Thinking differently about software security: Inside-Out

Software_security_InsideOut_Thinking_Irdeto

We live in a very different world today than we did 10-20 years ago. We’ve never been more connected. So, it’s surprising that software security practices remain in the realm of “We’ve always done it this way before”. Can they really expect to solve today’s security problems with an old way of thinking?

Traditional thinking
Traditional thinking typically starts with the premise that honest parties control the computer devices and any cryptographic operations are performed free from interference from would-be attackers. Given this, it’s probably understandable

Cryptography is everywhere in day-to-day life

crypto_day2day_life_Irdeto

Cryptography is no longer limited to the military and spies. This ancient art underpins modern life. It’s about encoding intelligible data, e.g. numbers, text and transforming them into something unreadable to anyone other than who the information is meant for. The question is, does it need an upgrade for today’s always connected world?

How secure is your house?
Hundreds of times a day we use cryptography in our everyday life. From the lock on the website that you’re browsing, remotely unlocking your car with the key fob to using all kinds of devices.

APIs – friend or foe?

api_friend_foe_Irdeto

APIs are everywhere in modern day life. We rely on them to access services on mobiles, tablets and laptops. Without them our day-to-day life wouldn’t be the same. Yet they are also increasing the attack surface. Are they really a friend to e-commerce or to cybercrime?

e-Commerce’s friend
APIs are not new. They’ve been around a long time. APIs are key to building scalable web-based applications as they allow and manage the interaction between 2 online connected services.

Does the security auditor have a point?

Security_auditor_Irdeto

On a recent flight, I was sat next to a security auditor. He asked “can someone steal keys used to encrypt credit cards from the server memory?” It depends, was my reply. But his question left me wondering. Why hasn’t anyone built a server side white box implementation?

Why does it depend?
Like any implementation, some are more secure than others. If the server side code was using ‘standard cryptographic APIs’ and they were black box implementations then

Bringing trust back into the relationship

irdeto_bringing_trust_back

Browser security isn’t a new problem. Apple, Google, Microsoft and Mozilla have put a huge amount of effort into enabling consumers to have a secure browsing experience. But who’s thinking about the web site operators and their secure browsing experience?

Trust online
Internet trust is dependent on certification authorities; with TLS/SSL being the most commonly used technology for securing electronic commerce transactions online. It’s all about enabling the consumer to access web services and be reasonably confident they know who they are talking to.

Is the next-generation white box cryptography the new Jedi?

irdeto_nextgen_whitebox_cryptography

In Star Wars: The Force Awakens, the sinister First Order dominates the galaxy, with only a small band of trusted resistance fighters left. What’s the link to today’s software world you may ask? It all comes down to the power of cryptography to defeat the dark side.

In this software controlled world the need for software protection is unavoidable. This protection extends to all aspects of day-to-day life. It could be securing your credit card details when shopping on line or a business safeguarding a remote network connection to even protecting premium content such as a blockbuster movie.

Balancing security and usability in the pay-media world

pay-media_web_security

Let’s face it; if consumers don’t get what they want, they look elsewhere. Gone are the days of loyalty due to limited choice. For pay-media operators this can be like walking a tightrope: protecting their content investment without the security negatively impacting the consumer experience. What can be done to make this easier?

To find out, let’s check in again with Bob. Unsurprisingly, after being identified as the cause of the corporate disaster Bob is now unemployed. He spends most of his day catching up on the movies and TV series he missed.

Are you causing a crack in the corporate IT’s ‘egg-shell’ security?

browser_security_corporate_it_irdeto

Many of us work for organizations with an established corporate IT department. IT determines the security policies; sets the protocols, permissions and instructs employees on the best practice. Given the cyber risks that organizations now face is ‘egg-shell’ security enough?

Some of you may remember Bob from my previous post. Let’s continue to see what Bob is doing to explore how safe corporate IT really is.

Are you sure you’re communicating with your bank?

online_banking_web_security

We naturally assume banks are safe. But why? From legendary bank robbers: Jesse James or Bonnie & Clyde, banks have always been a target. Today’s bank robbers are cybercriminals. And they are targeting not only the banks but also consumers.

Every couple of months cyber-attacks on banks make the headlines. Be it the Carbanak cybergang’s biggest ever online bank heist, a distributed denial of service attacks on RBS/Natwest or a Polish bank being held to ransom