Posted on

Google Releases Basic Homomorphic Encryption Tool

Google has released an open-source cryptographic tool: Private Join and Compute. From a Wired article:

Private Join and Compute uses a 1970s methodology known as "commutative encryption" to allow data in the data sets to be encrypted with multiple keys, without it mattering which order the keys are used in. This is helpful for multiparty computation, where you need to apply and later peel away multiple layers of encryption without affecting the computations performed on the encrypted data. Crucially, Private Join and Compute also uses methods first developed in the ’90s that enable a system to combine two encrypted data sets, determine what they have in common, and then perform mathematical computations directly on this encrypted, unreadable data through a technique called homomorphic encryption.

True homomorphic encryption isn’t possible, and my guess is that it will never be feasible for most applications. But limited application tricks like this have been around for decades, and sometimes they’re useful.

Boing Boing article.

Read the Full Article here: >Schneier on Security: Cybercrime Paper

Posted on

Offensive Security launches OffSec Flex, a new cybersecurity training program for enterprises

Offensive Security, the leading provider of hands-on cybersecurity training and certification, announced OffSec Flex, a new program for enterprises designed to simplify the cybersecurity training process and allow organizations to invest more in cybersecurity skills development.

Organizations can now use OffSec Flex to purchase blocks of Offensive Security’s industry-leading practical, hands-on training, certification and virtual lab offerings, allowing them to proactively increase and enhance the level of cybersecurity talent available within their organizations.

With Offensive Security’s hands-on courses, labs and exams readily available, organizations are able to offer educational opportunities to new hires and non-security team members alike, improving their security posture and equipping their employees with the adversarial mindset necessary to protect modern enterprises from today’s threats.

“Cybersecurity training is not just for security professionals anymore,” said Kerry Ancheta, VP of Worldwide Sales, Offensive Security.

“Increasingly we see organizations recommend pentest training courses for their software development or application security teams in order to improve their understanding for how their systems and applications are attacked.

“With the OffSec Flex program, it will now be easier for organizations to access more training options, offering cyber skills growth opportunities to more employees to better defend IT systems from sophisticated attackers outside of their companies.”

Cybersecurity spending reached new heights in 2019. Gartner estimates that it will reach $124 billion by the end of the year1. Yet, while organizations are increasingly willing to spend on cybersecurity solutions, security incidents continue at an alarming rate.

Over 1.9 billion records were exposed during the first quarter of 2019, an increase of almost 30 percent2. Despite increasing their cyber spend, most organizations are unable to close the cybersecurity skills gap due to a lack of available training options.

With the launch of OffSec Flex, Offensive Security simplifies the allocation and use of training budgets, making it significantly easier for organizations to invest in cybersecurity skills.

Once an organization sets its training budget, it can pre-purchase a block of Offensive Security training from across its range of offerings. It is then able to utilize that training time as needed throughout the year while extending its budget through Flex Bonus Funds, contributed by Offensive Security.

Offensive Security not only provides some of the industry’s most sought-after training courses and certifications, including the Penetration Testing with Kali Linux (PWK) course and the Offensive Security Certified Professional (OSCP) along with the Advance Web Attacks and Exploitations (AWAE) course and the Offensive Security Web Expert (OSWE).

The company’s rigorous training programs force students to develop adversarial mindsets and persistent work habits, demanding that they think like attackers and try harder to earn the industry’s most sought-after certifications.

Read the Full Article here: >Help Net Security – News

Posted on

How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance

Tenable Research Release Highlights are posted for significant new releases or updates to existing plugins or audit files that are important for early customer notification. Here, we discuss new audit guidance for Microsoft Exchange.

Tenable Research Release Highlights

Microsoft Exchange remains one of the most widely adopted email and calendar solutions. Establishing a secure baseline configuration for Exchange, based on industry leading guidance, is essential but the complexity in deployments can present a challenge. The Center for Internet Security (CIS) and Defense Information Systems Agency (DISA) have issued guidance on hardening and auditing these deployments. Tenable released plugin enhancements and audits to help customers implement this guidance on July 1. 

CIS Benchmarks for Microsoft Exchange

DISA STIGs for Microsoft Exchange

Usage Overview

Tenable customers can audit an MS Exchange server with all of the same check types as in our Windows Compliance Plugin, as well as with a new check type, AUDIT_EXCHANGE. This new check type leverages the Exchange-specific cmdlets suggested for use in the audit steps of DISA and CIS recommendations.

The following is an example check using AUDIT_EXCHANGE:

Adding CIS Benchmark and DISA STIG - Audits for MS Exchange 2013 and 2016

The powershell_args tag contains the core of the audit functionality, with the plugin itself connecting and exposing Exchange specific cmdlets. As a result, the EMS/Exchange cmdlet import is seamless to the user, who can instead focus on writing good powershell.

How to get started

A byproduct of the session setup and cmdlet import is that we need to work with powershell credential objects. In order to avoid unintended disclosure of credential information via powershell logs, users are required to use a pregenerated encrypted password string for each target of the audit as part of what we require in the Exchange Auditing scan setup.

