Security session

security session

what should we cover?

• developing a mobile app that works with big data
• what is safe? where to store data? devices/online/mobile/desktop?
• what should nonprofits' top concerns be?
• practical aspects of encrypted email? clumsy & time-consuming. how to really implement?
• little brother

general intro

• concept of encryption: scrambling the information going from here to there
• public key encryption - even the idea of keys is unfamiliar, explain by analogy to simple ciphers (alphabet shift 8 to the right) used by kids.

encryption costs - what are they?

• buy ssl cert
• the work to get and install cert
• resources (slows your site down), but not too relevant these days for most

four basic concepts

1. Data in motion, ie. while being transferred/downloaded. assume that all communication is being recorded forever. much of it stored and analyzed later. so encryption and learning to encrypt is a statement of movement solidarity - choosing not to encrypt is a policy and political decision that affects others. encryption raises the cost of surveillance.

• email - use ssl & pgp
• web - https everywhere tries to promote http up if possible. even if you don't feel you're serving risky content, you don't know who's looking at your site. could be someone in a country where what you're doing is illegal, and they can be spied on if unencrypted.
• IM - off-the-record messaging (OTR), encrypts your communicatoins even if you're talking through google or yahoo or whoever.

2. Data at rest: stuff that's stored on any of your media, on all your devices, in your pocket and in the cloud. what can happen?

• lose it
• stolen (prolly just for profit)
• seized by law enforcement. if you're arrested, they pop your iphone into their dock and it sucks every bit of info off it. illegal search and seizure, but they're still doing it. need to encrypt your data so that someone accessing it still can't read it.
• if in the cloud, you just have no idea what kind of access someone might get. but look for encryption capabilities on your cloud there. but security of your data is also about choosing your provider, someone that cares and will fight to protect your data, not just roll over to a subpoena.

3. Operational security: put passwords on everything, change them often, make them strong. also policies on what data leaves the office.

4. Physical security: you can do everything else right, but if the door's unlocked, or don't change locks after losing disgruntled employee, or you don't know where your backups are or they're unencrypted, the rest is for nought.

how to actually move over to encryption?

• back up, back up, back up
• try linuxmint... and it's non-trivial, but good strategy is for one brave committed soul to try it out, use two laptops for a while, and make the final switch when ready
• aspiration has a linuxmint laptop loaner program for this purpose
• the first thing that happens on power up, before anything boots, is your password to the encrypted volume. from there you're just using it the same as always.

crossing borders is a critical danger point for security - needs lots of self education and precaution. what type of data are surveillers most interested in? social graphing. your communications network profile identifies you as uniquely as anything else in the world short of DNA. LEAP: leap.se Leap Encrypted Activist Platform: trying to hide the social graphi inside of encryption, ie. hiding even whom you're talking to (normally visible even if contents are encrypted)

on specific questions:

• mobile app with big data: make sure security concerns are part of the conversation from the start. makes it work much better, and be much cheaper. data minimilism - only collect what you actually need. and think about sunsetting data after no longer needed, and anonymizing any data you can.
• what is safe to download? nothing. operate from a frame of distrust. every piece of software you install increases your vulnerability. if you want to be scared, look up fin fisher on wikipedia. on the other hand, citizen lab out of toronto is studying and documenting the evil bastards. and on the bad side again, bluecoat routers. a lot of games are "surveillance apps", ie. for advertising, not law enforcement.
• your phone has a whole nother back-end OS on the radio chip that you can't touch
• top concerns: unpatched CMSes and unpatched everything. so #1 keep everything current. #2 is just throwing all your data up on random corporate clouds who do not care about you, and are in fact tied to government. can get the data, but also can ust block your access to it.

what about encrypted voice? skype is evil, always has been but even more now that it's inside microsoft. in skype chats, any link you put to anything online will be opened and downloaded by micorosoft. promising new thing coming out, jitsy, runs in a browser but only in chrome, which is spyware.