You've requested...

Diffie-Hellman Key Exchange - A Non-Mathematician's Explanation

If a new window did not open, click here to view this asset.

Download this next:

The exploitation of flaws in the HTTPS protocol

The HTTPS protocol is a vital tool in safeguarding the security of our personal and business lives. This protocol ensures that important data such as financial information, intellectual property and login credentials are encrypted and integrity protected as they travel across the internet. Ultimately this means a malicious observer is unable to obtain, view, use or sell this important data. To both technical and non-technical users, the presence of “HTTPS” at the start of the website URL will provide enough confidence to consider entering sensitive information such as bank or credit card details. However, in this article we will explain how even websites owned by the most reputable organisations may be exposed to a 20-year-old attack – originally known as the “Million Message Attack” due to Daniel Bleichenbacher – if HTTPS is not properly implemented. Around 33% of internet servers were found to be vulnerable to this attack in 2016, and both Facebook and PayPal remained vulnerable in 2017. Furthermore, related weaknesses in HTTPS implementations are still regularly being discovered. As a result, a secure TLS implementation is imperative for all organisations looking to maintain their business reputations and sensitive intellectual property.

These are also closely related to: "Diffie-Hellman Key Exchange - A Non-Mathematician's Explanation"

  • How Russia's war in Ukraine is changing the cybersecurity game and why that matters

    The build-up to the attack on Ukraine by Russia saw widespread warnings from cyber security pros that the world was on the verge of a cyber war. So far, such cyber attacks have been confined to the theatre of conflict, but this doesn't mean things won't change. In this e-guide, we will explore some of the more impactful cybersecurity stories that have unfolded around the war.

     

    In this e-guide:

    • Prepare, but don’t panic, over supposed Russian cyber threat
    • Why security professionals should pay attention to what Russia is doing
    • Use of encrypted Telegram platform soars in Ukraine, Russia
    • Direct action is a risky business for Ukraine's volunteer hackers
    • Dark web littered with Ukraine crypto scammers
    • Ukrainian cyber defences prove resilient

  • Jargon buster guide to GDPR

    The European Union’s General Data Protection Regulation (GDPR) comes into effect on 25 May 2018. GDPR will introduce new accountability obligations and stronger rights and restrictions on international data flows.

    GDPR introduces new obligations for any organisation that handles data about EU citizens - whether that organisation is located in the EU or not. It introduces data breach notification into European law for the first time. And it places stricter responsibilities on organisations to prove they are adequately managing and protecting personal data.

    In this guide, we provide the 10 most important things you need to know about GDPR, and a jargon-buster explanation for some of the key terminology.

Find more content like what you just read:

  • Jargon Buster Guide to Post Quantum Cryptography

    This Jargon Buster will help you to understand the key concepts of quantum computing and why businesses should be acting now to ensure they are able to encrypt sensitive data in a secure way in a post-quantum era.

    Download

  • Secure sockets layer: What is it really about?

    You may have heard of "SSL: Secure Sockets Layer" but there hasn't been a consistent definition/assessment of the scope of the term...until now.Go onto the landing page now to learn about SSL, through a succinct definition, as well as an in-depth explanation going into its origin and significance.

    Download

  • 2 types of endpoint encryption to protect data

    Endpoint encryption can ensure data remains safe from unauthorized access when it is stored and transmitted to another endpoint. Two main approaches to endpoint encryption that companies can implement to protect data are full-disk encryption and file encryption.

    Download

  • A new approach to secure email

    GoSecure Titan Inbox Detection & Response (IDR) empowers users to send suspicious emails directly from their inbox to professionals for evaluation and handling. Download this brief video for an explanation of GoSecure Titan IDR and all its capabilities.

    Download

  • EDR: Endpoint Detection Response

    You’ve probably heard of EDR, but with so many acronyms in the security space, you may not know what it stands for or what it really means.Access this exclusive landing page to explore expert opinions and explanations of EDR’s origin and modern importance.

    Download

  • ZTNA: What it stands for & what it means

    ZTNA is one of the hottest acronyms in the cybersecurity space. While many people know what it stands for, different interpretations focus on different things.Go onto the landing page now to learn about ZTNA, through a succinct definition, as well as an in-depth explanation going into its origin and significance.

    Download

  • 7 NAS encryption best practices to protect data

    NAS encryption helps organisations prevent unauthorized individuals from gaining access to confidential data. However, the process is complex and, if done incorrectly, can put sensitive data at risk. Here are seven NAS encryption best practices to protect your data.

    Download

  • Defining APIs: Why they matter

    API is a commonly used acronyms in the cybersecurity space, and while many have a loose understanding of what it stands for, there is still a lack of clarity surrounding what APIs actually do. Go onto the landing page now to learn about APIs, through a succinct definition, as well as an in-depth explanation going into its origin and significance.

