Monday, February 15, 2016

Encryption Debate: The issue isn’t strong crypto; It’s easy crypto

An article by Tozny CEO Isaac Potoczny-Jones at NextGov:
Strong cryptography has been around for a long time, but the user interfaces have been terrible. As a result, most individuals and even software programmers struggle to use them effectively. Over the last few years, we’ve seen a push by technology industry leaders to prioritize easy to use encryption technologies in their products on the front end. This is an enormously positive and important development that expands adoption of secure products.  Backdoors and storing encryption keys don’t strengthen crypto; they weaken it, and the lack of good security in commercial and government products and services has left the United States extremely vulnerable to industrial espionage from determined foreign adversaries.
Read More.  

Saturday, February 13, 2016

The tension between Agile, MVPs, and Security

Here's a great article by George V. Hulme, including discussions with Tozny CEO Isaac Potoczny-Jones about the tension between Agile, MVPs, and Security. See also the complete Q&A with Isaac at CSO Magazine.
The first step is just saying, "We're going to include security in the Agile definitions of done," and once you've at least penetrated that level, which I don't think a lot of people have, then they’re going to at least do the right things. You're either going to start to build it either into the user stories or the acceptance testing. But you can’t leave it to the end of the process. If you leave security acceptance testing toward the end (and naturally your schedule is going to slip) then you'll get to the security testing and find there's a lot more work to do. Then you'll be in this unfortunate decision of either having to fix the security issues and let your schedule slip, or choose to let something go out the door that's not secure.
Read More.

Tuesday, December 1, 2015

GCN Article: Making mobile phones the authentication hubs for smart homes

Our NSTIC privacy project was highlighted in an article at GCN by Derek Major.
Tozny serves as the technical lead for the pilot programs and will build the data storage and sharing platform by tackling one of the weakest links in cybersecurity today: the password. Tozny’s solution replaces the username and password with something people use for almost everything: the smartphone, or wearable device. Tozny is working with IOTAS, a developer of a home automation platform that integrates preinstalled hardware (light switches, outlets and sensors) with software to create a unique experience in which users learn from and interact with their homes. Together, the companies are working to help users to log in to the IoT management console installed in their apartments without a password. Tozny is providing cryptographic authentication that is based on mobile phones.
Read More.

Tuesday, November 24, 2015

Article: NIST Testing out passwordless smart home

Mohana Ravindranath over at NextGov wrote a nice piece about our NIST privacy pilots.
Tozny, a subsidiary of tech company Galois, aims to test one system that encrypts user data generated by the "smart home," and another that would let transit riders use their mobile phones as tickets, Galois principal investigator Isaac Potoczny-Jones said in a blog post outlining more details about the project.
The NIST pilot, through an initiative called the "National Strategy for Trusted Identities in Cyberspace," focuses on these two applications. But NIST has recently been drafting broader standards for tech companies creating products for the "Internet of Things": In September, it released a Draft Framework for Cyber-Physical Systems, essentially a guide teaching device manufacturers how to build safer devices.
Read More.

Tuesday, November 17, 2015

Interview: DoD embraces public key infrastructure to secure tactical networks

Isaac contributed to some technical background for an interesting article at c4isrnet.com about the use of Public Key Infrastructure (PKI).
"Humans are terrible at generating and remembering random stuff, and the strong crypto on PKI is virtually impossible to brute force," said [Tozny CEO] Isaac Potoczny-Jones, research lead, computer security, for Galois, a technology research and development consulting firm with an office in Arlington, Virginia. "On a scale from one to 10, PKI is a 10 for security and password is a two."
Read More.

Sunday, November 15, 2015

FedScoop: NIST IoT project explores how to ditch passwords, maintain privacy

Head on over to FedScoop to read the latest about Tozny.
A project that lets consumers use their mobile-phone bus passes to control smart home systems may set the table for a forthcoming framework from the National Institute for Standards and Technology dedicated to protecting user privacy... 
"The idea is to build privacy-preserving personal data stores to allow new ways for user information to be shared across organizational boundaries in a way that the user is in control over how the data shared, what is shared, with who and when," Potoczny-Jones told FedScoop. "It’s important that with emerging IoT technologies and the new way people are getting around via ridesharing or public transit, we collect this share this information in a way that the user has a lot of control over it."
 Read More.

Monday, November 9, 2015

Interview: Portland Business Journal covers Tozny's NSTIC project

The Portland Business Journal discusses Tozny's new NSTIC project in an article by Malia Spencer.
"Computer science research and development firm Galois, mobile ticketing firm GlobeSherpa and smart home startup IOTAS are teaming up on a project funded by the federal National Institutes of Standards and Technology. The effort could lay the groundwork for Internet of Things applications that will be secure and protect privacy.

Galois, through its mobile security subsidiary Tozny, is the lead on the two-year project. So far, the government has committed $1.86 million to the first year of work.

Menlo Park-based SRI International and 6 Degrees Consulting are also participating in the project."

Read More.

Sunday, November 8, 2015

Tozny's NSTIC Pilot Project

Amid growing concerns that IoT devices are inherently vulnerable to attacks that could compromise users’ information privacy and security, Tozny today announced that it has been awarded a $1.86 million NIST National Strategy for Trusted Identities in Cyberspace (NSTIC) grant to build a secure data storage system that enables next-generation IoT capabilities without sacrificing privacy. Galois’ authentication and mobile security subsidiary, Tozny, will serve as the technical lead for the NSTIC pilot program.

Read More.

Monday, November 2, 2015

Here's a great article over at NextGov about various efforts the Federal government is involved with to secure the Internet of Things. Tozny CEO Isaac Potoczny-Jones mentioned NIST's new privacy frameworks in the context of IoT.
Galois is working with NIST on a pilot in which consumers' information, culled from smart-home services, could be integrated into a "privacy preserving data store," Potoczny-Jones said.
Read More.

IoT security & privacy requires overcoming a legacy of insecurity

Head over to Network Computing to read Isaac's article about Internet of Things security and privacy work we're engaged in.
Vendors must adapt a different approach for IoT than was done with the Internet, which was “you are the product, not the customer.” Sticking with this old approach would treat IoT user privacy as second fiddle. Getting privacy right is even more important with IoT than it is with computers because IoT extends beyond a smartphone or laptop screen to end user applications such as Internet-connected baby monitor video cameras, door locks that can be opened remotely with an app, wearables that track our movement and smartphones that track our location.