A massive GDPR fine, threats against critical infrastructure, and spyware took over the headlines this past week. Catch up on all of these stories in this week’s Friday Five!

Data is the cornerstone of the digital economy, but its constant generation creates challenges for organizations. One such challenge is storing and managing the data securely throughout its lifecycle–namely–creation, storage, processing, archival, and disposition.

Despite law enforcement’s best efforts to combat and take down cybercriminals, home routers, Android phones, and Android-based TV boxes are all being threatened by new malware. Catch up on all the latest in this week’s Friday Five!

With ChatGPT in the news almost daily these days, users should know that Digital Guardian’s data loss prevention solutions can help highlight and mitigate data loss risks associated with deep learning large language models.

Defending against distributed denial-of-service (DDoS) attacks is always top of mind for defenders. In this blog we break down what a DDoS attack is, different types, and tips for fending off a DDoS attack.

Intellectual property is one of the cornerstones of modern capitalism. It encourages entrepreneurial risk-taking by ensuring individuals, organizations, and businesses reap the rewards of their creative ingenuity.

Learn about the benefits of implementing the principle of least privilege in Data Protection 101, our series on the fundamentals of information security.

Learn about approaches to data protection for data in transit vs. data at rest in Data Protection 101, our series on the fundamentals of data security.

CPRA enforcement is only months away, so here’s everything that organizations need to know about how it differs from the CCPA, how CCPA compliance will be different moving forward, and whether or not the changes will apply to your organization.

Learn how a malware gang’s tactics are being used against them, how the Department of Homeland Security is facing new threats head-on, an ambitious project to create a more secure OS, and more—all in this week’s Friday Five!

Financial services companies will have to retool their cybersecurity policies when the new version of NYDFS Cybersecurity Regulation, including a core risk assessment requirement, goes live.

The proliferation of cloud computing has heightened the need for organizations to monitor and manage the safe use of cloud services. Cloud access security brokers, or CASBs, provide the necessary security features to protect cloud-based resources as they’re accessed while also detecting threats and controlling data that flows through the cloud. What Are the 4 Pillars of Cloud Access Security Brokers (CASBs)? A cloud access security broker is either an on-premise or cloud-hosted software strategically placed between the service consumers and the cloud service providers. Its primary role is to enforce security policies with features like malware detection, encryption, authentication, credential mapping, tokenization, and regulatory compliance. In essence, a CASB is an added layer of security that acts like a firewall. It also enables organizations to extend the reach of their security controls beyond network boundaries. Consequently, this empowers CISO/CIOs to protect mission-critical data in their enterprise, like intellectual property (IP), personally identifiable information (PII), and comply with payment card industry (PCI) standards. To accomplish this, a CASB is based on foundational building blocks, such as the following: 1. Data Security With its on-demand computing, the cloud has boosted data movement and collaboration at a distance. However, this seamless interaction with data has made it more vulnerable, especially when it exits outside the network perimeter. This widened attack surface comes at a considerable cost to businesses that must protect sensitive data such as customer information, intellectual property, and trade secrets. To strengthen data security, a CASB is equipped with sophisticated tools to minimize the risk of costly leaks. These typically encompass a range of data protection and monitoring tools, including cloud data loss prevention (DLP) mechanisms, to protect sensitive data and battle shadow IT. In the CASB arsenal, other tools to prevent data leaks include encryption mechanisms, information rights management, authentication & authorization, access control, and tokenization. 2. Visibility Visibility is paramount if organizations are going to identify and protect sensitive data, whether it’s at rest or in motion. The visibility challenge that enterprises typically struggle with is the specter of having too many employees across multiple cloud environments juggling data at various endpoints. Having a CASB enables organizations to discover all their data in use, pinpoint shadow IT, scope redundancies, evaluate license costs, and provide reports on cloud expenditures. As a result, the capabilities of a CASB can equip organizations with visibility to observe how sensitive data travels, whether in the cloud, to and from the cloud, or from cloud-to-cloud environments. 3. Compliance The importance of data and its mass migration to the cloud has underscored the need for robust personal privacy protections. With the raft of regulatory laws around securing PII passed in recent years, enterprises increasingly face complex security enforcement demands. Aside from regulations with an international scope like the General Data Protection Regulation (GDPR), enterprises in different business verticals need to monitor their compliance with laws governing their respective industry. Fortunately, CASBs are equipped for such versatility, ensuring that healthcare providers can comply with the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Health Insurance Portability and Accountability Act (HIPAA); financial service organizations are in line with the Federal Financial Institutions Examination Council (FFIEC) and the Financial Industry Regulatory Authority (FINRA) and retailers are aligned with Payment Card Industry Data Security Standard (PCI DSS) compliance. Traditional security systems are usually insufficient to monitor enforcement between users and cloud-based systems, especially across multiple locations and devices. Having a CASB in place helps facilitate cloud governance and risk assessment by providing security teams with the appropriate guidance on resolving multiple risk areas. 4. Threat Protection With how fast data is passed through cloud-based services, organizations must proactively identify and isolate threats. Fortunately, today’s CASBs are equipped with cutting-edge technology that enables them to evolve continuously in their ability to detect anomalous behavior. Powered by intelligent automation tools and AI in the form of machine learning, CASBs can help thwart zero-day threats, ransomware, and advanced persistent threats. They can also integrate the principle of least privilege (POLP) controls to prevent attackers who have breached the network from moving laterally to access sensitive data. How Does a CASB Work? The main goal of a CASB is to secure data flowing through an organization’s IT infrastructure, both on public cloud vendors and on-premise environments. To achieve this, CASBs primarily use a three-part process: Discovery: As the name implies, discovery seeks to unearth and pinpoint all cloud applications, especially third-party services, automatically. CASBs can identify apps as well as the employees affiliated with them. Classification: CASBs use data classification to identify and prioritize data, evaluate each cloud application, and determine its security risk levels. Classification also facilitates the understanding of how an application is used, the kind of data it consumes, and how it is shared within the app. Remediation: CASBs don’t stop at identifying threats; they can also mitigate vulnerabilities after discovering the risk levels encountered in cloud services. Consequently, CASBs can leverage this information to create tailored policies to address the organization’s security requirements. They can take action automatically to fix any security violations according to policy. The Main Use Cases of CASBs While CASBs provide many security benefits, their main use case is safeguarding proprietary data like trade secrets and intellectual property in third-party, external-facing media like public cloud environments. In addition, CASBs also bridge the gap between capabilities not found in traditional firewalls and secure web gateways (SWGs). Here are the common use cases associated with having a CASB: Protect against cybersecurity threats: CASBs employ mechanisms such as continuous monitoring, threat intelligence gathering, and anomaly detection to fight against malware, ransomware, and advanced persistent threats. Threat prevention and activity monitoring: By leveraging user and entity behavior analytics, CASBs can establish a baseline of expected behavior and flag any deviation while establishing granular control of cloud usage. Boosting risk visibility: CASBs can identify high-risk vulnerabilities and accurately assess risk contextually, subsequently setting appropriate mitigation policies. Shadow IT assessment and management: CASBs offer much-needed insight into sanctioned and unsanctioned applications. Having visibility into cloud services can help uncover rogue applications while delivering a comprehensive picture of your risk profile and any security measures in place. Data loss prevention: CASBs can prevent data leakage and unauthorized access to sensitive data like proprietary information, in addition to financial, health, social security, and credit card numbers. This involves using robust user verification to control cloud-native resources, especially during collaboration and sharing, while blocking shared document downloads. Maintaining regulatory compliance: With tools like encryption, key management, and DLP, CASBs can provide sufficient protection to handle problems related to local laws and data residency – the physical or geographic location of an organization’s data or information. This can help your organization meet regulatory requirements. As a result, data is safeguarded throughout its lifecycle while meeting compliance. Configuration auditing: Improper cloud configurations can create systemic risks for organizations. Unfortunately, most cybersecurity misconfigurations are self-inflicted. A recent Gartner report pointed out that 99% of cloud security failures are due to the customer. Configuration auditing with a CASB allows you to spot improper cloud misconfigurations, default passwords, and easily compromised settings. Adaptive access control: CASBs provide flexible and contextual cloud-based access control, whether to enforce location-based or endpoint policies. How Can Fortra/Digital Guardian Secure Collaboration Help Me with a CASB? Fortra/Digital Guardian Secure Collaboration has extensive expertise working with CASBs to protect sensitive data. Digital Guardian Secure Collaboration’s capabilities are bolstered by a data-centric security model based on rights management and DLP. Learn more about cloud-based access security brokers and how we can extend file protection in the cloud.

