Slashdot Mirror
Cryptography 'Becoming Less Important,' Adi Shamir Says
Trailrunner7 writes "In the current climate of continuous attacks and intrusions by APT crews, government-sponsored groups and others organizations, cryptography is becoming less and less important, one of the fathers of public-key cryptography said Tuesday. Adi Shamir, who helped design the original RSA algorithm, said that security experts should be preparing for a 'post-cryptography' world. 'I definitely believe that cryptography is becoming less important. In effect, even the most secure computer systems in the most isolated locations have been penetrated over the last couple of years by a series of APTs and other advanced attacks,' Shamir said during the Cryptographers' Panel session at the RSA Conference today. 'We should rethink how we protect ourselves. Traditionally we have thought about two lines of defense. The first was to prevent the insertion of the APT with antivirus and other defenses. The second was to detect the activity of the APT once it's there. But recent history has shown us that the APT can survive both of these defenses and operate for several years.""
Encryption is the best anti-tampering mechanism you have in computing. Well placed encryption protects OS data from tampering, user data from theft, and sensitive communications secured. It's only getting more important.
To offset political mods, replace Flamebait with Insightful.
Would have been nice to define APT...
Have fun when Joe the Burgler takes your computer.
To offset political mods, replace Flamebait with Insightful.
Encryption doesn't do shit if they're grabbing it before encryption or after decryption. It's not a magic security bullet. It has its uses, but now it's become easier for Eve to hack Alice and read the plaintext than to intercept and brute-force the ciphertext. And when Alice is talking to not just Bob, but Carol and Dave, well, that makes Alice a high-value target worth spending time on.
I think what most of the people responding to this post aren't realizing (or acknowledging) is that your security needs to be appropriate for the data it's protecting.
If we're talking about a corporations backbone, then yeah saying "it's not connected to the internet" isn't acceptable.
If instead we're talking about some John Doe's personal data, then you aren't going to be attacked in the same way. Keeping it on a drive that has no internet access is probably good enough.
There are 10 types of people in the world. Those that understand this sig, and those that beat up people who do.
From TFA
One way to help shore up defenses would be to improve--or replace--the existing certificate authority infrastructure, the panelists said
Indeed. IMO SSL public keys could be stored in DNSsec protected DNS records. That way one would only have to trust the manager of the root zone and the TLD, which would be a good improvement compared to the CA debacle.
I was just having a discussion about this at work today. Encryption should be ubiquitous now. There is no excuse. It's not "free" in terms of the resources it takes up, but it's pretty close. Everything should be encrypted in transit. Everything should be encrypted at rest. "Well you mean the table with the PII and not...." NO! I mean EVERYTHING. The servers drive should be encrypted. The entire database should be encrypted. Every network connection should be encrypted.
This doesn't mean encryption is a panacea solution to APTs or to any other security threat, but its an absolutely critical layer which is still not widely implemented enough. To prevent tampering, to prevent certain types of attacks, to prevent breaches through physical theft, etc. Saying encryption isn't as important anymore is like saying that keyboards aren't that important anymore. Sure, management shouldn't spend a lot of time worrying about them, and should be focusing on other problems instead....but that doesn't mean everything will be cool if everyone's keyboard is stolen overnight.
It needs to be there, and by there I mean everywhere. And its not. Every day developers are looking at security guys like, "huh??" because they are looking for encryption to be incorporated into the product. Or, they want to "just get the system built out" without encryption, but they'll totally enable it once everything is working perfectly and all the testing is done (FYI developers, security guys aren't falling for that, we realize that you really mean, 'we'll think about enabling it until we realize how many things it will break, and then we'll ship the product without it, ignoring the enormous liability it creates'). You would think things would be different now that its 2013...they are different, but not that much different. Security still isn't regarded as a core piece, or even an important feature, of most products.
The larger problem here is motivation of software developers, white hats, and black hats. The developers; whether it be open source or proprietary, tend to code towards a particular functionality and usually with deadlines. The white hats are preforming a job function to the best of their ability usually no more than 40-50 hours a week in teams. Whereas, the black hat is playing a game or solving a puzzle for personal enjoyment reasons. Now, I'm not saying that there is any weakness to any of the aforementioned groups, but when people do things for enjoyment, it tends to yield a higher chance of success especially when the black hat needs only to find a single point of attack in a system that largely extends from the digital realm or job functions of the software developer or the infosec ops.