’ve looked at before, rather than using a single alphabet when encrypting information, we make use of multiple alphabets – 26 of them to be precise!

Vigenère square

Creating the square is fairly simple. On the top line, write out the alphabet going from A to Z. On the next line, move every letter one space to the left, wrapping any over flow round to the end of the row. Repeat this for the remaining letters until you have the square shown below.

Encryption

In order to encrypt the message, first of all a key has to be agreed upon. In this example, we’ll be using ‘DRAX’. Next, the key is repeated until it is the same length as the length of the message being encrypted – for example:

Key: DRAX

Plaintext: Nothing goes over my head. My reflexes are too fast, I would catch it.

Adjusted Key: DRAX DRAXDRAXDRAXDRAXDRAXDRAXDRAXDRAXDRAXDRAXDRAXDRAXDR

Ciphertext: Qfteleg drvs lyvr jb yexg. Dy ohwlbavs xuv tlr wapw, Z wlxcd zdkce lk.

To encrypt, we now take the first letter of the plaintext and pair it up with the first letter of the key string. One is placed along the top row and one is placed in the first column. The letter at the point where they intersect will be the first letter of the ciphertext, in this case:

Decryption

To decrypt a piece of ciphertext, we follow much the same method used to encrypt the message. We place the first letter of the key in either the top row or the first column. Then, we follow the line along until we hit the first letter of the ciphertext: ‘Q’. The letter at the top of the column or row where the intersection occurs is the first letter of the recovered plaintext.

Weaknesses

By using multiple different alphabets, we’re now slowly gaining some defence against letter frequency analysis since the letter ‘N’ won’t always encrypt to the letter ‘Q’. However, that’s not to say the cipher is bulletproof.

The main weakness of this cipher comes down to the length of the key used. Since we used a four letter key in our example, we had to repeat the key multiple times to ensure it matched the length of our message (54 letters). This use of a repeating key will inevitably result in some patterns occurring in our resultant ciphertext and using these patterns, the likely length of the key can eventually be reasoned.

One such method that can be used when trying to deduce the length of the key is known as the ‘Index of coincidence’. Like letter frequency analysis, it is focused on looking at ‘normal’ patterns that occur in texts and how the ciphertext deviates from these patterns.

Once we know the key length, the ciphertext can be rearranged so that it is written in a series of columns, as shown below. We then know that each column was encrypted using the same key – in other words, a Caesar cipher was used. With this information, our old friend frequency analysis can be used to help reconstruct the key.

Even with this weakness, however, the use of multiple alphabets proved an effectual method at protecting information for over two centuries, earning the cypher the name of ‘Le Chiffre Undechiffrable’ or in English: ‘The Unbreakable Cipher’. It was finally defeated in 1854 by an English cryptographer, Charles Babbage – who required a mix of cunning, intuition and amazing cryptographic genius to finally break the unbreakable cipher.

A glimpse of perfection

The Vigenère cipher also gave us perhaps our first glimpse of ‘perfect’ cryptography – that is to say, the information is ‘theoretically secure’. If we had a 250 character long message with a 250 character long random key, then there would be no clues as to what the ciphertext is or what key was used. Perhaps even more incredible is this 250 character ciphertext can be decrypted into any 250 character plaintext message, using any 250 character key – so how do we know which message was the real message?!

This ‘theoretically secure’ idea will be explored more when we take a look at the one-time pad cipher, which has seen use in World War II and in an early version of the ‘Red Phone’ that connected offices of the President of the United States to the President of the Soviet Union.

Securing shared services

2015-03-20T15:21:00.000+00:00

It comes as no surprise that two of the biggest drivers towards multi-agency working in the Public Sector are cost and efficiency. In efforts to lower spend, increasing numbers of public bodies and organisations are working together to meet combined goals and doing so using digital solutions.

Yet a major stumbling block exists in the form of ‘closed community’ accredited networks and supported mail systems – such as the PSN, GCSX and CJSM. Although individually they can facilitate secure communication between organisations of the same type or function – who therefore sit within the same umbrella networks and systems – they often fail to do so between different government organisations, as well as with private and third sector partners.

This issue of information security and assurance risks undermining multi-agency working and, ultimately, the evolution of service delivery.

You can only collaborate with confidence if you can share information securely

The challenge: How can organisations create secure environments to work together outside of trusted networks?

Firstly, you need to find a suitable solution that will meet the project’s aims while also securely bridging the divided between existing government supported systems and the organisations unable to access them. Procuring a suitable COTS solution will offer both cost and efficiency savings, and catalogues such as G-Cloud can often help to narrow down the search, with offerings already approved for use within the Public Sector.

Secondly, the solution must offer the appropriate levels of information security and data protection. Again, government initiatives such as CESG’s Commercial Product Assurance (CPA) and Pan Government Accreditation (PGA) can aid the search for suitable solutions. These provide assurance that the solution has been independently certified by the UK National Technical Authority for Information Assurance, is fit for purpose, and is capable of protecting your organisation and the data you share from external threats. PGA in particular is offered to manage combined risks and provide end-to-end assurance when different Public Sector organisations work together to deliver shared services.

Finally, the solution must be simple to use. If the aim of multi-agency working is to improve efficiency, then the solution must not take more time to use than old ways of working. Moreover, a recent ICO FOI demonstrated that 93% of data breaches were caused by human error. Solutions have to make data protection accessible to all while also offering comprehensive protection and control to mitigate the risk of a data breach.

Ultimately, information security should not, and does not need to, hinder the delivery of effective and efficient multi-agency projects. In fact, by sharing data securely, public sector organisations can enhance their services to provide citizens with greater levels of information assurance and thus increased confidence in the services being delivered.

Encryption 101: Substitution ciphers

2014-09-05T15:54:00.000+01:00

Jack Hammond
Junior Developer
Egress Software Technologies Ltd.

So far in this blog series, we’ve mainly focused on transposition ciphers, which encrypt their messages by shifting the letters around, as in the Caesar and Atbash ciphers, or by ‘jumbling them up’ in some way that makes discerning their true meaning difficult, à la the Columnar Transposition Cipher.

The simple substitution cipher

The basic idea of a substitution cipher is a simple one: take one letter in your message, let’s say ‘A’, and replace it with a different letter, such as ‘E’.

Sounds familiar?

Both the Atbash and Caesar ciphers used this basic principle, however they both have one weakness: predictability. Figure out how a handful of letters had been encrypted and you can pretty much break the entire message. (Learn more about how these ciphers work in my previous post: Encryption 101: Back to basics.)

The substitution cipher, however, takes this idea to the next level and provides a ‘random’ alphabet to encrypt the message. In other words, each letter is encrypted with its own key.