    Download

  • Transport layer security: What it is & what it means

    You’ve probably heard of transport layer security (TLS), but with so many acronyms in the security space, you may not know what it stands for or what it really means.Access this exclusive landing page to explore expert opinions and explanations of TLS’s origin and modern importance.

    Download

  • A Look Inside the Top Four Value-Based Care Plans

    Payers have several different value-based care arrangements they can offer, including pay-for-performance programs, bundled payment models, and capitation.

    Download

  • Cloud computing storage key management

    Jagat Paudel addresses key management in cloud computing storage in this thesis from our Royal Holloway security series.

    Download

  • 2020 Media Consumption Series - What

    In this inforgraphic, we show the results of our 2020 Media Consumption Survey. Find out what prospects' advice is for your content creation team and what data users are willing to share in exchange for quality content?

    Download

  • Explore the CMS interoperability and prior authorization rule

    The CMS Interoperability and Prior Authorization final rule is here, with new requirements for Medicare Advantage, Medicaid, and CHIP plans. Learn how ZeOmega's HealthUnity platform can help you comply and streamline payer-provider collaboration. Read the full details.

    Download

  • Brush up on your understanding of key cybersecurity terms

    Cybersecurity is filled with acronyms and terms that can be difficult to fully understand, which can lead to confusion and intimidation for potential interested parties. In this blog post, Nexum introduce their Acronym Series, which aims to spread cybersecurity awareness by providing explanations of various acronyms. Read now to learn more.

    Download

  • CW Innovation Awards Project of the Year: StratMed

    Named Project of the Year in the Computer Weekly Innovation Awards APAC 2022, StratMed's Integer platform is facilitating data exchanges between healthcare providers and their suppliers to improve transparency in India's healthcare supply chain.

    Download

  • Computer Weekly – 30 January 2024: Tech companies warn EU over encryption plans

    In this week's Computer Weekly, tech companies are calling on the European Commission to rethink plans to weaken internet encryption – we explore the issues. We talk to credit rating agency Moody's about why it thinks now is the time to invest in quantum computing. Read the issue now.

    Download

  • Improve customer experience with good customer data

    Learn how you can build customer loyalty and improve customer experiences via quality and effective customer data collection and analysis. In addition, tap into how companies like 7-Eleven, Walgreens, and Mazda are improving customer journeys by enabling mobile loyalty programs.

    Download

  • How to use a public key and private key in digital signatures

    Ensuring authenticity of online communications is critical to conduct business. Learn how to use a public key and private key in digital signatures to manage electronic documents.

    Download

  • NY health plan improves quality measures with health exchange

    Healthfirst, a NY health plan, used real-time data from its health exchange, accessing 700+ facilities, to boost quality measures and care coordination. This led to a 5-6% increase in compliance. The nonprofit aims to enhance the program for better event identification and provider alerts. Learn more in this case study.

    Download

  • Why a data intelligence platform is crucial for enablement

    Many companies often see a lack of widespread adoption for new data products by key stakeholders. Read on to learn why a rich, data-driven culture requires an organization to have a singular platform through which data can be exchanged.

    Download

  • Your Guide to Zero-Trust Security

    Implementing zero trust requires creating detailed policies and devising certain "hoops" through which those wanting access to critical infrastructure must jump. Not an easy task. Luckily, searchSecurity is here to help. Participate in our IAM research program for access to our guide, Implementing a Zero-Trust Approach to Network Security.

    Download

  • Are you making your users pay a Time Tax?

    Time tax refers to the irritating, inefficient, and time-wasting processes imposed on members of the public in exchange for public assistance. Are you making your users pay a Time Tax? Download this white paper and fill out the quiz to discover if you’re guilt of any of the common time tax pitfalls.

    Download

  • 9 Common Cryptocurrency Scams in 2023

    Even though cryptocurrency is a newer trend, thieves are using old methods to steal. Here are some of the common cryptocurrency scams to watch out for.

    Download

  • How to lock down your APIs and keep data secure

    APIs are increasingly critical to businesses, but security risks abound. Learn about the top API security challenges, and uncover key steps to lock down your APIs, in this informative tip sheet.

    Download

  • 6 ways to empower your network team

    Your organization may have multiple software systems – and those systems may be disparate. How can you ensure data exchange and interoperability between such systems? Download this 4-page overview to learn how LogicVein’s SmartBridge can help.

    Download

  • SMS for dummies: Everything your business should know

    Today, it’s reported that approximately 18.7 billion text messages are sent worldwide each day. However, despite the frequency with which messages are exchanged, very few actually understand the communication system and SMS itself. Browse this article to learn more.

