Generation ahead..Encrypted Hard-Disk

Self-encrypting hard drives are becoming a reality. One standard, led by the Trusted Computing Group, has been adopted by a number of vendors.The cost of encryption is virtually zero because the encryption itself takes place in hardware on the drive. This means that everything is encrypted by default, without compromising performance. We may remember to encrypt our most sensitive files, but at the same time forget to encrypt our email archive, previous versions of the sensitive file, and of course the swap and hibernate files which can contain everything. Encrypting everything by default protects us from these omissions.

How secure are these drives? Well, the encryption keys are generated and stored internally on the drive. Thus, the security of the system depends on the security of the key inside the drive. This means that the main question to ask encrypted-drive manufacturers is how is the key stored inside, and how secure is it? If a secure smartcard chip is used, and the key is password protected, then this is great. If the key is obfuscated and somehow hidden (of course, and still password protected), then someone stealing the drive can probably get to it given enough effort. However, you have still made their life difficult and they have to take the drive away with them (it’s unlikely that they’ll be able to do this without taking the drive apart). So, in any case, you have gained a lot. (I am ignoring the possibility of really bad implementations, although experience tells us that this can also happen not too infrequently…) It is worth noting that highly sensitive files should probably still be encrypted on a higher level (using an encryption key that is stored in a separate smartcard that you take with you). Keeping the encryption key in a completely separate place is always the best practice and prevents even the most concerted efforts to decrypt.

On a usability note, since the encryption keys are internal to the drive there is no key management issue. This is good because key management is often the biggest hurdle to adoption. Regarding data loss, it is important to realize that if the encryption key is somehow lost due to a fault in the drive, then this would be the same as if your hard drive was completely destroyed. So it’s important to also ask manufacturers what sort of fault tolerance has been built into the system regarding the encryption key.

7 steps to flawless ONLINE shopping....

Today in the Internet era, the range of online retail options makes us really lucky to shop comfortably at the click of a mouse. While the perks of online shopping are obvious – no traffic jams, irritating crowds, billing queues or parking problems – taking some simple precautions will ensure safe shopping. Here are some basic safety tips for a secure online shopping experience.

1. Look for visual cues

When you shop online, always look for simple visual cues indicating that the site has been authenticated as legitimate and that the information you enter is protected. Visual cues such as the VeriSign logo or a green browser address bar indicate that the Web site’s ownership has been verified and that the site is safe for online shopping and other transactions. A Web address beginning with “https means that that there is an encrypted connection between your browser and the Web site’s server, indicating that your communication is secure and cannot be intercepted.

2. Validate the vendor

Always buy from a reputed shopping site – ones that you have heard of through friends and trusted acquaintances. You should check online ratings and reviews from other customers and take red flags seriously. You can then make an appropriate decision about the site and decide whether or not it is wise to shop there. Make sure that the Web site has an authentic and valid phone number and mailing address.

3. Check for `two-factor’ authentication

A growing number of sites are now beginning to accept a second form of user authentication that comes from physical devices such as a token, credit-card form factor, a USB drive, or even your cell phone. Two-factor authentication pairs something you know, such as a username and password, with something you have, a one-time password generated by this device in your possession. The unique second password gives you the confidence to shop online without the risk of a hacker or thief gaining access to your accounts via stolen personal information. Although this is still relatively new in India, it will only be a matter of time before most Web sites offer it.

4. Pay attention to the order form

When you place your order, the site should not ask for more than your name, shipping address, billing address, credit card type and number or expiration date. Do not disclose your bank account details.

5. Compare the check-out experience

Whenever you commit to transactions over the Internet, it is important to make sure you can save and print a receipt or other confirmation of the transaction. This should have the date of the purchase along with the amount included on it. Beware of simple forms that offer no confirmation that you entered or ordered anything.

6. Safeguard your password

Don’t ever select the `remember my password’ option and avoid saving your password on your PC; it is the first thing a hacker will target. Malware can be used to search your PC for stored passwords. Avoid using the same password on multiple sites or writing it down on a Post-It note or scrap of paper that can be easily intercepted. Finally, change all your passwords every two to three months.

7. Provide minimal personal information

Always check the Web site’s privacy policy to make sure that your personal information will be safe. Try to limit the amount of personal information you give out while filling out online forms. With these simple precautions, you can have a delightful shopping experience!