CISA has released new guidance for Zero Trust Security and secure-by-design principles for software manufacturers, Russian hackers were linked to attacks against NATO and the EU, and more. Catch up on all the latest stories in this week's Friday Five!

Looking to bolster your Amazon Web Services (AWS) container security? Fortra's AlertLogic team has pulled together three tips to help secure your container ecosystem.

Data Encryption Algorithm Methods & Techniques Every company has sensitive data that it needs to protect, yet extracting value from your data means that you must use it, whether that means feeding it to a data analytics tool, sharing it with partners or contractors, or even simply storing it in the cloud or on a USB. While you can take steps to prevent unauthorized access to your network and sensitive data, what happens if a cyberattacker breaks through your defenses? It's considered an essential best practice for data loss prevention. What is Data Encryption? Data encryption is a widely used approach to rendering data uninterpretable should unauthorized users gain access to it. Using a data encryption algorithm, data encryption translates data from its raw, plain text form (plaintext data) — which is easily readable by anyone who accesses it — to a complex form or code (ciphertext) that's unreadable and unusable unless the user has a decryption key or password that will "decrypt" the data by translating it back to its plain text format. For example, if a cybercriminal gains access to a database containing customers' Social Security numbers, but the data is encrypted, the attacker can gain no value from it. Because they can't interpret the true Social Security numbers, they can't use the data for identity theft, and they can't sell it on the dark web. There are two primary types of data encryption algorithms: Asymmetric encryption, also known as public key encryption, which uses two keys: a public key and a private key. The public key is used to encrypt the data, and the private key is used to decrypt the data. The private key is carefully protected, shared only between the sender and receiver of the data. Symmetric encryption, which uses the same key to encrypt and decrypt data. A hash function is another method involved in data encryption. Hashing uses an algorithm to translate data of any size to a fixed length, resulting in a hash value, rather than the ciphertext produced by encryption algorithms. Hashing is used to verify that data has not been altered from its previous state during transmission. For example, if one person is sending a sensitive file to another user and the user needs to confirm the integrity of the data, the original person can send a hash value along with the data. The recipient can then calculate the hash value of the data they've received. If the data hasn't been altered, the two hash values will be the same. Data encryption enables: Authentication: Did the data come from where it claims or appears to? Integrity: Is the data unchanged from before transmission? Non-repuditation: The sender cannot deny sending or transmitting the data. Data encryption doesn't prevent attackers from gaining entry to your network or systems, but it does ensure that your data cannot be read or interpreted even if it's accessed by a malicious actor. 50 Data Encryption Algorithm Methods & Techniques for Effective Data Encryption Let's take a look at some of the most well-known and commonly used data encryption algorithm methods and techniques, as well as some common hash functions. They're grouped by the type of algorithm and listed alphabetically within each category. Asymmetric Data Encryption Algorithms 1. Blum–Goldwasser (BG) cryptosystem. The Blum-Goldwasser cryptosystem is a probabalistic public-key encryption scheme that was proposed back in 1984 by Manuel Blum and Shafi Goldwasser that comprises three algorithms, including a probabalistic encryption algorithm, a deterministic decryption algorithm, and a probabilistic key generation algorithm to produce a public key and a private key. This semantically-secure cryptosystem that has a consistent ciphertext expansion. As it uses a probabalistic algorithm, the BG cryptosystem can produce different ciphertexts each time a set of plaintext is encrypted. That is advantageous as cybercriminals intercepting data encrypted with the BG algorithm cannot compare it to known ciphertexts to interpret the data. 2. Boneh–Franklin scheme. The Boneh-Franklin scheme was the first practical identity-based encryption (IBE) scheme. Proposed in 2001 by Dan Boneh and Matthew K. Franklin, the Boneh-Franklin scheme is based on bilinear maps between groups, such as the Weil pairing on elliptic curves. The Private Key Generator (PKG) in the Boneh-Franklin scheme can be distributed so that to ensure that the master key is never available in a single location by using threshold cryptography techniques. 