The table below displays an alphabet that I chose at random, simply placing letters in different locations until it was complete.

Plaintext alphabet

Ciphertext alphabet

This new alphabet makes figuring out the relationship between the plaintext and the ciphertext a lot harder, as the confusion that the cipher provides has been increased. The diffusion, however, is still fairly low – changing one letter in the plaintext will still only change one letter in the ciptertext – but this won’t really increase in complexity until we start looking at more modern examples.

However, while the Atbash cipher had just one key and the Caesar cipher had 25, the substitution cipher has 26 (factorial) unique keys. This works out to about 403,291,461,126,605,635,584,000,000 different ways to write the alphabet!

As you can see, the number of keys increases rapidly the more the ciphers advance.

More keys = More secure?

While one might think that having a vast number of keys to choose from is a good security metric – after all, what attacker is going to sit there and write out every possible permutation of the alphabet, run your ciphertext through it and see whether they can break the encryption – substitution ciphers still suffer the same inherit weakness as the transposition ciphers before them: letter frequency analysis.(I discussed this topic in further detail when looking at weaknesses in the Caesar cipher.)

Defeating letter frequency analysis

Letter frequency analysis has so far proven to be a very powerful cryptanalysis method, so you would be forgiven for thinking that eventually all ciphers would be cracked by it.

As part of this Encryption 101 series, however, we will move onto the Vigenere Cipher, Substitution-Permutation Networks, which start to try to increase the diffusion property of the encryption process to make the relationship between plaintext and ciphertext. We’ll also take a look at the One Time Pad cipher, which some argue is the only form of ‘perfect’ cryptography we’ve ever created – however nothing is perfect in the world of cryptography and even this ‘perfect’ cipher has its drawbacks.

Your turn to crack the code (try these at your desk!)

For these examples, we’ll be using the substituted alphabet that we create earlier in the blog to encrypt and decrypt some messages. You’ll also be asked to carry out a letter frequency analysis on a piece of ciphertext to see whether you can uncover the ‘cipherbet’ used to encrypt it.

Using the cipherbet, encrypt the following phrase:

‘You either die a hero, or live long enough to see yourself become the villain’
Answer: gnw pjxvpk ljp d vpkn, nk ojep onrs prnwsv xn ipp gnwkipof hpcnbp xvp ejoodjr

Using the cipherbet, recover the plaintext message from the ciphertext. The spaces between the words has been removed to make it a little harder:

‘hpcdwip vp'i xvp vpkn snxvdb lpipkepi, hwx rnx xvp nrp jx rppli kjsvx rnq’
Answer: Because he's the hero Gotham deserves, but not the one it needs right now

Now for something a little harder. Using the website and ciphertext below, see whether by using letter frequency analysis you can recover not only the plaintext message but also the cipherbet used to encrypt it:

www.cryptoclub.org/tools/cracksub_topframe.php
‘yzeypq cl psmwqlzr! mizlqq psm fyi cl cyuayi. ugli yzeypq cl cyuayi!’
The answer to this last problem will be supplied in the next blog – good luck!

Practical steps you should be taking to unleash the full benefits of Cloud Computing

2014-08-15T14:29:00.000+01:00

Neil Larkins
Chief Operating Officer
Egress Software Technologies Ltd.

The last 12 months have seen have a tangible change in perception around the security of Cloud-based communication solutions. With Edward Snowden revealing the extent of international Government surveillance, in addition to data losses and breaches earning a higher level of media coverage, there has been an understandable hesitancy about procuring Cloud-based communication solutions.

However in my view, so long as the correct approach is taken, the Cloud can provide the same, if not a greater, level of security as on-premise offerings, with the added advantages of cost reductions, reduced management overhead and increased flexibility – an approach that I presented at Europe’s largest information security event, Infosecurity Europe 2014.

Manage risk with 'smart encryption'

‘Data residency’ – the concept of where your data is stored and processed, and who consequently has jurisdiction over it – has become one of the go-to reasons for avoiding the Cloud. However, a well-informed approach to data sharing can mitigate this risk.

Before undertaking any contractual agreement with a Cloud-based service provider, ask yourself the following questions:

Does your service provider have access to your servers and data?
Do they have the appropriate service accreditations and procedures in place to look after your data?
Where will your data live and will it be replicated to other geographical locations?
What are your options should you want to change providers?

If concerned about any of the above, you should probably question whether you’re using the right service provider!

In addition, by adopting ‘smart encryption’ to data that you expose to any third party provider and by remaining in control of the associated keys, you not only ensure the information is protected but also that you can track and audit it wherever it resides.

Extending the parameters of your control

The systems in place to share data securely must not only ensure legitimate distribution but also actively promote user control.

Essentially, it comes down to identifying the extent to which an end-user can be trusted (based on key factors such as the domain, browser, device and IP range being used to access the information) and being able to apply different access controls to reflect this.

For example, when sharing confidential information with a ‘trusted’ business partner – who is accessing it from an authorised domain through a compliant browser or application on a federated secure network with a verified IP range – then it would be possible to grant this particular end-user ‘full access’ (meaning they can, for example, download and print the information). Alternatively, if you have an ‘untrusted’ business partner, with whom you don’t have a federated trust relationship, then it is possible to only grant them ‘restricted access’, enabling them to simply view the information in a hosted environment.

If the information is subsequently forwarded to an unknown and ‘untrusted’ third party – or even if a known recipient is attempting to access information using a non-compliant browser or device or from an unknown location – it is possible to deny access altogether.

Embrace the Cloud - just secure it too!

At Egress, we like to call this thought-out method 'taking a risk-managed approach' - recognising the need to share sensitive information electronically, and consequently applying all suitable and available mechanisms to ensure the information is protected. In doing so, the benefits of cloud computing need not be sacrificed in the name of data protection.

The fall of TrueCrypt: Reminding us all to choose our encryption solutions carefully

2014-08-06T09:47:00.002+01:00

Daniel Hoy
UK Marketing Manager
Egress Software Technologies Ltd.

Much has been written about the motives behind the recent shutdown of open source endpoint and file encryption product TrueCrypt. Whether you believe some of the conspiracy theories or the reason given on the TrueCrypt website (which puts it down to Microsoft ending support for Windows XP) there is a lesson in this story for us all.

Fans of TrueCrypt have for many years used it as an example of how open source technology can be effectively used to solve business and personal data privacy challenges. Used to encrypt data at the endpoint, in addition to file attachments, TrueCrypt was relied on by thousands of users to protect their highly sensitive information.

However, this sudden exit from the market, leaving organisations and individuals fearful that their data may now be compromised, highlights the very real risk behind selecting open source technology to solve information security requirements. On one hand the software may be free to use, but on the other, is this cost saving worth placing data privacy at risk?

Protecting sensitive data isn’t something that should be taken lightly, and careful monitoring of those individuals that contribute to the development of encryption software using best practise standards plays an essential part when delivering information assurance. Consequently when procuring a new technical solution, particularly data security or encryption services, it is imperative for organisations to choose a solution provider that offers both openly validated technology, as well as the reliability, long-term technical support and SLAs offered by a stable commercial business.

Why does Egress’ ISO/IEC 27001:2013 certification matter?

2014-07-30T13:52:00.000+01:00

Richard Green
Senior Project Manager
Egress Software Technologies Ltd.

ISO27001 certification provides organisations with a way to demonstrate the strength of their security practices to customers, prospects and partners – however, although a company may already be working to the correct standards, actually undertaking formal certification requires a considerable commitment of man hours across the business. Consequently, organisations need to get the timing right when submitting for formal certification: undertake this too lightly and you may very well end up having to repeat the process further down the line.

At Egress, we continually seek to benchmark our technologies and processes against the highest levels of certification and accreditation. With the publication of the updated ISO standard in September 2013, we decided the time was right to formally certify ourselves against a standard we had informally been working to for some time.

This meant we needed to prove that we manage key business risks effectively, and ensure that our existing policies and procedures were moved into a robust, international standard called an information security management system (ISMS). Our first step was to define the scope of our ISMS, before fleshing out our Security Policy and undertaking an extensive risk assessment across all key Egress business areas, culminating in a score that represented our current risk level.

What does ISO/IEC 2700:2013 involve?

Stepping up from the old 2005 standard, and among other improvements, the 2013 one puts more emphasis on measuring and evaluating how well your ISMS is performing. As we were documenting our ISMS afresh, we tackled this from the ground up to create a tailor-made management system.

By December 2013, we’d planned our ISMS design, assessed our information security risks and had started to align appropriate controls against them. Moving into 2014, we started to formally implement and operate these as company policies and processes, together with the system controls they applied to, such as Access Control, Incident Management, Business Continuity, Physical Security, HR and Technical Procedures – everything you would imagine you’d need to support an effective and efficient management system.

Throughout the process, these controls were reviewed and constantly evaluated to ensure they were fit for purpose. In reality, and despite us fully discussing our requirements and agreeing pragmatic resolutions to our business challenges, a few processes needed some fine tuning to make them work as well as we had originally anticipated. Most problem areas were identified internally, however BSI (our external auditors) highlighted a dwindling action list as we progressed through our pre-certification visit, Stage 1 and Stage 2 Audits.

What does this mean for Egress?

Although we had been working to the ISO standard for some time, since our formal ISO 27001 certification in June, we’ve already noticed how this creates a market differentiation due to prestige, image and external goodwill. Being ISO certified has also allowed us to meet contractual requirements more easily, as well as being a positive selling point for additional business. Internally, it’s given us an assurance of a set standard of information security throughout Egress, demonstrating to staff that we have total buy-in for this from the Egress Management Team.

ISO 27001 is also the foundation block for other accreditations and is now providing key evidence in our Pan Government Accreditation (PGA \ G-Cloud).

Even though we’re now formally certified, Egress will still have an external ‘continual assessment visit’ every year and will be audited for recertification every third year. By allowing independent reviews, Egress will provide ongoing assurance of our information security practices to both customers and partners.

In conclusion

ISO 27001 provides a holistic, risk-based approach to information security and compliance, providing confidence for clients, partners and internal staff. By undertaking formal certification of this new standard, Egress has successfully demonstrated its commitment to not only providing market-leading technology, but doing so by working efficiently and securely to ensure the service we provide to customers and partners is of the same equally high standard. Our ISMS is now fulfilling its role very effectively, such that it’s now part of Egress’ everyday business, helping us to identify and manage risks to key Egress information and systems assets in a cycle of continual improvement, raising the security awareness of all staff, together with monthly ISMS management meetings feeding into our existing management sessions.

This is the best way ISO 27001 can demonstrate its value to any business!

New ‘snooping law’ is another reminder to keep our data secure

2014-07-14T16:04:00.001+01:00

Daniel Hoy
UK Marketing Manager
Egress Software Technologies Ltd.

Last week’s passing of an emergency law to ensure that the UK police and security services can continue to access email and phone data relating to British citizens for up to 12 months is yet another reminder of the need to secure our most sensitive information (http://www.bbc.co.uk/news/uk-politics-28237111and http://www.lbc.co.uk/new-snooping-law-needed-to-keep-uk-safe-93547).

This move represents an attempt by the UK Government to protect existing powers after the European Court of Justice ruled in April that existing legislation was unlawful and breached human rights. Prime Minister David Cameron defended the decision, stating the law was intended to protect citizens and the state from terrorist attack.

Whether you agree with granting governments access to personal data stored by service providers in the name of national security or not, this story serves as another reminder that sensitive information handled or stored by external third parties needs to be secured appropriately.

After all, if governments can access / intercept data and emails, then so can other less credible entities and organisations!

This is a topic we have covered regularly on the Egress blog and in our news pages:

Snowden: What have we learnt?

The Year of Encryption? What 2014 will mean for data security

Whatis the government doing to protect my data? Recent ICO fine is a wake-up call for us all

The ‘Snowden effect’ shakes industry confidence in Cloud-based communication solutions and will continue to influence future IT procurement, survey claims

At Egress, we see this type of news coverage as a real positive for the data security industry.

Regardless of the politics or the perceived terrorist threat, it demonstrates yet again that organisations and individuals need to question the underlying security of their data and apply greater due diligence when procuring a new system via a third party service provider – a point supported by some recent market research.

Product launch, presentation and prizes: The highs of Infosecurity Europe 2014

2014-05-14T15:53:00.000+01:00

Rebecca Bailey
Senior PR & Marketing Executive
Egress Software Technologies Ltd.

Egress Software Technologies enjoyed a busy three days at Infosecurity Europe 2014 earlier this month. Whether interested in the launch of our latest product, Egress Switch Secure Workspace; discussing current issues in data security with the Egress team; or trying their hand at the Egress Buzz Wire Challenge, our stand proved incredibly popular with delegates.

In addition, Egress COO Neil Larkins presented to a packed audience in the Technical Theatre during Day Two, examining ‘Who’s really accessing your data? Building information assurance in a cloud-facing world’. Such discussions also continued on the stand, where delegates were invited to take part in the ‘2014: The Year or Encryption’ market survey – the results of which will be published in the coming days.

