Review: Open-Source Encryption Utility Frustrates Phishers - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Review: Open-Source Encryption Utility Frustrates Phishers

Phishing schemes are proliferating, yet most companies remain in the dark about this threat. One solution to the problem: TrueCrypt 4.2 encryption software.

Phishing schemes are proliferating, and this year may be the worst. Yet most companies remain in the dark about this threat, which can be squelched with encryption. One solution to the problem: TrueCrypt.

As far as encryption software goes, TrueCrypt may be one of the best open-source gems and least-recognized software offerings on the market. The CRN Test Center considers the utility, now at version 4.2, the ultimate information-hardening tool. Though the software is deceptively simple to use, it sports some cool features that help users encrypt entire partitions and hide data in virtual volumes.

Through phishing, hackers try to steal personal or confidential information from PCs via official-looking e-mail messages, as well as through spam, keylogging, trojans and other methods. While most anti-malware and anti-spam suites provide some protection, it's not enough to protect employees. But encryption software can prevent hacker and malware from reading critical files on employees' desktop and notebook PCs.

VARs that haven't been promoting encryption should consider looking into TrueCrypt. The software supports all of the top encryption algorithms, such as Triple DES, Blowfish and the famous AES-256, which is used by the U.S. government to encrypt top-secret documents. The TrueCrypt software uses AES as its default encryption in LRW mode.

Despite being powerful, many of these encryption methods are slow, especially when working with large keys. For most purposes, using TrueCrypt in 128-bit mode is more than enough to protect data. Prepare to wait a while if the Blowfish algorithm runs, since it churns through 16 rounds of encryption using a 448-bit key.

When creating virtual drives, TrueCrypt leverages hash algorithms that use the SHA-1 and RIPEMD-160 key generators. Because all the encryption steps require passwords and key files, users should nest volumes using various keys, which would make it virtually impossible for hackers break -- even if they have knowledge of some of the passwords.

TrueCrypt can hide volumes and embed volumes into files to make it more difficult to find data, even if intruders somehow get a hold of passwords. TrueCrypt calls this security feature "plausible deniability." Talk about James Bond.

Volumes can be hidden within empty spaces of other volumes, so even if an attacker gets into a visible volume, the partition is only partially revealed. To anyone looking at the data in the volume, the empty space looks like fragmented junk data.

The only critical feature missing from TrueCrypt is boot sector encryption, which is available in Microsoft Windows Vista. In addition to Windows XP and Windows 2003 server, TrueCrypt supports many Linux flavors and languages. The group is now working on Vista and Mac OS X support.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
2020 State of DevOps Report
2020 State of DevOps Report
Download this report today to learn more about the key tools and technologies being utilized, and how organizations deal with the cultural and process changes that DevOps brings. The report also examines the barriers organizations face, as well as the rewards from DevOps including faster application delivery, higher quality products, and quicker recovery from errors in production.
How COVID is Changing Technology Futures
Jessica Davis, Senior Editor, Enterprise Apps,  7/23/2020
10 Ways AI Is Transforming Enterprise Software
Cynthia Harvey, Freelance Journalist, InformationWeek,  7/13/2020
IT Career Paths You May Not Have Considered
Lisa Morgan, Freelance Writer,  6/30/2020
Register for InformationWeek Newsletters
Current Issue
Special Report: Why Performance Testing is Crucial Today
This special report will help enterprises determine what they should expect from performance testing solutions and how to put them to work most efficiently. Get it today!
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll