QSC: A multi-plugin framework used by CloudComputating group in cyberespionage campaigns

Kaspersky shares details on QSC modular cyberespionage framework, which appears to be linked to CloudComputating group campaigns. Continue reading QSC: A multi-plugin framework used by CloudComputating group in cyberespionage campaigns

Encryption password in program, to secure its centrally-stored settings?

I was thinking of implementing this in software, starting with one password, with each new release being derived from that initial password.
(trying to find the name of this technique, I think it’s called a “hash chain”)
That way you can g… Continue reading Encryption password in program, to secure its centrally-stored settings?

Why do best practices recommend against adding your own pepper to passwords before hashing?

According to my research, if you want to store passwords securely, you should use built-in hash functions that have been vetted by the professionals. Best practices recommend that you do not add a hard-coded pepper.
But why not?
Let’s say:… Continue reading Why do best practices recommend against adding your own pepper to passwords before hashing?

Google on scaling differential privacy across nearly three billion devices

In this Help Net Security interview, Miguel Guevara, Product Manager, Privacy Safety and Security at Google, discusses the complexities involved in scaling differential privacy technology across large systems. He emphasizes the need to develop secure, … Continue reading Google on scaling differential privacy across nearly three billion devices

White House to agencies: Don’t wait to test your post-quantum encryption

Federal agencies can spare themselves interoperability heartburn tomorrow by testing post-quantum encryption algorithms in live conditions today, official says.

The post White House to agencies: Don’t wait to test your post-quantum encryption appeared first on CyberScoop.

Continue reading White House to agencies: Don’t wait to test your post-quantum encryption