Day One: Launching Switch Secure Workspace

Arriving for the final Infosecurity Europe event to be held at Earls Court, the Egress team stood out against the crowd in our unmistakeable orange tops. Moreover, based on the Egress Trust Network, our unique community-based licensing model, the fantastic design of the Egress stand provided a great talking point for delegates.

Forming the focus for Day One, the launch of Secure Workspace responded directly to the market’s need for a secure Cloud-based online collaboration platform. The latest pillar of functionality of the award-winningEgress Switch encryption platform, this Cloud-based service offers end-to-end secure collaboration by encrypting information at rest and in transit. For the first time, Infosec14 delegates were given the opportunity to demo Switch Secure Workspace, visiting the Egress stand to examine this next generation of secure online collaboration.

The evening, meanwhile, gave the Egress team chance to rest their tired legs in Drayton Arms, where we hosted a drinks reception for attending clients.

Day Two: Building information assurance in the Year of Encryption

Refreshed and ready for Day Two, we returned to an even busier stand than the day before. While Switch demos continued and the Egress team caught up with more delegates, COO Neil Larkins presented to a full Technical Theatre. With standing room only, Neil challenged his audience to examine how they build information assurance when using Cloud services to share sensitive information securely.

The recent media coverage of high-profile data breaches and the impact of Edward Snowden’s revelations regarding the scale of international data surveillance, a topic we covered here, have raised concerns about the security of shared data in the Cloud. Neil encouraged delegates to examine the issues of data residency, risks posed by service providers, how to ensure controlled release of sensitive data and gaining identity assurance over communities of third party recipients.

Inciting debate amongst attendees, many of these topical discussions continued on the Egress exhibition stand throughout the event and tied in well with the market survey being conducted by members of the Egress team. Entitled ‘2014: The Year of Encryption’, the survey gave delegates the chance to offer their opinions on a range of current subjects, including whether Snowden’s revelations have increased their awareness of data protection, how secure they subsequently perceive Cloud solutions to be, and the upcoming reforms to the European Data Protection Act. Look out for the results of the survey on the Egress website in the coming days.

Day Three: Going out with a buzz

Back by popular demand, the Egress Buzz Wire Challenge ran throughout Infosec14, with a Samsung Galaxy Tab 3 being awarded for the fastest lap time each day. This year saw the 2013 record (11.9s set at NISC2013) repeatedly broken and we’re delighted to announce our three winners, alongside their times:

Day One: Phil Yeo – 12.5s

Day Two: Davinder Hunjan – 10.45s

Day Three: Imogen Cummings – 10.0s

Further congratulations go to Allan Sneddon, who took part in the @EgressSwitchTwitter competition to win a Kindle Fire HD.

Packed with demos and delegates, Infosec14 provided Egress with a fantastic opportunity to not only discuss our latest offerings and developments, but to also listen to attendees views and opinions about the continual evolutions of the data security market - and we look forward to next year's event, when we will be able to reflect on whether 2014 has truly proven to be the Year of Encryption.

Day One: Phil Yeo - 12.6s

Day Two: Davinder Hunjan - 10.45s

Day Three: Imogen Cummings - 10.0s

The Mail app bug: How can you protect documents stored on iOS 7 devices?

2014-05-07T15:04:00.001+01:00

Andy Whittlestone
Senior Software Developer
Egress Software Technologies Ltd.

Late last month, Andreas Kurtz, of NESCO Security Labs, publishedclaims on his personal blog that attachments in the Mail app have not been encrypted at rest in iOS 7, as Apple assures user they are, since at least version 7.0.4 and including the current version, 7.1.1.

Kurtz discovered the bug by restoring an iPhone 4 to iOS 7.1 and 7.1.1, and setting up an IMAP email account. After performing certain tests, Kurtz found that all attachments were accessible without any encryption, with the same proving true for iPhone 5s and iPad 2 devices.

While Apple has responded to the claims – with a spokeswoman declaring: “We’re aware of the issue and are working on a fix which we will deliver in a future software update.” – they haven’t provided a timescale for when a fix will be available.

Protect your email attachments on iOS 7 devices

With mobile devices being used increasingly more often to send and receive personal and commercially sensitive documentation, it is imperative that this information is protected.

Encrypting email attachments as ‘.switch’ files, the Egress Switch Secure Email app secures documents when stored on iOS 7 devices. These files can only be accessed using the correct credentials and the Secure Email app, which also gives users the ability to deny unauthorised access attempts and, if required, revoke access to sent information.

Consequently, while Apple works to resolve the Mail app bug, Switch will continue to enable users to share confidential information with confidence.

Cloud-based collaboration: It's better together

2014-04-28T10:35:00.003+01:00

Rebecca Bailey
Senior PR & Marketing Executive
Egress Software Technologies Ltd.

Aside from data security concerns, a topic we recently examined here, online (Cloud-based) collaboration sites can also present IT management and integration issues. For many, such sites are seen as separate from traditional email and file transfer systems, meaning they are procured, developed and managed differently, with solutions kept in insolation from one another.

By taking this approach, however, organisations risk adding layers of complexity to their IT infrastructure – resulting in data silos, additional ongoing management overhead and low end-user take up.

Systems in silo

In the absence of a centrally managed solution, end-users often select collaboration sites on an ad-hoc basis, away from existing solutions for email and file transfer. Consequently, IT staff and senior managers end up with another system to manage and reduced visibility over what information is being shared where and with whom, both inside and outside of their organisation’s network boundary. Similarly, managing multiple sets of credentials for different collaboration, email and file transfer systems can create problems for users, who may resort to using other, less secure file sharing mechanisms as an answer to this. Not only does this heighten the risk of data breaches but it also impacts efficiency – one of the very reasons these services are used in the first place.

Moreover, even when solutions are procured centrally, if they don’t integrate with existing infrastructure, organisations will continue to risk added complexity and, consequently, the cost-effectiveness of their chosen solution.

The benefits of an integrated approach to online collaboration

To simplify this process and increase control over the information that employees are sharing with internal peers and external third parties, an integrated approach to data management must be taken.

This potentially involves procuring online collaboration solutions as part of a broad information sharing platform that also includes email and file transfer functionality. Moreover, it is also important that collaboration tools integrate well with an organisations’ existing IT infrastructure, such as archive and document management systems, to improve workflow and business processes.

Cloud solutions are championed for increasing efficiency and reducing costs – however a disjointed approach to procuring such platforms risks jeopardising these benefits.

Cloud-based collaboration: Golden goose or white elephant?

2014-04-24T14:10:00.001+01:00

Rebecca Bailey
Senior PR & Marketing Executive
Egress Software Technologies Ltd.

Have you ever stopped to consider the sensitivity and potential value of the information you disclose using one of the many widely available, online collaboration and file sharing websites?

