March, 2018 - securitylinkindia

Honeywell Vector Occupant App

MassMediaLink India LLP SecurityLink IndiaMarch 8, 2018November 14, 202406 mins

Honeywell has recently added new capabilities to the Honeywell Vector Occupant App that give occupants more control over their experiences within a building with the swipe of a screen. The most significant new feature is indoor navigation, which uses GPSlike technology to help users find their way around complex buildings that are difficult to navigate without directions. The benefits of the indoor navigation feature have been demonstrated in the Minneapolis Skyway System, a complex interlinked network of enclosed pedestrian walkways spanning 80 city blocks. The walkways protect Minnesotans from the harsh winter elements and summer humidity, allowing them to comfortably walk between more than 30 buildings in downtown Minneapolis. “For anyone who’s not a local, and for even some who are, finding your way around the skyway system can be a big challenge,” said Steve Cramer, President and CEO, Minneapolis Downtown Council, “With our initial use of the Honeywell Vector Occupant App, we’ve seen an immediate impact. The interactive map makes it really easy and intuitive to know exactly where you’re going, and how to get there.” In addition to the indoor navigation feature, the app also now includes a location-based feature to rate spaces, allowing those within a building to highlight comfort issues to building staff for quick resolution. Both features combine the convenience of today’s mobile devices with Internet of Things (IoT) building connectivity to help improve a user’s experience inside a building. “Much of a building’s success hinges on how happy and satisfied its occupants are. They’re the lifeblood of an organization, and their experience within a building is what keeps them coming back,” said Aseem Joshi, Country General Manager, Honeywell Building Solutions, India, “The Honeywell Vector Occupant App has given users more power to shape their building experiences from their smartphones. Now, we’re adding even more features to deepen the connections between occupants and the spaces around them so they can be as comfortable as possible, and can more easily and efficiently move about a building.” Indoor navigation Enabled by strategic partner Insiteo’s indoor location solution for smart buildings, the indoor navigation feature offers accurate indoor location, mapping, routing, presence, proximity notifications and analytics – all embedded into an integrated platform. Backed by location technology installed within a facility and software, the app’s indoor navigation provides easy-to-use way finding, with turn-by-turn voice assistance and location accuracy up to five feet. The app promotes better collaboration and improved safety via its ‘share my location’ feature, which gives users a way to more easily find each other in a building. For building owners and managers, in addition to promoting occupant satisfaction, the app also provides insights into foot traffic patterns, which building personnel can use to better inform measures like messaging placement to better serve their occupants. Location based space rating The rating feature builds on the app’s original one-click hot/ cold call capability, which lets users raise comfort issues with building personnel for resolution. Building owners and managers can view ratings and feedback on dashboards to pinpoint where building spaces need attention and improvements. They can also visualize longer-term trends and space rankings to uncover patterns and improvement opportunities to promote occupant comfort, satisfaction and productivity. Vector occupant App capabilities The new capabilities build on the Honeywell Vector Occupant App’s base functionality, which includes digital identification, mobile access control and the ability to communicate temperature discomfort to prompt adjustments by facility teams. The Honeywell Vector Occupant App is part of Honeywell’s connected services portfolio, which leverages the connectivity of buildings to improve how they operate and the experiences they offer for those who visit and work within them. The Honeywell Vector Occupant App works with Apple and Android products.

