This podcast is brought to you by the Greater Lafayette Security Professionals (GLSP) group and the Center for Education and Research in Information Assurance and Security (CERIAS) at Purdue University.

Show Notes

Hosts

• Preston Wiley, CISSP, CCNA
• Mike Hill, CISSP
• Keith Watson, CISSP, CISA

Announcements

• The CERIAS Security Seminar is complete for the Spring semester. Speakers for the Fall semester will be announced on future podcasts. Until then, you can find past content on the CERIAS web site.
• The meeting notes from the May 10th meeting have been posted to the GLSP wiki.
• The Greater Lafayette Security Professionals June meeting will be on June 14, 2012.

Security Updates

• Microsoft releases many updates, May 8th
• Apple releases iOS updates, minor Mac OS X updates, security updates, May 10th
  • Mac OS X 10.7.4 update (contains Safari 5.1.6) 
  • iOS 5.1.1
  • Safari 5.1.7 for Mac OS X 10.6 and Windows
  • Security Update 2012-002 for Mac OS X 10.6

• Google updated Chrome to version 18.0.1025.168, April 30th

• Adobe updated Flash to version 11.2.202.235, on May 4th

Tools Discussion

• Mac OS X Disk Image Encryption for Web-based Storage Services
  Create with Disk Utility or ``diskutil`` command-line tool.
  • Use a sparse bundle disk image (for 10.6 and up) if you want to continue adding files to the image and want to conserve space. The disk image is just large enough to hold the files in it and expands to its maximum size as you add files to it. For example, if you create a 100 MB sparse bundle disk image, its maximum size is 100 MB.
  • Use a read/write disk image for a single file. The entire file is uploaded on synchronization. This can take a while.
  • Disk image is protected with AES 128 or 256 bit crypto.
  • Can be mounted as an image and unmounted when finished.
  • The disk image is stored in “band files”, so only the band file that contains the updated files is synchronized, saving time and bandwidth.
  • Conflicted copies of the individual band files is still possible if you have two images open at the same time on different machines or the synchronization has not completed before you open mount the image.

• TrueCrypt
  

  • Free open-source on-the-fly encryption available for Windows(7/Vista/XP/2000), Mac OS X, and Linux
  • Creates a virtual encrypted disk within a file and mounts it as a real disk.
  • Supports the following encryption algorithms: AES, Serpent, and Twofish.
  • Also supports cascading algorithms: AES-Twofish, AES-Twofish-Serpent, Serpent-AES, Serpent-Twofish-AES, Twofish-Serpent,
  • Encrypts an entire partition or storage device such as USB flash drive or hard drive.
  • Encrypts a partition or drive where Windows is installed (pre-boot authentication).
  • Encryption is automatic, real-time (on-the-fly) and transparent.
  • TrueCrypt can run in so-called portable mode, which means that it does not have to be installed on the operating system under which it is run
  • Parallelization and pipelining allow data to be read and written as fast as if the drive was not encrypted.
  • Encryption can be hardware-accelerated on modern processors.
  • Provides plausible deniability, in case an adversary forces you to reveal the password.

• BoxCryptor
  

  • Can be used for client side encryption with nearly any cloud storage solution.
  • Creates an encrypted folder in the disk which will mount as a disk on the device.
  • Each file is stored as a separate, encrypted file with its name also encrypted. This means that if a single file gets updated, it is the only file that needs to be synced to the cloud storage service.
  • Because it uses file-by-file encryption and not container files, there is no need to manage the size of the encrypted volume.
  • Uses the AES-256 encryption standard and supports Windows, Linux, Mac OS X, Android, and iOS. Some of this support is through the use of EncFS.
  • The free version is limited to a single encrypted folder with a total of 2GB of data. Cost of the unlimited version varies by device, with the Windows version having a fixed cost of $39.99 for the unlimited personal version.