IBM X-Force Research: Outdated Encryption Standards Pose a Serious Risk of Data Breach

Many businesses today depend upon encryption standards that date back to the late 1990s. These standards are now considered insufficient for protecting sensitive, confidential or private data, according to the National Institute of Standards and Technology. Over the last many months, we have seen security researchers publish information disclosing various weaknesses in these standards.

The purpose of this research paper, which focuses on encryption standards related to data in transit, is twofold. First, it provides high-level information needed to help make sense of the issues created by the use of old encryption standards. Second, it provides recommendations for building a strategy for adopting stronger encryption standards, which will help reduce a company’s security risk and the effort spent patching its systems.

Read the IBM X-Force Research report: A security update on Internet encryption

Security Intelligence Staff

X-Force releases detection & response framework for managed file transfer software

5 min read - How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response guidance being released by the various security vendors had many similarities (e.g., Log4shell vs. Log4j2 vs. MOVEit vs. Spring4Shell vs. Microsoft Exchange vs. ProxyShell vs.…

MSMQ QueueJumper (RCE Vulnerability): An in-depth technical analysis

13 min read - The security updates released by Microsoft on April 11, 2023, addressed over 90 individual vulnerabilities. Of particular note was CVE-2023-21554, dubbed QueueJumper, a remote code execution vulnerability affecting the Microsoft Message Queueing (MSMQ) service. MSMQ is an optional Windows component that enables applications to exchange messages via message queues that are reachable both locally and remotely. This analysis was performed in collaboration with the Randori and X-Force Adversary Services teams, by Valentina Palmiotti, Fabius Watson, and Aaron Portnoy. Research motivations…

X-Force prevents zero day from going anywhere

8 min read - This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities are associated with a zero day. X-Force often observes zero-day exploitation on Internet-facing systems as a vector for initial access however, X-Force has also observed zero-day attacks leveraged by attackers to accomplish their goals and objectives after initial access was…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from Software Vulnerabilities

X-Force releases detection & response framework for managed file transfer software

MSMQ QueueJumper (RCE Vulnerability): An in-depth technical analysis

X-Force prevents zero day from going anywhere

Topic updates