Password/Secure String Generation

In order to generate an encrypted password for use with our Exchange audits, run the following powershell while logged in on the target with the account that will be used for scanning:

Read-Host -AsSecureString | ConvertFrom-SecureString

While logged into the account you’ll be using to scan, type in the password for the account. The output will look like this:

01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ad58de852cc4646b0d9dfa96c67f2100000000002000000000003660000c0000000100

00000d8b09ba7e13918c19d776cc7dfcac82a0000000004800000a0000000100000003654a47ae8a4da017657d57f0706989e180000004acd2fe799

0e1243ed84c380e5d0e8a95a01f12f5662574714000000e5b4783976f1ad76065cf6f91a3b1bebbcf4b169

Read-Host -AsSecureString | ConvertFrom-SecureString

Reminder: An encrypted password is required for each target being scanned. 

After creating the string from the instructions, make sure to select the audit under the Windows category and populate the secure string variable (separating multiple targets with commas). The plugin will determine which string to use on which target. Add your usual credential information on the credential tab and save the policy.

How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance

Once the configuration is saved, run the scan and review the results. 

Example Scan output

How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance

Below is a closer view of one of the results. This page shows:

  • Pass/fail status
  • Remediation steps, if necessary
  • Individual results from the systems scanned

How to Audit Microsoft Exchange 2013 and 2016 with CIS and DISA Guidance

Summary

Auditing an Exchange Environment with Tenable.io and Nessus requires a little bit of extra setup but allows for a secure and automated method for evaluating your organization’s compliance. Exposing Exchange specific cmdlets allows for much more accurate auditing of the environment, with a direct correlation to industry guidance. At Tenable, we regularly update our policy compliance audits to match the newest versions by CIS and DISA to ensure our customers are able to keep pace with the latest best practices.

Follow Tenable Research Release Highlights on the Tenable Community.

Read the Full Article here: >Tenable Network Security

Posted on

What is and what is not working for security operations teams in securing cloud data

Security professionals continue to face a number of major challenges as more organizations move legacy IT operations to cloud infrastructure and applications, and traditional security tools often fall short, according to Delta Risk.

cloud data security concerns

The research, produced by Cybersecurity Insiders, clearly shows that organizations must assess their cloud security posture and strategies on a regular basis and have a well-developed incident response plan that includes cloud applications and infrastructure.

Among the findings:

  • The top cloud security concern is data loss and leakage (64 percent).
  • Unauthorized access through misuse of employee credentials and improper access controls (42 percent) takes the number one spot in this year’s survey as the single biggest perceived vulnerability to cloud security, tied with insecure interfaces and APIs (42 percent). This is followed by cloud misconfigurations (40 percent).
  • Most respondents (54 percent) say cloud environments are at higher risk of security breaches than traditional on-premises environments – a 5 percent increase from last year.

cloud data security concerns

“The 2019 Cloud Security Report highlights the fact that IT and security professionals have to take the lead in securing their cloud data, systems, and services under the shared responsibility model,” said Holger Schulze, CEO and Founder of Cybersecurity Insiders.

cloud data security concerns

“The 2019 research supports what we hear from organizations about their challenges with effectively monitoring cloud applications and infrastructure,” said Tempy Wright, Vice President of Marketing at Delta Risk. “High-profile data breaches in the past year have driven increased concerns about the security of cloud environments, and we see this reflected in the survey results.”

Read the Full Article here: >Help Net Security – News

Posted on

Slurp – Amazon AWS S3 Bucket Enumerator

Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan from an external perspective or an AWS API to scan internally.

Slurp - Amazon AWS S3 Bucket Enumerator

There are two modes that this tool operates at; blackbox and whitebox mode. Whitebox mode (or internal) is significantly faster than blackbox (external) mode.

Blackbox (external)

In this mode, you are using the permutations list to conduct scans. It will return false positives and there is NO WAY to link the buckets to an actual AWS account.

Whitebox (internal)

In this mode, you are using the AWS API with credentials on a specific account that you own to see what is open. This method pulls all S3 buckets and checks Policy/ACL permissions. Your credentials should be in ~/.aws/credentials.

Slurp – Amazon AWS S3 Bucket Enumerator Features

The main features of Slurp are:

  • Scan via domain(s); you can target a single domain or a list of domains
  • Scan via keyword(s); you can target a single keyword or a list of keywords
  • Scan via AWS credentials; you can target your own AWS account to see which buckets have been exposed
  • Colorized output for visual grep
  • Currently generates over 28,000 permutations per domain and keyword
  • Punycode support for internationalized domains

Usage of Slurp S3 Bucket Enumerator

Will enumerate the S3 domains for a specific target:

slurp domain <–t|—target> example.com

Will enumerate S3 buckets based on those 3 key words (linux, golang & python):

slurp keyword <–t|—target> linux,golang,python

Will perform an internal scan using the AWS API:

You can download Slurp here:

slurp.tar.gz

Or you can read more here.

Read the Full Article here: >Darknet – The Darkside