Personal attributes: Cyberis are looking for a highly organised, self-disciplined multi-tasker with an exceptional eye for detail and the ability to be flexible, accommodating, calm and focused, all whilst working to tight deadlines. A problem solver by nature, you must have excellent communication skills and be used to working professionally at all levels demonstrating patience and understanding.
In the last quantum cryptography blog post we looked at the popular BB84 protocol and discussed how it is, at least theoretically, a secure protocol.
This time we’ll see how, when put into practice, physical implementations of the protocol can introduce vulnerabilities that we can exploit to undermine the entire key exchange!
When testing these types of systems, vulnerabilities can be broken down into two broad classes:
Shadow IT increases your business' security risks and is invisible to you. It might not be covered on your asset lists, because your asset management lists are incomplete. It might have no assigned owner, either because it doesn't fit neatly into any business unit, or isn't related to any current operational priorities but hasn't been fully decommissioned yet. It might have been installed outside of usual processes, either without authorisation or because usual processes were overridden.
Encryption implementation issues are, in my experience, some of the most commonly reported findings during penetration tests. Whilst they may not always be quite as scary as seeing "SQL Injection" or "Stored Cross-Site Scripting" in a report, their ubiquity merits some discussion.
We broadly find the most often encountered issues fall under three categories:
- Outdated Encryption Protocol Support
- Certificate Issues
- Weak Cipher Suites
How are these three categories linked and what do they do to keep my data safe?