Cisco Blogs


Cisco Blog > Security

Next Generation Encryption

A transition in cryptographic technologies is underway. New algorithms for encryption, authentication, digital signatures, and key exchange are needed to meet escalating security and performance requirements. Many of the algorithms that are in extensive use today cannot scale well to meet these needs. RSA signatures and DH key exchange are increasingly inefficient as security levels rise, and CBC encryption performs poorly at high data rates. An encryption system such as an IPsec Virtual Private Network uses many different component algorithms, and the level of security that it provides is limited by the lowest security level of each of those components. What we need is a complete algorithm suite in which each component provides a consistently high level of security and can scale well to high throughput and high numbers of connections. The next generation of encryption technologies meets this need by using Elliptic Curve Cryptography (ECC) to replace RSA and DH, and using Galois/Counter Mode (GCM) of the Advanced Encryption Standard (AES) block cipher for high-speed authenticated encryption. More on these algorithms below, but first, some good news: the new ISR Integrated Services Module brings these next-generation encryption (NGE) technologies to IPsec Virtual Private Networks, providing a security level of 128 bits or more. These technologies are future proof: the use of NGE enables a system to meet the security requirements of the next decade, and to interoperate with future products that leverage NGE to meet scalability requirements. NGE is based on IETF standards, and meets the government requirements for cryptography stipulated in FIPS-140.

NGE uses new crypto algorithms because they will scale better going forward. This is analogous to the way that jets replaced propeller planes; incremental improvements in propeller-driven aircraft are always possible, but it was necessary to adopt turbojets to achieve significant advances in speed and efficiency.

Read More »

Tags: , , , ,

NCSAM Tip#17: Stay Safe Online — Security at Home

October 25, 2011 at 7:33 am PST

When we discuss security as an integral part of our cyber life, it is important that we take sufficient care that the home network and the devices that are used at home are secured. There are several areas at home in which we use Internet and IP-enabled devices. These include your home network (wired & wireless), personal computing devices, smart phones, official computing devices, network-enabled printers, and other smart appliances. While we look at security, all of these devices need to be reviewed for security best practices to ensure that the risk of an attacker penetrating or compromising these devices is reduced. This post concentrates on securing three main entities in a home network.

Read More »

Tags: ,

NCSAM Tip #16: Use Secure Password Management

Do you have a lot of passwords? Are they too hard to remember? Then use a secure password storage database. Password Safe, Password Gorilla, xPass, and several other tools are available. They all remember your user names, passwords, URLs, etc, and store them all in a strongly-encrypted database.

Read More »

Tags: ,

Duqu: The Next Stuxnet?

Reports of the recently discovered Duqu trojan have spawned much speculation and even resulted in the trojan being dubbed “the son of Stuxnet” or “Stuxnet 2.0.”

So what is Duqu and how does it compare to Stuxnet?

Duqu is an infostealer trojan designed to sniff out sensitive data and send it to remote attackers. Conversely, Stuxnet was a worm with a malicious payload designed to programmatically alter industrial control systems.

I’ve heard Duqu called Stuxnet 2.0. Why is that?

Read More »

Tags: , , , ,

NCSAM Tip #15: SSH Insecurity

On *nix systems, check your sshd_config and ssh_config files. In both files, the Protocol line should read “Protocol=2″ and NOT “Protocol=2,1″ or similar values that include protocol version 1 as an option. Putty should be configured to use only protocol version 2 as well.

Failure to check your SSH configuration can lead to a downgrade attack, where user credentials and the entire SSH session are recovered in the clear. If you are using SSH protocol version 1, your SSH session is no more secure than Telnet.

Tags: ,