Making mobile phones the authentication hubs for smart homes

Government Computer News

“[…] people who have tried to deploy authentication devices for smart homes have had a lot of trouble getting them to work, and they’re kind of expensive,” said Isaac Potoczny-Jones, computer security research lead at Galois.“Since a mobile phone can do cryptography, and because we can build beautiful and easy-to-use interfaces on mobile phones, we […]

PERMALINK

Isaac Potoczny-Jones: IoT Security & Privacy – Reducing Vulnerabilities

Network Computing

“In a recent 2015 cybersecurity report, AT&T charted a 458% increase in Internet of Things (IoT) vulnerability scans of devices. This is just the latest indication that hyper-growth of IoT devices, sensors and systems across business, consumer and government sectors puts users’ information privacy and security at risk.” In this Network Computing piece, Galois’ Isaac Potoczny-Jones discusses why the Internet of Things are very often vulnerable today, and what vendors can do to built IoT devices with security and privacy in mind.

PERMALINK

How the Federal Government is Attempting to Protect the Internet of Things

NextGov

NIST is also developing standards aimed at protecting consumer privacy in the Internet of Things, noted Isaac Potoczny-Jones, research lead for computer science at Galois, a company working with NIST on consumer privacy. “A lot of the Internet has this financial basis around making the user into the product, not the consumer,” he told Nextgov. “The user’s private data is really the product and that product is sold elsewhere — we see a potential for that happening on the Internet of Things.” Galois is working with NIST on a pilot in which consumers’ information, culled from smart-home services, could be integrated into a “privacy preserving data store,” Potoczny-Jones said.

PERMALINK

Podcast: Galois using biometrics to secure private data

SecureID News

Isaac Potoczny-Jones, Galois Identity Research Lead and CEO of Galois authentication spin-off Tozny, talks about the new NSTIC pilot in a recent re:ID podcast episode. Galois, a Portland-based company that focuses on cyber security primarily for the U.S. government, is the final winner of the fourth round of NSTIC pilots. Galois and its partners will build […]

PERMALINK

Secure Computation and The Right to Privacy: Guest blog post by David Archer

The State of Security

While there are straightforward encryption solutions for data in transit and data at rest, data is usually unencrypted while it is being computed on, leaving it exposed to sophisticated attackers. In this guest blog post on Tripwire’s The State of Security blog, David Archer, research lead at Galois, explores a few methods of computing on data while it remains encrypted that are emerging from academic research and slowly becoming practical.

PERMALINK

NSTIC commits $3.7 million to new round of identity pilot programs

ZDNet

Galois will build a tool that allows users to store and share private information online. The user-centric personal data storage system relies on biometric-based authentication and will be built securely from the ground up. As part of the pilot, Galois will work with partners to develop just-in-time transit ticketing on smart phones and to integrate […]

PERMALINK

Asymmetric Network Defense: Guest blog post by David Archer

The State of Security

Defending networks is becoming increasingly harder, as adversaries are advancing far quicker than our defense techniques. In this guest blog post on Tripwire’s The State of Security blog, David Archer, research lead at Galois, talks about some of the reasons behind this asymmetry, and gives a few ideas on how network defense might catch up to the agility of attackers.

PERMALINK

Strategies for Building Cyber Security into Software Development

Software Magazine

In this Software Magazine piece, Galois’ Isaac Potoczny-Jones writes about what vendors can do to build cyber security into their products from the start. “Cyber security should not be an afterthought in the software development process; it should be the first thought. As applications, systems and devices increasingly fall victim to hacks, vendors may be tempted to assume that business users and consumers have become desensitized to the problem. That adding two-factor authorization or offering three months of credit monitoring service will somehow wipe the slate clean with no damage done to brand perception, customer growth, and revenues. This is not the case. Building cyber security into the front end of the software development process is critical to ensuring software works only as intended.”

PERMALINK