Hmm,
apologies! tl;dr
sekio, words of wisdom!
The second quote is just me rambling on about the human influence on network/system security - I could obviously ramble on the topic for ages. :D
----------------------------
....Let's ignore the independently developed cryptography... e.g. the independent discovery of differential cryptanalysis, Rijndael and the NIST competition algorithms, etc. And the fact that the algorithms have been beaten on by academics all these years but nobody's found a flaw capable of breaking them - yet
.....
Either way, the problem is not the cryptography. Very rarely is it ever. The problem is implementing it. Key mangement and the like is the other half of the puzzle, and it's equally as important. if someone knows the key to your "unbreakable" cipher, or if they can just sneak into your office and read the cleartext while you're in the bathroom... your million-dollar NSA algorithm is useless.
.....
Welcomed words of wisdom (not to say that other posts weren't of course!
) Cryptology/cipher advancements - well not these says - aren't directed by some covert, men in black, Government officials sequestering the top-minds. Not to say Government cryto- programs don't exists, (afaik) R&D largely comes out of Universities (PhD's and research specialists/advisors) and security organisations (ie, OWASP: to note
open source (for which there are many in the same mentality. Kind of what "old hippies" would preach - PLUR - just 2013! or WhiteHat Security) .... that's not to deny Government don't provide funding (One would assume less so for profit organisations however).
You mention NSA, this is one of the best encryption algorithms known. Once encryption has performed, it is near impossible to decrypt without the public key, I'm most definitely not cipher/high level mathematician but having to studied the RSA algorithm (I might do a little revision); as with most innervations it's beauty is in it's simplicity!
RSA (algorithm) - encryption and decryption really aren't that a difficult processes. It's due to a curious feature of mathematics when two prime numbers are multiplied, it is very difficult to factor, that is to work out, the two original numbers. Mathematicians have been trying to find a way to do this quickly for hundreds of years and have failed so far. The agreement on key generation seems to be the difficult bit; the use of strong (every increasingly long) primes and the basic mod function is what decrypts it (and over simplification I'm sure).
....The human element is always the weakest link. Ask Kevin Mitnick about it!
.....
^^^ Listen to reason. (not really a "new" field of security now days, although one of the newest) Crackers
* specialise, and one speciality is that of
social engineering. Crackers
* now realise technology - especially with a closed/
air gap** network configuration - for anyone/group (excl. movements such as Anonymous) is unattainable using old methodologies (a nerd at a terminal, service/port/idle scanning/portsweeping [call it what you will] on an IP for vulnerabilities. DDoS attacks/taking down a server used to consist of just sending a packet greater than what the protocol could handle .... it was
that simple those days) so creative alternatives were concocted;
social engineering - essentially using one's charisma/charm to pull as much information from whatever source you can, finding a "weak link" in the chain (a [new] receptionist, confidence [handling oneself such that one should be there and not out of place], forged ID, knowing and convincing someone on the inside .... I think you get the idea.
As sekio said, the human element
is, and will
always be the weakest link in any system! Which is why regular and up to date training for
all employees is a must, developers/testers must be on the cutting edge of any flaw(s) in their own software (a comprehensive SDLC should include extensive testing [however the degree of testing/debugging depends on the specific SDLC chosen] to reduce these numbers), external SQA audits, utilisation of testing tools, and many many more steps can be put in place in mitigate software/system/infrastructure/etc. issues.
* A cracker is the real term for what the media have grabbed hold of and called "hackers".
** An air-cap network/computer is one in which there are absolutely no connection to the outside world. The system is stand-alone and does not have any connections to the Internet/VPN/etc.
)