DDS Protocol Analysis Software

MassMediaLink India LLP SecurityLink IndiaMarch 8, 2018November 14, 202403 mins

In late 1970s to late 1980s, ATT offered a pure private line digital data service called Dataphone Digital Service, or DDS. Supported rates of 2.4, 4.8, 9.6, and 19.2 were standard with higher rates such as 56kbps; and nx56kbps also possible but rarely. These circuits although legacy, are still quite common today – because they really work. Specialized channel cards called OCU-DP (Office Channel Unit Data Port) are connected to standard CSU/ DSUs with datacomm interfaces. Both synchronous and asynchronous data is formatted and fit cleanly into a 64kbps time-slot (by repeating the data bits or bytes). The bit repetition had the added advantage of providing error correction and thus better performance. The channel data is then inserted into time-slots of a standard T1. In this manner many data circuits can be packed into a private line T1.” “GL supports non-intrusive monitoring and analysis of DDS frames using T1 Analyzer hardware. The captured data can be decoded and analysed by GL’s DDS Protocol Analyzer,” Vijay Kulkarni, the CEO of the company said, “Non-intrusive TAPs are used to passively duplicate the signal between two end points on a network link without disturbing the actual network activity. GL’s T1 Analyzer hardware can be used with RJ48 Y Bridge – splits one RJ48 into two complete and non-intrusively tap and capture the DDS frames on a T1 line.” He added, “The DDS data is formatted into frames separated by one or more bytes. The data channel may utilize multiple, all or a fractional timeslot of the T1 line. Also, there may be multiple data channels within the T1 line. The captured data is analyzed using GL’s DDS Protocol Analyzer.”

India Electronics and Semiconductor Association Vision Summit 2018

MassMediaLink India LLP SecurityLink IndiaMarch 8, 2018November 14, 202404 mins

India Electronics and Semiconductor Association (IESA), the premier trade body representing the Indian electronic system design and manufacturing space in collaboration with MarketsAndMarkets launched an industry report on Indian semiconductor fabless startup ecosystem at the this year’s Vision Summit. The report was launched by Ashwini K Aggarwal, Chairman, IESA; Anilkumar Muniswamy, Director, SLN Technologies Ltd., and Jitendra Chaddah, Chair, Fabless CIG and Senior Director, Strategic Relations and Operations, Intel India. It reveals that the Indian semiconductor component market is expected to be worth USD32.35 billion by 2025, growing at a CAGR of 10.1% between 2018 and 2025. The inaugural session was presided over by Priyank M Kharge, Honorable Minister for IT, BT and S&T, GoK. H.E. Ms. Dana Kursh, Consul General of Israel to South India and Shailendra Tyagi, Director, STPI Bangalore, were also shared the stage. The Vision Summit is a global leadership conclave for the Electronics System Design & Manufacturing (ESDM) industry. This year the theme is ‘Resurgent India: Electronics, Entrepreneurship and Economy,’ which attracted a powerful line-up of industry experts, thought leaders, policy makers, government officials, business and technology experts, venture capitalists, entrepreneurs who shared their views and vision on the future of the ESDM industry as well as the trends, challenges and opportunities shaping the Indian industry. Ashwini K Aggarwal said, “We are witnessing the rise of a new India with a stable government clearing policy logjams, taking bold decisions and ambitious targets. With digital as the growth hack and aggressive engagement from the government’s ‘Make in India’ campaign, the ESDM industry will benefit and is projected to see investment proposals over $1.5 bln over next 2 years. We believe that now is the time to build the future of design led manufacturing. The fabless report clearly highlights the opportunities for the Indian fabless ecosystem. This year’s theme at IESA Vision Summit 2018 is dedicated towards building the industry success by highlighting opportunity areas and addresses the challenges being faced.” Highlights of the Indian Semiconductor Fabless Startup report: The key trends identified in the report include smart industrial automation, defense and rural broadband. It elaborates on the Indian semiconductor design ecosystem, and highlights the various opportunities for major global semiconductor players to consider India as their global R&D destination. It revealed that India is a highly attractive destination for global R&D centers owing to the availability of talent, as well as lower cost (compared with the US and Western Europe).

