• "Dropping support for a broken crypto primitive is hard in practice
    - but crypto can be broken overnight
    -
    what do we do if SHA-1 or RSA falls tomorrow?"

    Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, Benne de Wegerr, "MD5 considered harmful today - Creating a rogue CA certificate", December 2008
    Read more...
  • "First and foremost, there is no proper excuse for continued use of a broken cryptographic primitive (MD5) when sufficiently strong alternatives are readily available, for example SHA-2. Secondly, there is no substitute for security awareness." ... "Advice from experts should be taken seriously and early in the process. In this case, MD5 should have been phased out soon after 2004."

    Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik, Benne de Wegerr, "MD5 considered harmful today - Creating a rogue CA certificate", December 2008
    Read more...
  • “Assurance is best addressed during the initial design and engineering of security systems, NOT as an after market patch. The earlier you include a security architect in your design process, the greater the likely hood of a successful and robust design. As the quip goes, he who gets to the (module) interface first wins.”

    Brian Snow, Former Technical Director of the US National Security Agency (NSA), "We need Assurance", AusCERT 2008

    Read more...
fact: Security is a process
Synaptic Facts and FAQs - Security in general


A mantra of the well known security expert Bruce Schneier, founder of BT Counterpane and a pioneer in the development of Managed Security Monitoring, is that "security is a process, not a product". Security cannot be achieved by just adding strong cryptographic algorithms to a computer system. Implementations of the cryptographic algorithms reside within complex computer systems. These complex computer systems then interact with even more complex human dynamics.  A failure anywhere in this ecosystem can seriously compromise security. Security must be addressed at a holistic level and as an ongoing process involving the entire organisation and all its parts. To learn more about security as a process read Schneier's article here.

Taking the above into account, modern cryptographic security systems still rely on the security of the choice and configuration of cryptographic algorithms. Algorithms such as DES with a 56-bit key are no longer used because they fail to provide adequate security, failing in practice against attackers who can afford US$10,000 to mount the attack. If a central cryptographic component of the crypto system fails, security may be entirely lost.

Synaptic has designed our security ecosystem to strengthen the security process, not just the cryptographic components. Click here to read more about Synaptic Labs' line of argument. Click here to read more about risks facing mainstream cryptographic systems today. 

Last Updated on Friday, 16 January 2009 13:28
 

Related Items