The go-to solution for multiple email threads and file transfers, as well as for improved project and document management between co-workers and external third parties, collaboration sites have grown in prominence within business. Offering the ability to edit in real time and check in / check out documents, these sites seem to solve many business challenges, such as efficiency, cost overheads, and sharing information from private networks without numerous emails and file transfers.

While these sites all claim to have invested heavily in security and authentication mechanisms designed to keep user data safe, recent stories in the press have caused many to question this:

www.bbc.co.uk/news/technology-26969629

www.computerweekly.com/news/2240160676/Unsafe-password-practices-cause-Dropbox-spam-scare

www.computerweekly.com/news/2240204366/Dropbox-can-be-hacked-say-security-researchers

Understanding the security threats

Typically, security breaches can be routed back to one of the following causes –or in some cases, both.

Access control

By their very nature, collaboration platforms have been designed with ease of access in mind. Internal and external access to documents and information enables users to share content and work collectively on files, which in turn offers substantial efficiency and cost saving potential. However, if insufficient access control mechanisms are put in place, the risks to data protection can be significant.

In many cases, once a user has gone through the initial authentication process steps, there is nothing to stop them from sharing personal or commercially sensitive data with an extended group of external third parties. Additionally, with no auditing or tracking capabilities, in many cases an organisation’s IT team will have little to no visibility over what information has left the corporate network.

This reduced control also extends to the types of devices and applications that are used to access the data. With links being forwarded to different email addresses, for instance, sensitive information can be downloaded onto personal laptops. This is not only a concern due to potential malware or viruses existing on these devices, but also means that individuals can continue to access certain information after they have left a project or, even, the company.

The hacker / cyber security threat

The recent disclosure of the Heartbleed bug and the ease with which hackers have bypassed the security / authentication mechanisms of many websites that were previously perceived as secure raises a more fundamental security concern. As Dropbox found out when they were hacked two years ago, the consequences of unpermitted users gaining access to unencrypted data can be disastrous. An attentive reading of the security credential webpages of many online collaboration service providers shows that although they may have taken measures to protect data in transit using TLS, very few have taken steps to encrypt information at rest.

A secure approach to online collaboration

These factors pose significant threats to data security – however, they shouldn’t be used as excuses to avoid collaboration through Cloud-based service providers. Organisations should be able to take advantage of the benefits offered by online collaboration sites, such as time and cost efficiencies, without compromising their data security.

Investment must be made in suitably secure platforms. Sensitive data needs to be encrypted both in transit and at rest, and appropriate access control mechanisms need to be implemented so that organisations and central administrators have full visibility and control over who accesses information – including the ability to restrict the access rights of those no longer relevant to the project, such as ex-employees. Online collaboration shouldn't be an issue that makes senior management and IT departments uncomfortable. The benefits of Cloud services and data protection shouldn't be mutually exclusive.

Snowden: What have we learnt?

2014-03-21T14:30:00.000+00:00

“There can be no faith in government if our highest offices are excused from scrutiny - they should be setting the example of transparency.” – Edward Snowden, 2013.

The topic of data security and privacy has captured plenty of headlines and column inches since Edward Snowden’s revelations regarding the NSA collecting large-scale data on individuals – and questions have been raised about the way that we trust our governments and businesses to handle our information.

Individual privacy vs national security?

One of the main points that arose from Snowden’s revelations is the balance between individual privacy and national security. While governments need to take measures to ensure that national security is not compromised and their borders are protected, has this pursuit taken priority over the privacy rights of the individual?

The mass collection of data has raised questions, with some calling it a waste of resources and others saying it damages communication security at the expense of protecting individuals’ information.

In this current era of the internet, social sharing is now commonplace, with people using social networks to share intimate details of their everyday lives. However, this shouldn’t negate the fact that our national governments are collecting huge stores of data with no clear or intended purpose in the interests of national security. In his TED Talk, Mikko Hypponen makes an interesting point about individual privacy, stating that it should be “non-negotiable and built into all of the systems we use”. But how clear are national governments and businesses being with our information?

Transparency – clear as mud?

The bond of trust is one that is built through an exchange of honesty and openness between the individual and the entity in question. Upon reflection of Snowden’s revelations last summer, there are still challenges that governments and organisations face with the collection and storage of data.

As mentioned in a previous post, the US Patriot Act has implications for how data is stored and accessed; an issue that is also currently being debated within European Parliament. Companies such as Google and Microsoft are already taking into consideration where data is stored, with the former encrypting searches and the latter offering overseas data storage in response to NSA concerns. However, other challenges include:

The need to ensure the data about individuals that is collected and stored is kept secure and only shared with trusted people and organisations
Making sure people are trained and educated in data protection
Ensuring data is used for specific purposes only
Keeping accountability and transparency paramount

The impact of Snowden’s revelations has been far reaching, with the issues of privacy, national security and transparency ever-changing. What is important is keeping in mind the people who are affected by these issues, ensuring that they are well-protected and that their individual rights are being considered with the strictest confidence.

Encryption 101: Columnar Transposition Cipher

2014-03-14T10:11:00.001+00:00

Jack Hammond
Junior Developer
Egress Software Technologies Ltd.

As part of the Encryption 101 series, we’ve previously looked at the Caesar cipher – a simple transposition cipher that sees every letter in the plaintext shifted by a set number (otherwise known as the key). So, for example, using a key of ‘4’, the following encryption occurs:

Plaintext: We can only see a short distance ahead, but we can see plenty there that needs to be done

Ciphertext: Ai ger srpc wii e wlsvx hmwxergi elieh, fyx ai ger wii tpirxc xlivi xlex riihw xs fi hsri

Columnar transposition

This post will focus on a columnar transposition cipher – a slightly more advanced transposition cipher that produces very different results. If we take the same phrase as above and run it through a columnar transposition cipher, the ciphertext would read:

OETNAEEYTEEX ASOTHTSNRNOE NERAEWETEEBX CYHSAUNEETTN WNADCDCPTHDD ELSIEBALHASO

Right away, we can see that this looks vastly different to the previous result: if you saw these two pieces of ciphertext next to each other, you’d initially have no way of knowing that they contained an identical message.

Working with columns

As with every cipher, you first need to define a key. For this example, we’ll be using the keyword of ‘Turing’, which will define how many columns we’ll use to encrypt the message: since the keyword has six letters in it, we’ll be using six columns.

To encrypt the text, we write each letter of the keyword at the top of a column. In the next row, each letter is given a number that dictates its alphabetical position in the keyword: since ‘G’ is the first letter of the alphabet that is present in the keyword, it gets designated ‘1’; ‘I’ is given ‘2’ as it appears next; and so on. Then we simply write the text we wish to encrypt out under it, moving to a new line once we reach the end of each row. (As we are using Regular Case transposition in this example, any empty cells at the end have been padded with the letter ‘X’.)