Infinova VT210-A2-B0 Series Camera

MassMediaLink India LLP SecurityLink IndiaMarch 8, 2018November 14, 202403 mins

Infinova’s VT210-A2-B0 series H.265 HD megapixel smart starlight WDR IP box camera allows image output resolution up to 1920×1080@30fps. The camera provides excellent resolution and color reproduction, acquires richer and more accurate details, and guarantees intelligent analysis accuracy in a more effective way, which caters for different application needs. The camera boasts of rich intelligent functions, such as wire cross detection, regional invasion detection, field of view change detection, defocus detection, too dark detection and too light detection. VT210-A2-B0 series camera is designed for safe city, rail transit and municipal construction. Particularly, it is widely used in city public security, highway, metro, station, exhibition hall etc. . ● 1/2.8” progressive scan CMOS sensor. IR-Cut removable (ICR) filter for day/ night switching. Star-grade sensitivity: 0.0015 lux. Supports frame integration WDR, with dynamic range up to 132dB (True WDR). High-resolution image signal output: 1920×1080@30fps. Auto back focus (ABF). Smart functions for perimeter protection (wire cross and regional invasion detection) and feature protection (field of view change, de-focus, too dark, and too light detection). Three simultaneous video streams: Dual H.265 & M-JPEG or dual H.264 & scalable M-JPEG. Supports built-in storage/ NAS. Support alarm recording and event recording (including broken network). Supports alarm snapshot and event snapshot. Bi-directional audio, G.711a and G.711u. 2 alarm inputs, 1 on-off output. Support multiple ways to trigger and handle alarms. Up to four definable privacy mask areas. Up to eight ROI (Region of Interest) areas. Support simultaneous access and parameter setting via Web Server from multiple clients. Compatible or able to integrate with digital video surveillance software, and other video surveillance software. ONVIF Profile S & G compliant. Standard SDK is provided for easy integration with other video surveillance software. Wide voltage design.

Matrix NVR for IP Cameras

MassMediaLink India LLP SecurityLink IndiaMarch 8, 2018November 14, 202406 mins

A network video recorder (NVR) is primarily used to record the video streams of cameras. In medium and large scale enterprises where a huge number of cameras are installed, it becomes a necessity to incorporate a network of NVRs. It provides a systematic log of various camera video recordings and the space required to store the same. However, with the advancement in technology, NVRs are now able to assist or perform many other functions which enhance the security and ease of operation. Some of these features are unique with respect to IP NVR system, while some are found in most of the NVRs produced these days. Matrix NVRs hold one of the unique features called Cascading that eliminates the need of a server to operate CMS (Centralized Management System) as it works on client-server architecture where each NVR is divided into two parts, client and server. The client of one NVR can communicate with the other one’s server and vice versa. Therefore, each network video recorder can supervise and interface with several other NVRs, bypassing the need of a server to do the same, which makes this solution very cost-effective. For example, if multiple NVRs exist in a network, they can still be governed from one of them locally. A single device can act as the server (or a master device) and can control 19 other client (or slave) NVRs. Similarly, there can be multiple master devices as well, monitoring various sets of other (slave) NVRs. Finally, the master device can be directly connected to a screen and output from all slave NVRs can be monitored. One of the major concerns of an IP NVR manufacturer is the storage space to store the recordings. Required storage capacity is determined by the number of factors such as IP cameras in the network, resolution, type of recording and retention duration. If many cameras are connected, optimizing storage becomes indispensable. To resolve this problem, following three features in a NVR come in handy: Motion based recording: There are instances when there is no motion at all but are still recorded, hogging storage space unnecessarily. With motion based recording enabled, the NVR stops recording when there is no motion. Therefore, the storage space is utilized for only those recordings in which motion has been observed. Adaptive recording: According to Indian Government policies for public areas, it is mandatory to record video streams persistently, irrespective of motion. To approach this requirement, NVRs have the option of adaptive recording, in which the number of frames per second change, adapting to the motion. This means, when there is no motion the NVR for IP cameras will still record, but with less frames as compared to when there is motion. Adaptive recording can economize storage space by as much as 50% Camera-wise recording retention: Each area in an industry fulfils a unique purpose and thus, the priority of camera recordings vary. Camera-wise recording retention provides flexibility to configure the number of days for retaining recordings based on the predominance of a camera and the area where it is installed. For example, recording retention for canteen can be set to 15 days, that of reception area, to 30 days while for the parking area recording retention can be set to 40 days. These are some of the many features that NVRs with modern technology come equipped with. There are, however, still a large amount of functions that a NVR can perform.

