[LINK] All your internets are belong to us

[Crispin Harris]

Hi Stil, Karl, Tom and other linkers...

The 20% figure I quoted on the podcast was a flipant one - as you may well
appreciate.

Mostly this is based on a couple of factors:
 - Most organisations don't know what traffic is important.
   These organisations tend to not encrypt anything on the wire.
 - Of the organisations that do understand what is important,
   many value the transient information as less than the cost of encryption
 - of those that can justify the encryption, many have incomplete coverage.

My experience outside of those environments with Legislative requirement or
classification requirement is that VERY FEW actually encrypt any data(Note
1) in motion across thier internal
networks.

In my particular case, I am fortunate enough to say that data travelling
across networks where I do not control the routing tables is encrypted over
20% of the time (depending on the link and the traffic). We also encrypt a
pile of our email and are working on a much deeper implementation of
encryption of datra both at rest and in motion throughout the organisation.


(Note 1: Except authentication information - because Microsoft finally got
it right, and encrypts it for them by default)

Cheers,
    C

On Mon, Nov 22, 2010 at 3:56 PM, Stilgherrian <stil at stilgherrian.com> wrote:

>
> On 22/11/2010, at 6:47 PM, Karl Auer wrote:
> > On Mon, 2010-11-22 at 18:36 +1100, Stilgherrian quoted a story:
> >> In short, the Chinese could have carried out eavesdropping on
> >> unprotected communications — including emails and instant messaging —
> >> manipulated data passing through their country or decrypted messages,
> >> Dmitri Alperovitch, vice president of threat research at McAfee said.
> >
> > Key words "unprotected communications". Anyone using encryption would
> > have had no problem at all. Well, non-delivery maybe, but not the wrong
> > people reading it, and not "manipulation".
> >
> > "Decrypted messages" - how? Conspiracy theories aside, modern crypto,
> > available to all, is essentially unbreakable. The VP of threat research
> > should have had a great deal more sense than to say that, if he even
> > did.
>
> The McAfee VP was quoted in various places. I suspect McAfee's PR people
> were pimping him around heavily, but I did find him talking on NPR.
>
> http://minnesota.publicradio.org/features/npr.php?id=131423973
>
>
> >> “What happened to the traffic while it was in China? No one knows.”
> >
> > I do know that if one of my encrypted emails ended up there, no Chinese
> > malefactor would have been able to read it.
>
> On my podcast, Crispin Harris mentioned that only about 20% of traffic that
> should be encrypted is. I dunno where he got that figure from, but he
> watched Link and may chirp in.
>
> Stil
>
>
> --
> Stilgherrian http://stilgherrian.com/
> Internet, IT and Media Consulting, Sydney, Australia
> mobile +61 407 623 600
> fax +61 2 8569 2006
> Twitter: stilgherrian
> Skype: stilgherrian
> ABN 25 231 641 421
> _______________________________________________
> Link mailing list
> Link at mailman.anu.edu.au
> http://mailman.anu.edu.au/mailman/listinfo/link
>



-- 
Crispin Harris
crispin.harris at gmail.com
"A great deal of Security is unfortunately just like the underwear of
Brittany Spears.
If it's even there at all, it is needlessly complex and frilly; looks good
without actually covering much; and is far to easy to get around or remove
completely."
 - David Boston

Marriage (n): a natural institution whereby a man and a woman give
themselves to each other for life in an exclusive sexual relationship that
is open to procreation.
 -Definition compliements of Cardinal George Pell, Catholic Archdioces of
Syndey