T	U	R	I	N	G
5	6	4	2	3	1
W	E	C	A	N	O
N	L	Y	S	E	E
A	S	H	O	R	T
D	I	S	T	A	N
C	E	A	H	E	A
D	B	U	T	W	E
C	A	N	S	E	E
P	L	E	N	T	Y
T	H	E	R	E	T
H	A	T	N	E	E
D	S	T	O	B	E
D	O	N	E	X	X

Using this table, we can now create our ciphertext. Starting with the column ‘1’ (‘G’ in this case), we now read down the whole column, writing out each letter in turn, which results in:

OETNAEEYTEEX ASOTHTSNRNOE NERAEWETEEBX CYHSAUNEETTN WNADCDCPTHDD ELSIEBALHASO.

Decrypting

Now that we have an encrypted piece of text, we need to know how to recover the actual message. If you know the keyword, this process is fairly straight forward. All you do is start with the letter in the keyword that appears first in the alphabet, in this case G, and put this at the top of the first column. Then put the letter that appears next in the alphabet at the top of the second column, etc.

With that done, start writing out the ciphertext – however, whereas before we wrote across the rows, this time we write down the columns.

G	I	N	R	T	U
1	2	3	4	5	6
O	A	N	C	W	E
E	S	E	Y	N	L
T	O	R	H	A	S
N	T	A	S	D	I
A	H	E	A	C	E
E	T	W	U	D	B
E	S	E	N	C	A
Y	N	T	E	P	L
T	R	E	E	T	H
E	N	E	T	H	A
E	O	B	T	D	S
X	E	X	N	D	O

Once the columns have been written out, rearrange them so the keyword makes sense and then read the resulting text off row-by-row.

Increased complexity = Increased security?

This initially seems to be a more complex method of encryption compared to the simple transposition cipher – and therefore it surely must provide more security? The answer is both ‘yes’ and ‘no’.

When this cipher was first created, it would have of course provided more security than those that came before it. However, it still possesses one weakness that was present in earlier ciphers: namely, the letter frequency will still closely resemble that of the original plaintext, thus making the ciphertext potentially vulnerable to a frequency analysis attack.

Your turn to crack the code (try these at your desk!)

Try the following examples at your desk and see if you get the correct results. Since these might take a while to crack, there are only two this time.

Using the ‘encryption’ as a keyword, encrypt the following phrase (with ‘x’ as padding if needed):

“The obvious mathematical breakthrough would be development of an easy way to factor large prime numbers” (Bill Gates)
Answer: etbgeoyautmaoenwreottlpacrshaludtalnscrbeyomxuihdmstixvmaolnfeeohrhvftrmiakuoeaprbeeweaogb

Using ‘cryptography’ as a keyword, decrypt the following ciphertext:

oafntplnpyimrsexyedlccbegsixhhidtwfarkyleithapax
Answer: The cryptographic key was split by Diffie and Hellman

CPA certification: An exercise in trust

2014-02-20T12:28:00.001+00:00

Neil Larkins
Chief Operating Officer
Egress Software Technologies Ltd.

Last year, we put Egress Switch to the test. Or rather, we allowed CESG, the UK National Technical Authority for Information Assurance and world-renowned cryptography experts, to put Switch to the test.

CESG’s Foundation Grade CPA programme certifies commercial security products for use by government, the wider public sector and industry in lower threat environments. For government and the public sector, this means that Switch is certified for sharing IL2 and low-threat IL3 information (OFFICIAL and OFFICIAL SENSITIVE under the new Government Classification Policy) over the internet – a topic we demystified in a previous blog post. While this is great news for organisations in the public sector, independent software assurance must be a key consideration for businesses across all industries when selecting an encryption service to protect their most valuable assets.

What does CPA involve?

Only products that perform a security enforcing function are eligible for certification. Specifically, email encryption products are expected to protect the confidentiality and integrity of emails, in addition to providing the recipient with authentication over the sender. In practice, this means that we need to think about the real risks to our information and give it the right levels of protection at all the points we are responsible for it. Therefore, when faced with the challenge of sharing highly sensitive data electronically, organisations must use the most appropriate technology available to ensure safe delivery to that space whilst maintaining the integrity and protection of internal networks at all times.

CESG stipulates a detailed set of characteristics and security principles that an email encryption product should be tested against. This not only deals with how the data is encrypted, but also with interoperability with other systems and ensuring security is maintained at all times, even in the event of system crash or compromise.

CPA testing is carried out by CESG-approved Test Labs, under the supervision of GCHQ. Vendors are also involved throughout the process, on hand to provide technical assistance during the evaluation to ensure a good understanding of the product undergoing assessment. Once the evaluation is complete, CESG reviews the report, and if the assessment is successful, they award the Foundation Grade Certification. This process, however, is by no means a walk in the park, sometimes taking up to 12 months and including a complete review of the entire business and software applications.

Why does Switch’s CPA certification matter?

CESG states: “Foundation Grade certification represents a level of confidence in the security behaviours of a product, in line with commercial good practice.”

First and foremost, therefore, Switch’s CPA certification demonstrates to our customers that Egress’ technology and supporting business process can be fully trusted. Our software development methods and quality assurance practices have been rigorously tested by some of the best crypto-analysts in the world – and stood up to the challenge.

In practice, this means that Switch can be trusted to protect our customer’s information throughout the data sharing lifecycle. Many products use the same AES 256 bit encryption – however, the way that it is implemented is key to security.

It is interesting to note that not a single product, including Switch, has gone through CPA certification without some changes, both in software and procedural use of the product. This can only be seen as a good thing – as is third party assurance, especially when that third party happens to be a branch of government.

The certification also demonstrates that Egress has nothing to hide. We voluntarily put Switch forward for CPA testing because we have confidence in our product and the work we do. And this, again, is good news for our end-users. There are some companies who may shy away from CPA testing – and they would no doubt say they have their reasons for this.

As an end-user, therefore, you have to ask yourself which product you want: the one that government experts approve or one that won’t be put to the test.

The Year of Encryption? What 2014 will mean for data security

2014-01-17T14:01:00.001+00:00

Rebecca Bailey
Senior PR & Marketing Executive
Egress Software Technologies Ltd.

Labelled by many as ‘The Year of Encryption’, 2014 is expected to see unprecedented growth in the cybersecurity market, in particular in the area of data encryption.