Smiths Detection to Boost Aviation Security in India

MassMediaLink India LLP SecurityLink IndiaMarch 8, 2018November 14, 202404 mins

Smiths Detection, a leading player in threat detection and screening technologies for aviation, ports and borders, urban security and military markets, has recently been awarded a multi-million contract to boost aviation security in India. The Airports Authority of India (AAI) has placed an order for multiple CTX 9800 DSi™ systems at a combined value of over USD50 million. Through a global competitive tender process conducted by AAI, Smiths Detection won the bid to install and integrate high-speed explosives detection systems (EDS) for hold-baggage screening at 11 sites across nine airports in India including Chennai International Airport and Netaji Subhas Chandra Bose International Airport in Kolkata. the third-largest aviation market in the world by 2026, and so security is a mission-critical factor in enabling India’s airports to be futureready. Smiths Detection is honoured to partner with AAI – supporting airports to stay ahead of the evolving threat landscape with a technological solution that is fully compliant with regulatory requirements,” said Jerome de Chassey, General Manager of Smiths Detection in India. AAI manages a total of 125 airports in India and is responsible for creating, upgrading, maintaining and managing civil aviation infrastructure both on the ground and in the air. The organisation is also responsible for building new terminals for the many new small airports under development by the Government of India. Working in partnership with Smiths Detection, AAI will implement ECAC Standard 3 screening of hold baggage at Level 1 for inline systems across the country. This complies with regulations set by the Bureau of Civil Aviation Security (BCAS), the regulatory authority for civil aviation security in India. Powered by leading-edge computed tomography (CT) technology, CTX 9800 can be configured to deliver throughput of up to 1,800 bags per hour and can be tailored to meet the specific needs of any legacy or new baggage-handling system. Approved by the European Civil Aviation Conference as meeting Standard 3 requirements, CTX 9800 is also certified by the U.S. Transportation Security Administration and the Civil Aviation Administration of China. Smiths Detection has installed over 4000 hold baggage solution units worldwide and are located in more than 70 percent of the world’s 100 largest airports.