3. Cayley–Purser algorithm. The Cayley-Purser algorithm was developed by Sarah Flannery in 1999 and was inspired by Michael Purser's ideas for a Young Scientist competition in 1998. The algorithm is named after Purser and the mathematician who invented matrices, Arthur Cayley. Rather than modular exponentiation, the Cayley-Purser algorithm uses only modular matrix multiplication. It's about 20 times faster than RSA for a modulus consisting of 200 digits and is most other public-key algorithms for large moduli. However, it has since been discovered that data encrypted with the Cayley-Purser algorithm can be decrypted easily using knowledge of public data. 4. CEILIDH. The CEILIDH public-key cryptosystem, which is based on the ElGamal scheme and has similar security properties, was introduced by Alice Silverberg and Karl Rubin in 2003. Based on the discrete logarithm problem in algebraic torus, CEILIDH's primary advantage is its reduced key size compared to basic schemes for the same level of security. Named after Alice Silverberg's cat, this cryptosystem's name is also a Scot Gaelic word to describe a traditional Scottish gathering, 5. Cramer–Shoup cryptosystem. The Cramer–Shoup cryptosystem is an extension of the ElGamal scheme developed by Ronald Cramer and Victor Shoup in 1998. It incorporates additional elements compared to ElGamal to ensure non-malleability and was the first scheme proven to be effective at securing against chosen-ciphertext attack (CCA) in the standard model. 6. Crypto-PAn. Crypto-PAn (Cryptography-based Prefix-preserving Anonymization) is a type of format-preserving encryption that's used to anonymize IP addresses while preserving the structure of their subnets. It was invented in 2002 by Jinliang Fan, Jun Xu, Mostafa H. Ammar from Georgia Tech, along with Sue B. Moon and was inspired by Greg Minshall's TCPdpriv program in 1996, which adopted IP anonymization. Crypto-PAn has been found to be vulnerable to fingerprinting and injection attacks. 7. Diffie-Hellman. The Diffie-Hellman algorithm, developed by Whitfield Diffie and Martin Hellman in 1976, was one of the first to introduce the idea of asymmetric encryption. The general concept of communication over an insecure channel was introduced by Ralph Merkle in an undergraduate class project called Ralph's Puzzles, which is now deemed to be one of the earliest examples of public key cryptography. Also known as the Diffie-Hellman key exchange, it's a mathematical method that enables two unfamiliar parties to exchange cryptographic keys over a public channel securely. While it's a non-authenticated key-agreement protocol, it serves as the basis for numerous authenticated protocols. 8. El Gamal. The El Gamal encryption algorithm, based on the Diffie-Hellman key exchange, was developed by Taher Elgamal in 1985. The security strength of this algorithm is based on the difficulty of solving discrete logarithms. One downside is that the ciphertext generated by El Gamal is two times the length of the plaintext. However, it creates a different ciphertext each time the same plaintext is encrypted.

Organizations use various types of data security controls, along with their corresponding implementation methods, to safeguard their digital assets. This article delves into the main types of data security controls, their associated technologies, and how to implement them for maximum impact.

Read up on TikTok CEO Zi Chew’s largely unsuccessful testimony, a concerning series of stealthy Chinese hacks, the arrest of a malware creator, and more in this week’s Friday Five!

There's no shortage of data that can be classified. To help you build an effective data classification policy, we look at 50 different examples of data classification.