Major developments over the last 12 months have propelled encryption to the forefront of public debate and business agendas. While some of these events were expected (for example, the LIBE Committee’s vote on the European Data Protection Regulation reforms), some were less so – namely Edward Snowden’s revelations made to the international press regarding the extent of the US Government’s data surveillance programme (PRISM). This latter development sparked international concerns and debate, and has prompted some of the largest email providers, such as Microsoft and Yahoo, to pledge the provision of encryption services for their users.

At Egress, we have witnessed the noticeable changes wrought on the cybersecurity market by the events of 2013, and have analysed some of the effects they will have during 2014.

Putting encryption on the map

Prior to 2013, encryption was often seen as a topic confined to those in the public sector, in particular Central Government, where a data breach could have implications for individual and national security. However, Snowden’s revelations have forced organisations of all sizes and across all industries to recognise the importance of encryption.

One repercussion was the extensive examination of the US Patriots Act – a topic we discussed here. Created in the wake of 9/11, the Patriots Act gave the US Government wide-ranging jurisdiction over data connected to the US, which has consequently led many business leaders to scrutinise the impact that geographical location, and the laws that subsequently apply to it, has on their data.

A newfound interest

So, while 2013 turned the spotlight on encryption and cybersecurity, it is likely that 2014 will see a refinement of that interest. Undoubtedly there will be an increase in the number of encryption options making their way to market; however if Snowden has taught us anything, it is that rigorous assessment is imperative (for example, examining the industry accreditations achieved by individual products – such as CESG’s Commercial Product Assurance programme).

Moreover, with budget restrictions continuing across all sectors, efficiency will provide a strong driving force for the market. Business heads will be required to put together a solid business case to support their preferred solution, demonstrating that not only does it provide comprehensive security but is also responsive to an organisation’s changing needs. In addition, ability to integrate with existing infrastructure and business processes will be of the utmost importance, as cybersecurity must enhance workflow rather than hindering it.

The vendors of these solutions, meanwhile, will have to remain agile to the market’s need as organisations explore their differing and evolving requirements. At Egress, in particular, we have already broadened our offering of encryption services, and will continue to do so throughout 2014.

Thus although born largely of controversy, this newfound interest in data encryption will have a positive impact on the cybersecurity market, refining the options available to organisations based on their own further scrutiny of data encryption.

Encryption 101: Back to basics

2013-12-06T11:39:00.000+00:00

Jack Hammond
Junior Developer
Egress Software Technologies Ltd.

Having introduced the concept of encryption in my last blog post through the PlayFair Cipher, I’m now going to look at a few of the oldest known ciphers, which demonstrate the fundamentals of encryption.

At the most basic level, encryption is primarily about providing two properties:

Confusion – The relationship between the plaintext (input) and the ciphertext (output) should be as difficult as possible to figure out, thus making the key difficult to crack
Diffusion – Any changes to the plaintext, even just a single letter, should produce wide, sweeping changes to the resulting ciphertext

A brief history

Encryption has been used for thousands of years – for example, there are reported cases dating back to 2,500BC of hieroglyphs being altered in Ancient Egypt to conceal information. In 500BC, meanwhile, Rabbis hid information using the Atbash cipher – a very simplistic cipher in the sense that it simply reverses the alphabet, so ‘A’ becomes ‘Z’, ‘B’ becomes ‘Y’, and so on.

Plaintext: ‘This message has been encrypted using the Atbash cipher’

Ciphertext: ‘Gsrh nvhhztv szh yvvm vmxibkgvw fhrmt gsv Zgyzhs xrksvi’

While these ciphers wouldn’t take long to crack with today’s technology, they demonstrate encryption in a very basic form, providing a solid foundation for a better understanding of the subject.

The cipher of a Roman Emperor

Julius Caesar is perhaps one of the most famous Roman Emperors – however what people may not know is that he has a cipher named after him: The Caesar cipher.

Like the Atbash cipher, the Caesar cipher has a very simple method of encryption. However, while the Atbash cipher only allows the use of a single ‘key’ (‘A’ will always encrypt to ‘Z’, ‘B’ will always encrypt to ‘Y’, etc), meaning that if someone knows a document has been encrypted using the cipher, it would be fairly trivial for them to decrypt it; the Caesar cipher provides 25 different ‘keys’. How? Well, it’s what’s known as a substitution cipher or, more specifically, a simple substitution cipher.

The Caesar cipher uses the alphabet and a numerical offset to encrypt data, hence the 25 possible ‘keys’ (you can’t have 26, as if you moved a letter 26 times, it would ultimately end up back in its starting position and break the encryption).

With this in mind, let’s take a look at a simple example that will use the key of ‘3’ to encrypt the letter ‘E’ to its corresponding ciphertext letter.

Letter shifting

It is generally accepted that encryption is done by shifting all the letters to the right (positive shift) and decryption is done by shifting all the letters to the left (negative shift), with ‘Z’ looping back round to ‘A’. Of course there is no steadfast rule, and you’re free to encrypt and decrypt in any way you like!

Plaintext	A	B	C	D	E	F	G	H	I

Ciphertext	D	E	F	G	H	I	J	K	L

Looking at the example above, we can see that if the letter ‘E’ is encrypted by the Caesar cipher with a 3 shift, then it will encrypt to the letter ‘H’. To decrypt this, we simply use a -3 shift.

Some more examples

So, now we know how the Caesar cipher works, let’s look at encrypting a whole sentence:

I came, I saw, I conquered.

Plaintext alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZ

Example 1

Shift: 1

Ciphertext alphabet: BCDEFGHIJKLMNOPQRSTUVWXYZA

Ciphertext message: J DBNF, J TBX, J DPORVFSFE.

Example 2

Shift: 10

Ciphertext alphabet: KLMNOPQRSTUVWXYZABCDEFGHIJ

Ciphertext message: S MKWO, S CKG, S MYXAEOBON.

Weaknesses in the cipher

Look at the two examples above, do you notice anything about them? Specifically, the letter ‘I’ is quite revealing.

As you’ve probably noticed, the letter ‘I’ is always encrypted to the same letter: on the 1 shift, ‘I’ always becomes ‘J’; on the 10 shift, ‘I’ always becomes ‘S’. This repetition means the Caesar cipher is vulnerable to one cryptanalysis method known as Letter Frequency Analysis – working out what a letter could be by how often it appears.

Every sentence tells a story

Within the English language, certain letters appear in sentences more often than others do. Using this knowledge, we can 'brute force' a Caesar cipher and get the original message, even if we don't know the key - although this involves some patience, of course!

The above graph shows the usual distribution of letters, otherwise known as letter frequency. By comparing the frequency of letters in some ciphertext, it can give clues to the key used to encrypt it, and we can then try that to see what it decrypts to, adjusting the number of letters shifted up or down accordingly, until we find a solution that reads like a normal English sentence.