Corruption Perceptions Index 2017 By Transparency International

MassMediaLink India LLP SecurityLink IndiaMarch 8, 2018November 14, 202408 mins

An index recently released by Transparency International, which marks its 25th anniversary this year, reveals some disturbing information. Despite attempts to combat corruption around the world, the majority of countries are moving too slowly in their efforts. While stemming the tide against corruption takes time, in the last six years many countries have still made little to no progress. Even more alarming, further analysis of the index results indicates that countries with the lowest protections for press and nongovernmental organisations (NGOs) also tend to have the worst rates of corruption. The index, which ranks 180 countries and territories by their perceived levels of public sector corruption according to experts and business people, uses a scale of zero to 100, where zero is highly corrupt and 100 is very clean. This year, the index found that more than two-thirds of countries score below 50, with an average score of 43. Over the last six years, several countries significantly improved their CPI score, including Côte d’Ivoire, Senegal and the United Kingdom, while several countries declined including Syria, Yemen and Australia. This year, New Zealand and Denmark rank highest with scores of 89 and 88 respectively. Syria, South Sudan and Somalia rank lowest with scores of 14, 12 and 9 respectively. The best performing region is Western Europe with an average score of 66. The worst performing regions are Sub-Saharan Africa (average score 32) and Eastern Europe and Central Asia (average score 34). Every week a journalist is killed in a highly corrupt country Analysis of the index results by Transparency International further examined the relationship between corruption levels, the protection of journalistic freedoms and engagement of civil society. It found that almost all journalists killed since 2012 were killed in corrupt countries. fear for their lives when speaking out against corruption,” said Patricia Moreira, Managing Director of Transparency International, “Given current crackdowns on both civil society and the media worldwide, we need to do more to protect those who speak up.” The analysis, which incorporates data from the Committee to Protect Journalists, shows that in the last six years, more than 9 out of 10 journalists were killed in countries that score 45 or less on the Corruption Perceptions Index. This means that, on average, every week at least one journalist is killed in a country that is highly corrupt. In addition, one in five journalists that died were covering a story about corruption. Sadly, justice was never served in the majority of these cases. The efforts of Transparency International and its first-hand experience working with more than 100 chapters worldwide confirm close linkages between corruption and freedom of the press. For example, in Brazil, which scored 37 on this year’s index, 20 journalists died in the last six years. Targeted for their investigations into local government corruption and drug-related crime, among other issues, reporters in Brazil risk their lives everyday by simply doing their jobs. Corruption linked to shrinking space for civil society Transparency International also looked at the relationship between corruption levels and the freedom with which civic organisations are able to operate and influence public policy. The analysis, which incorporates data from the World Justice Project, shows that most countries that score low for civil liberties also tend to score high for corruption.] “Smear campaigns, harassment, lawsuits and bureaucratic red tape are all tools used by certain governments in an effort to quiet those who drive anti-corruption efforts,” said Moreira, “We’re calling on those governments that hide behind restrictive laws to roll them back immediately and allow for greater civic participation.” Hungary, which saw a ten-point decrease in the index over the last six years, moving from 55 in 2012 to 45 in 2017, is one of the most alarming examples of shrinking civil society space in Eastern Europe. If enacted, recent draft legislation in Hungary threatens to restrict NGOs and revoke their charitable status. This would have disastrous implications for many civil society groups already experiencing the constraining effects of a previous law that stigmatises NGOs based on their funding structures. “CPI results correlate not only with the attacks on press freedom and the reduction of space for civil society organizations,” said Delia Ferreira Rubio, Chair of Transparency International, “High levels of corruption also correlate with weak rule of law, lack of access to information, governmental control over social media and reduced citizens’ participation. In fact, what is at stake is the very essence of democracy and freedom.” India appears at the 40th position of CPI. About the corruptions perceptions index Since its inception in 1995, the Corruption Perceptions Index, Transparency International’s flagship publication, is the leading global indicator of public sector corruption. The index offers an annual snapshot of the relative degree of corruption by ranking countries from all over the globe. Their latest analysis, which looks at the relationship between corruption and freedom of the press, association and expression, uses statistics collected by the Committee to Protect Journalists, Reporters without Borders, the Varieties of Democracy Project and the World Justice Project.

