The FIDO Alliance announced two new standards and certification initiatives in identity verification and the Internet of Things (IoT). These initiatives build upon the Alliance’s ongoing focus on driving the efficacy and market adoption of FIDO Authentication by addressing adjacent technology areas that leave security vulnerabilities on the web.

Specifically, the Alliance aims to strengthen identity verification assurance to support better account recovery, and automate secure device onboarding to remove password use from IoT.

The Alliance has formed two new working groups: the Identity Verification and Binding Working Group (IDWG) and the IoT Technical Working Group (IoT TWG) to establish guidelines and certification criteria in these areas.

The FIDO Alliance will continue to focus on development and adoption of its user authentication standards and related programs and use them as a foundation for this expanded work, featuring contributions from current members and new industry participants.

“The FIDO Alliance has catalyzed a diverse set of stakeholders who have collaborated to answer the industry’s password problem through the standardization of FIDO Authentication – which has grown from concept to global web standard supported in leading browsers and platforms in just seven years,” said Andrew Shikiar, executive director and chief marketing officer of the FIDO Alliance.

“As we look at the threat vectors in the marketplace, however, it has become apparent that there’s a gap between the high assurance provided by FIDO Authentication standards and the lower assurance methods used in identity verification for account recovery and IoT authentication.

“This gap can be most effectively addressed through industry collaboration and standardization rather than siloed, proprietary approaches.”

Identity verification and binding working group overview

For accounts protected from phishing and other credential-based attacks with FIDO Authentication, the account recovery process when a FIDO device is lost or stolen becomes critical to maintaining the integrity of the user’s account.

Validating a user’s identity with high assurance is an important aspect of this process, as well as for account onboarding processes, meeting Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements.

The FIDO Alliance has identified newer remote, possession-based techniques including biometric “selfie” matching and government-issued identity document authentication as having the potential to greatly improve the quality of identity assurance for new account onboarding and account recovery.

The Alliance has also determined a market need for authoritative guidance, performance evaluation and certifications for their use.

The FIDO Alliance has created the IDWG to fill this need. The IDWG will define criteria for remote identity verification and develop a certification program and educational materials to support the adoption of that criteria.

The IDWG is led by co-chairs Rob Carter, Mastercard and Parker Crockford, Onfido Ltd. Other participating organizations include Aetna, Google, Idemia, Lenovo, Microsoft, Nok Nok Labs, NTT DOCOMO, OneSpan, Phoenix Technologies Ltd., Visa Inc., Yahoo! JAPAN, Yubico and the UK Cabinet Office.

IoT technical working group overview

Gartner forecasts that 20.4 billion connected things will be in use by 2020, opening up opportunities for increased efficiencies and innovation across industries. Yet, lack of IoT security standards and typical processes such as shipping with default password credentials and manual onboarding leave devices, and the networks they operate on, open to large-scale attack.

The IoT TWG aims to tackle this issue by providing a comprehensive authentication framework for IoT devices in keeping with the fundamental mission of the Alliance – passwordless authentication.

The working group will develop use cases, target architectures and specifications covering:

• IoT device attestation/authentication profiles to enable interoperability between service providers and IoT devices
• Automated onboarding, and binding of applications and/or users to IoT devices
• IoT device authentication and provisioning via smart routers and IoT hubs

The IoT TWG is led by co-chairs Marc Canel, ARM Holdings and Giridhar Mandyam, Qualcomm, Inc. Other participating organizations include Google, Idemia, Infineon Technologies, Intel Corporation, Lenovo, Microsoft, Nok Nok Labs, OneSpan, Phoenix Technologies Ltd., Yahoo! JAPAN and Yubico.

from Help Net Security https://ift.tt/2YkbZeG

Jetico, long-trusted pioneer in encryption software, announced the launch of Jetico Central Manager in the cloud, now available for BestCrypt Volume Encryption. Admins and Managed Service Providers gain control of disk encryption activities from anywhere without the need to configure and maintain a dedicated server.

“The burden of managing disk encryption affects organizations of all sizes,” claims Jetico CEO, Michael Waksman. “Jetico’s cloud-based central management helps to empower even the smallest businesses, now free from the hassle of running their own local server.”

Customers using Jetico Central Manager in the cloud will appreciate a ready pre-configured server. No need to buy dedicated hardware, install software components or determine all the settings.

Waksman adds, “For MSPs, a single administrator can manage several customer installations from one simple interface, from any remote location.”