These early examples prove just how far back in history encryption has its roots, and while they’re clearly very simple to crack by today’s standards, they demonstrate well the principles of encryption. Moreover, with every new algorithm invented, complexity and difficulty levels increased nearly exponentially – up to the point where currently ciphers are being designed that use the fundamentallaws of physics to provide a near perfect form of encryption… In theory at least!

Your turn to crack the code (try these at your desk!)

Using a key of ‘7’, encrypt the following phrase:

Rome was not built in a day
Answer: Yvtl dhz uva ibpsa pu h khf)

Using a key of ‘15’ encrypt the following phrase:

Experience is the teacher of all things
Answer: Tmetgxtcrt xh iwt itprwtg du paa iwxcvh)

The following phrase has been encrypted using a key of ‘20’, decrypt it:

Cz sio gomn vlyue nby fuq, xi cn ni mycty jiqyl: ch uff inbyl wumym ivmylpy cn.
Answer: If you must break the law, do it to seize power: in all other cases observe it)

The UK IT Industry Awards 2013: A night to remember

2013-11-20T16:32:00.000+00:00

Rebecca Bailey
Senior PR & Marketing Executive
Egress Software Technologies Ltd.

Informally dubbed the ‘Oscars of the IT world’, the UK IT Industry Awards celebrate best practice, innovation and excellence, and form the gold standard of achievement for any organisation within the IT sector. Unsurprisingly, then, emotions were running high for the Egress team last Wednesday, when our bid to be named Cloud Provider of the Year culminated at the Battersea Park Events Arena, London.

Celebrating 40 years of IT

The lavish awards ceremony, put together by the Chartered Institute of IT (BCS) and Computing Magazine, provided a fitting backdrop for leading individuals and organisations from across the sector to champion the endeavours and innovation that, as BCS Group Chief Executive Officer David Clarke explained, not only “provides best practice now but next practice very soon”.

As sponsors of the event, the Egress Team began the evening in the VIP Lounge with a champagne and canapé reception, before we took our seats alongside the other 1,300 guests to be formally welcomed by David, as well as Editor of Computing Stuart Sumner. The pair recognised both the calibre and the volume of entries for this year’s awards, before Stuart introduced an infographic celebrating 40 years of IT. The subsequent spectacular gala dinner was followed by Comedian and TV Host Jimmy Carr’s appearance on stage.

After a short round of stand-up – in which Jimmy played upon the common perceptions and misconceptions of the IT industry – the true business of the evening began.

Cloud Provider of the Year

As one of the last categories to be announced, the Egress Team had quite a wait before hearing about our success. However, entertainment was provided by Jimmy Carr’s quick wit and the good humour of those presenting the awards – including Egress CEO Tony Pepper. Arriving onstage to Jimmy quipping that his name would be well-suited to a mafia boss, Tony put on his best New York accent to greet the comedian.

Before long, however, the moment of truth was upon us. Our table sat in nervous silence, only to erupt in cheering as our logo appeared onscreen and we were awarded ‘Cloud Provider of the Year’.

Reflecting on our achievement, Tony commented: “The way the awards are judged is one reason they are held in such high regard by the industry. Rather than just an online form with a restrictive word count, BCS and Computing Magazine give every finalist the chance to present in person, which means you can explain in detail the work you are doing and justify why you think you deserve to win.

“For Egress, this meant we could demonstrate what an amazing year 2013 has been for us, with revenue growth of over 400% and a 95% increase in customers. This success is based in our fundamental belief in continued investment into product innovation and leading-edge technology.”

The rest of the evening was spent toasting our success, as well as that of the other winners and those acknowledged as highly commended. Egress partners and clients were amongst those recognised for their excellence on the night, most notably Softcat, who were awarded ‘Large Supplier or Major VAR of the Year’ and the London Borough of Hackney for ‘IT Project Demonstrating Most Effective Use of Collaborative Technology’. Similarly, Network Rail received the award for 'Innovative Mobile App of the Year', in the category co-judged by Egress’ Dan Hoy.

True to Egress form, we had a fantastic night of celebration and are proudly displaying our newest trophy in our London office - however, we're also already planning how to return bigger and better in 2014!

T	U	R	I	N	G
5	6	4	2	3	1
W	E	C	A	N	O
N	L	Y	S	E	E
A	S	H	O	R	T
D	I	S	T	A	N
C	E	A	H	E	A
D	B	U	T	W	E
C	A	N	S	E	E
P	L	E	N	T	Y
T	H	E	R	E	T
H	A	T	N	E	E
D	S	T	O	B	E
D	O	N	E	X	X

G	I	N	R	T	U
1	2	3	4	5	6
O	A	N	C	W	E
E	S	E	Y	N	L
T	O	R	H	A	S
N	T	A	S	D	I
A	H	E	A	C	E
E	T	W	U	D	B
E	S	E	N	C	A
Y	N	T	E	P	L
T	R	E	E	T	H
E	N	E	T	H	A
E	O	B	T	D	S
X	E	X	N	D	O

T	U	R	I	N	G
5	6	4	2	3	1
W	E	C	A	N	O
N	L	Y	S	E	E
A	S	H	O	R	T
D	I	S	T	A	N
C	E	A	H	E	A
D	B	U	T	W	E
C	A	N	S	E	E
P	L	E	N	T	Y
T	H	E	R	E	T
H	A	T	N	E	E
D	S	T	O	B	E
D	O	N	E	X	X

G	I	N	R	T	U
1	2	3	4	5	6
O	A	N	C	W	E
E	S	E	Y	N	L
T	O	R	H	A	S
N	T	A	S	D	I
A	H	E	A	C	E
E	T	W	U	D	B
E	S	E	N	C	A
Y	N	T	E	P	L
T	R	E	E	T	H
E	N	E	T	H	A
E	O	B	T	D	S
X	E	X	N	D	O

T	U	R	I	N	G
5	6	4	2	3	1
W	E	C	A	N	O
N	L	Y	S	E	E
A	S	H	O	R	T
D	I	S	T	A	N
C	E	A	H	E	A
D	B	U	T	W	E
C	A	N	S	E	E
P	L	E	N	T	Y
T	H	E	R	E	T
H	A	T	N	E	E
D	S	T	O	B	E
D	O	N	E	X	X

G	I	N	R	T	U
1	2	3	4	5	6
O	A	N	C	W	E
E	S	E	Y	N	L
T	O	R	H	A	S
N	T	A	S	D	I
A	H	E	A	C	E
E	T	W	U	D	B
E	S	E	N	C	A
Y	N	T	E	P	L
T	R	E	E	T	H
E	N	E	T	H	A
E	O	B	T	D	S
X	E	X	N	D	O