Be Cautious: You could be Giving out your Own Passwords

MassMediaLink India LLP SecurityLink IndiaMarch 6, 2018November 14, 2024011 mins

There are two types of hacking or unauthorized access to accounts. The first involves password cracking tools, but most organizations have cyber security features in place to prevent these attacks. However, it’s the second type of attack that can cripple any organization or person’s accounts and databases, and that is a social engineering attack. 〈 “ Social engineers are criminals who take advantage of human behaviour to pull off an online scam or hacking attack. Successful social engineers are confident and in complete control of the situation “ 〉 Social engineers generally use two techniques – one is by simple observation while the other is the proactive effort. In the first case, the social engineer simply observes a person’s social networking profiles such as Linkedin profiles etc., and all other data available about him. Most people have passwords that they can easily remember, and for that they use the words that are closely related to them. People share every detail of their lives on social networking sites including their date of birth, favourite colour, pet’s name and everything possibly related to them. This information is freely available. This makes it pretty easy for the hackers/ social engineers to guess passwords in such a scenario and fix it. It’s always advisable to be discrete with respect to the data shared on social media. Such data is also collected by the online questionnaires and market research forms that people request to fill in public places. In the second case, the attack is pre-planned and a complete checklist is made of the person or companies including likes and dislikes, passions, hobbies and professional credentials etc. The second stage of physical access now comes into the picture. For example, three income tax officials turn up at your office for an inspection along with relevant badges and check all the office computers and documents. In the process they lodge key loggers into your computers, whereby they will receive an email of every key stroke made on the computers, thereby giving out your passwords and confidential data. An example of this kind of attack would be where a social engineer researches about a person let’s say Mr. A, and collects that the person is fond of foreign holidays. The social engineer calls up this person as the authorized representative from a reputed travel agency and offers a mind-blowing holiday package. He asks Mr. A the version of PDF reader he is using on his laptop. The conversation is very friendly and inspires trust in the mind of Mr. A. The social engineer sends the holiday proposal in a PDF format which is not compatible with the PDF reader installed by Mr. A, and along with the proposal sends a compatible PDF reader for Mr. A to download and read the proposal. The PDF reader has malware attached that gives the social engineer access into Mr. A’s computer Another example of this type of social engineering attack is where a very pretty woman, who is a journalist, goes to meet the system administrator of a big company, to get his opinion on cyber security. She goes easy and flirts with him and after taking his opinion pushes off. In the course she ‘accidently’ leaves her pen drive behind with him. The ensuing impact of the girl would make him curious to know more about her and hence he accesses her pen drive. The pen drive is infected with key logger and Trojan malware, which make the company’s networks very vulnerable. The 4 basic principles which most social engineers follow are: They project confidence: They do not sneak around, they proactively approach people and draw attention towards themselves. They give you something: Probably just a small favor which creates trust and a perception of indebtedness. They use humor as that is one tool which is endearing and disarming. They make a request and offer a reason and research shows people are likely to respond to any reasoned request. Attacks by social engineers are offences in India under Section 43 of the Information Technology Act, 2000. This section reads as under: Penalty and compensation for damage to computer, computer system etc. If any person without the permission of the owner or any other person who is in-charge; Accesses or secures access to such computer, computer system or computer network or computer resource; Downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; Introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network; Damages or causes to be damaged any computer, computer system or computer network, data, computer database or any other programmes residing in such computer, computer system or computer network; Disrupts or causes disruption of any computer, computer system or computer network;] Denies or causes the denial of access to any person authorised to access any computer, computer system or computer network by any means; Provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder; Charges the services availed by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network, Destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means; he shall be liable to pay damages by way of compensation to the person so affected. 〈 “A victim is required to make a Complaint in the prescribed format along with the applicable fees to The Adjudicating Officer, Information Technology Act, 2000. Under the provisions of the Rules for the conduct of Adjudicating Proceedings, the Adjudicating officer shall decide every application in 4 months and the whole matter in 6 months “ 〉 The biggest weakness lies not in computer systems, but lies in human…