Features and benefits

Management of endpoint data protection

• Control encryption activities from anywhere
• Gain peace of mind with pre-set encryption policies based on compliance requirements, including HIPAA and GDPR
• Create and save customized encryption policies to best match your needs

Monitoring and reporting

• Get instant alerts on any issues and see progress of encryption tasks in real time
• Centralized logging
• Create global reports in HTML or PDF

Maximum security

• Protect endpoint data using the strongest independent encryption; nobody else can access your encrypted data, guarded by your own uniquely generated keys
• Rest assured with secure network traffic between client computers and cloud-based central management
• Rely on safe cloud-side backups for database recovery

For over 20 years, Jetico proudly serves enterprise customers with BestCrypt data encryption software, a reliable alternative to native OS encryption. Cloud-based central management of BestCrypt saves time and money, delivering more convenient compliance with regulations like HIPAA and GDPR.

from Help Net Security https://ift.tt/2NhftO8

ClearSky Data, provider of on-demand primary storage with built-in offsite backup and disaster recovery (DR) as a service, announced a collaboration with Packet for an edge computing deployment at the SBA Communications tower site in the Boston area. ClearSky will co-locate next to and coordinate with Packet to provide a complementary service.

SBA has an edge data center in Foxborough, Mass. at the base of one of its towers, where Packet is currently providing its carrier-grade bare metal cloud service. ClearSky will now offer edge-based storage, backup and DR as a service, enabling customers to power high-performance edge computing applications and workloads from this site.

“With ClearSky Data and Packet, customers can access a cloud native infrastructure that can be easily connected to self-protecting storage,” said Jacob Smith, Chief Marketing Officer at Packet. “It’s an extremely compelling edge story for the enterprise.”

ClearSky Data’s patented edge-based service automatically optimizes a customer’s entire data lifecycle to provide limitless access, simplified management, comprehensive protection and strong security.

The company’s radically different approach to storage uniquely supports highly-distributed edge architectures, with ClearSky’s patented Smart Tiered Caching technology ensuring data is available anywhere it’s needed to eliminate latency.

“Companies need data in multiple locations that they can aggregate, analyze and derive value from in real time, and ClearSky can fulfill this customer demand while utilizing our data center,” said Clay Moran, Director, Strategy at SBA.

Ellen Rubin, CEO of ClearSky Data, said, “The promise of edge computing brings new urgency to the idea of data anywhere, but to fully realize it, data management and storage must be in close proximity to customers.

“ClearSky’s service provides this data layer and, combined with Packet’s bare metal cloud, will accelerate the growth of the edge computing model at scale. SBA is an early innovator at the edge, and we appreciate their support in driving this market forward with ecosystem partners like ClearSky and Packet.”

from Help Net Security https://ift.tt/2Lo2DLj

Code Dx, provider of an award-winning application security management solution that automates and accelerates the discovery, prioritization, and risk management of software vulnerabilities, announced its partnership with AdaCore, a trusted provider of software development and verification tools for the Ada, C, and C++ programming languages.

Through this partnership, Code Dx Enterprise now supports AdaCore’s CodePeer advanced static analysis tool, an automatic Ada code reviewer and validator. This solution provides developers with one central location from which to view the results of multiple application security testing (AST) tools and allows them to easily prioritize vulnerabilities for remediation.

Developers can automatically pull results from AdaCore’s CodePeer into Code Dx Enterprise, without downloading and then uploading scan results each time. Users simply open Code Dx Enterprise and the latest results are there.

“AdaCore is well respected in the aerospace and defense, rail, space, automotive and other industries that have complex requirements for developing high-integrity software,” said Anita D’Amico, Ph.D., CEO at Code Dx.

“With our background with the Department of Homeland Security and our work with other government agencies, we have very similar missions to enable the development of software that is safe, secure, and reliable.”

Code Dx Enterprise supports and integrates with more than 70 commercial AST tools and techniques, including static, dynamic, and interactive tools; third-party component analyzers; and manual reviews, to provide total software application vulnerability correlation and management.

“Through Code Dx Enterprise, our CodePeer users have a central location to store results and a dashboard to visualize key metrics,” said Jamie Ayre, Commercial Director at AdaCore.

“In addition, the tool enables our users to more easily collaborate on testing and remediation processes, and to track findings over time. For CodePeer users who are developing multi-language software within the same application, Code Dx Enterprise provides a single repository to manage all of their AST activities.”

from Help Net Security https://ift.tt/2xhCaqM