INTERPOL Digital Security Challenge

MassMediaLink India LLP SecurityLink IndiaMarch 5, 2018November 14, 2024010 mins

Do you know how to protect your webcam from being hacked? Would you know if a cybercriminal was using your printer to carry out cyberattacks? While most of us are aware of the dangers that cybercriminals can pose to our computers and mobile phones and take steps to protect them, we seldom consider how these threats can affect the growing number of Internet vc connected devices we use in our daily lives. The ‘Internet of Things’ All devices which can connect to the Internet – collectively called the ‘Internet of Things’ or IoT – are potentially at risk of a cyberattack. Everyday personal items like video cameras, refrigerators and televisions can be used by cybercriminals for malicious means. Cyberattacks targeting or using IoT devices have increased significantly in the past two years, according to several reports from the private cybersecurity industry. An example was the Mirai botnet, which in 2016 infected tens of thousands of devices, mostly Internet routers, with weak password security. These were then used in coordinated distributed denial of service (DDoS) attacks against websites worldwide including a university and several media sites. In the world of cybercrime, the number of IoT devices a criminal has access to is seen as a sign of their status. Although police around the world are developing the skills necessary to forensically examine computers and mobile phones, they are often not aware of how to collect evidence from other connected devices. The latest edition of the INTERPOL Digital Security Challenge tackled this threat, with 43 cybercrime investigators and digital forensics experts from 23 countries investigating a simulated cyberattack on a bank launched through an IoT device. “Cybercrime investigations are becoming more and more complex and operational exercises such as the Digital Security Challenge, which simulate some of the hurdles that investigators face every day, are vital for the development of our capacities,” said Peter Goldgruber, Secretary General of the Austrian Ministry of the Interior. Meeting the challenge I n the scenario, cybercriminals attacked a bank in an attempt to steal large sums of money. The investigators analysed the bank’s computers to identify the date, time and files where the malware installed by the criminals. Through this digital forensic examination, the teams discovered the malware was contained in an e-mail attachment sent via a webcam which had been hacked, and not directly from a computer. This is an emerging modus operandi, as it is more difficult to identify the source of the attack. Once the teams accessed the digital data held by the compromised webcam, they identified the command and control server being used to remotely control the device to conduct the cyberattack. Further evidence led to the identification of a second command and control server, and the investigators identified technical vulnerabilities of the servers which could be used to prevent further attacks. Noboru Nakatani, Executive Director of the INTERPOL Global Complex for Innovation said the scenario provided a learning experience on how to conduct real-world investigations more effectively. “The ever-changing world of cybercrime is constantly presenting new challenges for law enforcement, but we cannot successfully counter them by working in isolation. “A multi-stakeholder approach which engages the expertise of the private sector is essential for anticipating new threats and ensuring police have access to the technology and knowledge necessary to detect and investigate cyberattacks,” said Mr Nakatani. Tips for safeguarding IoT devices: Change the factory default passwords – these can be the same for hundreds or thousands of devices, making it easy for criminals to hack; Regularly update all software; Disable features which allow the device to be accessed remotely; Take extra care when buying used devices – you don’t know what the previous owner installed on the device. Sharing expertise Conducted annually, INTERPOL’s Digital Security Challenge helps police worldwide develop the skills necessary to tackle the latest cybercrime threats. The first two events in 2016 and 2017 simulated cyber blackmail involving bitcoin and a ransomware attack. This year’s three-day (19-21 February) event was organized in close I n the Americas, hurricanes, tornadoes and earthquakes are occurring more frequently, so unimpeded mass communication during these events is critical. MNS software is often employed so companies can communicate with their employees, federal agencies, university students and the general public. More channels of communication available in these types of events, means more people can reach safety faster and more lives can be saved. In Western Europe, the second-largest market for MNS software, weather-related incidents occur less often, How Catastrophic Events are Changing Mass-Notification System Market By Robert Brooks – Analyst, Security and Building Technologies, IHS Markit cooperation with the INTERPOL National Central Bureau in Vienna and private sector partners NEC Corporation and Cyber Defense Institute. “NEC has contributed as a strategic partner to INTERPOL’s commitment to improve the cybersecurity skills of investigators throughout the world. For the third year, NEC is honored to have helped develop the Digital Security Challenge by providing our expertise at this cutting-edge event,” said Kozo Matsuo, Vice President of NEC Corporation’s Cyber Security Strategy Division.’ Training sessions to develop participants’ practical knowledge on IoT device analysis and the latest trends in malware-related crime were delivered by specialists from NEC Corporation, InfoSec, Meiya Pico, SECOM, Kaspersky Lab and Trendso the need for MNS software is lower than in the Americas. While individual countries might deal with specific weather threats – like blizzards and freezes in Sweden and flooding in the UK – in 2017 the United States alone experienced four major hurricanes. Mass-notification system (MNS) software used in emergency communication, the primary segment used during a catastrophic event, is expected to grow in the Americas at a compound annual growth rate (CAGR) of 6.8 percent from 2017 to 2021, reaching $293.1 million in 2021. Micro. Support was also provided by the UN Office on Drugs and Crime (UNODC). Kenji Hironaka, President of Cyber Defense Institute said, “We are proud to have provided forensic content and technical support during all three INTERPOL Digital Security Challenge events. We will…

Security Considerations for Code Signing

MassMediaLink India LLP SecurityLink IndiaMarch 4, 2018November 14, 2024035 mins

Recent security-related incidents indicate the need for a secure software supply chain to protect software products (also referred to as code) during the development, build, distribution, and maintenance phases. Of particular concern is provisioning and updating software that plays a critical role in platform security. A wide range of software products including firmware, operating systems, mobile applications, and application container images must be distributed and updated in a secure and automatic way to prevent forgery and tampering. An effective and common method of protecting software is to apply a digital signature to the code. Digitally signing code provides both data integrity to prove that the code was not modified, and source authentication to identify who was in control of the code at the time it was signed. When the recipient verifies the signature, he is assured that the code came from the source that signed it, and that it has not been modified in transit. “NIST plans to develop further guidance to help organizations evaluating, deploying or managing code signing systems. The high-level recommendations described in this document are expected to form the basis for more detailed recommended practices for code signing” This white paper targets software developers and product vendors who are implementing a code signing system or reviewing the security of an existing system, with the goal of achieving improved security and customer confidence in code authenticity and integrity. System integrators and administrators who are concerned about the trustworthiness of the applications that are installed and run on their systems will learn the properties they should expect from a code signing solution to protect their software supply chain. This white paper describes features and architectural relationships of typical code signing solutions that are widely deployed today. It defines code signing use cases and identifies some security problems that can arise when applying code signing solutions to those use cases. Finally, it provides recommendations for avoiding those problems, and resources for more information. Properly applied, these recommendations will help to ensure that the software supply chain is resistant to attack. NIST plans to develop further guidance to help organizations evaluating, deploying or managing code signing systems. The high-level recommendations described in this document are expected to form the basis for more detailed recommended practices for code signing. The basics of code signing This section provides high-level technical details about how this process works. There are multiple roles in the process: developer, signer and verifier. Developer The developer is the entity responsible for writing, building, and/ or submitting the code that will be signed. This entity maintains a secure development environment, including the source code repository, and will submit code to the signer after it has completed the organization’s software development and testing processes. Signer The signer is the entity responsible for managing the keys used to sign software. This role may be performed by the same organization that developed or built the software, or by an independent party in a position to vouch for the source of the code. The signer generates the code signing private/ public key pair on a device that is sufficiently protected, as the security of this process relies upon the protection of the private key. In many cases, the signer then provides the public key to a certification authority (CA) through a certificate signing request. The CA will confirm the signer’s identity and provides a signed certificate that ties the signer to the provided public key. Anyone can use the public key associated with this certificate to validate the authenticity and integrity of code signed with this key pair. If no CA is used, the public key must instead be distributed using a trusted, out-of-band mechanism. The signer ensures through technical and procedural controls that only authorized code is signed. When code is submitted by developers for signing, the signer verifies their identities and their authority to request a signature. The signer may also take additional steps to verify the code is trustworthy. Ultimately, two or more trusted agents of the code signing system may be needed to approve the request and generate a digital signature. In some cases, the signed code may also be provided to a time stamp authority to indicate when the code was signed. Verifier The verifier is responsible for validating signatures on signed code. The verifier may be a software component provided by the same developer as the signed code (e.g., for a signed firmware update), or it may be a shared component provided by the platform (e.g., the operating system). Architectural components The code signing architecture is composed of a set of logical components that are responsible for different aspects of the code signing process. The code signing/ verifying architecture represented in Figure 1 potentially has four distinct components: the code signing system (CSS), the certification authority (CA), the time stamp authority (TSA), and the verifier(s). Code signing system (CSS) The first component, the CSS, receives code submitted for signing, authenticates and authorizes the submitter, and generates the signature. To generate these signatures the CSS has one or more private signing keys, which need to be carefully protected from extraction or unauthorized use. Certification authority (CA) Typically, a CSS utilizes a CA to enable authenticating the identities of signers. CAs issue certificates to signers in accordance with certificate policies, which specify the security controls and practices the CA follows when issuing certificates, and impose requirements on the subjects of the certificates. NIST Interagency Report 7924 is a reference certificate policy that specifies most of the requirements for a CA that issues code signing certificates. There are also industry groups such as the CA/ Browser Forum and the CA Security Council, that have published requirements documents for the issuance of code signing certificates. Time stamp authority (TSA) Some code signing architectures use a TSA to demonstrate when a particular piece of code was signed. When a TSA is used, signatures are sent to the TSA which applies its own signature and signing time to the package….