    Download

  • Computer Weekly – 9 May 2017: Casting the IT skills net wider

    In this week's Computer Weekly, as research reveals that three-quarters of non-tech workers would be interested in a job in IT, we examine what's stopping them. We analyse the key storage elements of building a private cloud. And Bloomberg's head of data science talks about the benefits of machine learning. Read the issue now.

    Download

  • Your Guide to Co-Presenting Webinars

    In order to meet the demand for fresh marketing content, many have turned to leading webinars to help. But, if you continue to have the same people leading these sessions, you can risk content fatigue. Inviting another partner or customer to co-host might be your remedy. Access this guide to learn how to best co-present webinars.

    Download

  • Fill enterprise project management (EPM) skills gaps with managed services

    Read this product overview to discern the flexible, economical options to administer and support your EPM applications available to you through US-Analytics’ managed support services.

    Download

  • S/4HANA Migration: What You Need To Know

    Learn all you need to know about the S/4HANA migration through our eguide.  We'll cover the most popular S/4HANA deployment models, S/4HANA Cloud vs. On-prem and more.

    Download

  • A Security Assessment of Android Full-disk Encryption

    This article in our Royal Holloway Security Series describes an attack on Android 5.0 full disk encryption and discusses potential countermeasures.

    Download

  • 3-phase FHIR implementation approach outlined inside

    Regulations mandating adoption of HL7 FHIR are a major focus for payers in 2024. So, where do you start? Download this paper to evaluate a three-phase FHIR implementation approach and to educate yourself on the transformative potential of the process.

    Download

  • MicroScope – June 2021: A hybrid working world

    With hybrid working set to become the norm as the world starts to return to a more normal footing post-Covid, we look at how businesses are preparing for the new world of work. Also discover how to tackle the sustainability challenge, and have some key questions answered around handling bottlenecks caused by large volumes of data

    Download

  • How the New England Patriots Achieved HR Victory Through Paycom

    The New England Patriots deployed Paycom's HR system to manage 5K employees across states. Paycom's mobile-friendly tech improved data integrity & employee engagement, but that’s not all. In this case study, discover how Paycom is one of the Patriot’s MVPs.

    Download

  • How & Why NIST is Driving SBOM Evolution

    In December 2020, a supply chain attack on SolarWinds Orion software exposed over 100 private sector entities and 9 Federal agencies to cyber threats. The incident prompted the issuance of Cybersecurity Executive Order 14028. Download this guide and get insight into The National Institute of Standards (NIST) role in the EO.

    Download

  • The role of FHIR in interoperability

    The new CMS interoperability rule aims to improve prior authorization processes and drive better healthcare outcomes through increased data sharing and transparency. Learn how this regulation can provide a strategic advantage by transforming member experience and fueling innovation. Read the full report.

    Download

  • A CISO's guide to reducing risk and complexity across IT

    As cybersecurity risks expand, CISOs need a unified approach to evaluate, exchange, and enforce risk posture across users, apps, and data. Learn how to simplify risk management and optimize security investments in this e-book.

    Download

  • Shields up! Why Russia's war on Ukraine should matter to security pros

    The build-up to the attack on Ukraine by Russia on 24 February saw widespread warnings from cyber security companies and government agencies that the world was on the verge of a devastating cyber war. In this E-Guide, we will explore some of the more impactful cyber security stories that have unfolded around the war.

    Download

  • Computer Weekly – 4 July 2023: How data is beating heart disease

    In this week's Computer Weekly, we find out how a new data strategy is helping the British Heart Foundation to raise money and support medical research. We examine the benefits of using AI in advanced malware detection. And we reveal why the Information Commissioner is under fire for weak responses to serious data breaches. Read the issue now.

    Download

  • How to get the best value from Office 365

    In this e-guide, we outline the key differences between the three enterprise subscription packages offered by Office 365: E1, E3 and E5. By understanding the pros and cons of each tier as well as the needs of the end users, an IT department can ensure it purchases Office 365 in an effective manner.

    Download

  • The Investigatory Powers Act 2016 and Internet Connections Records

    This article in our Royal Holloway Information Security series examines the implication of the state's collection of Internet Connection Records under the Investigatory Powers Act 2016.

    Download

  • Computer Weekly – 7 March 2017: Industrial control systems pose big risk to security

    In this week's Computer Weekly, we examine the risks to national infrastructure from vulnerabilities in industrial control systems. DevOps is growing in popularity – we find out about the organisational, process and cultural approaches to make it succeed. And we ask CIOs how they are becoming hybrid IT and digital leaders. Read the issue now.

    Download

  • Top 10 cyber security stories of 2021

    Cyber security was once again top of the agenda for IT leaders in 2021, with a barrage of news and analysis making it hard to separate the wheat from the chaff and the genuine insight from the self-promotional nonsense. However, there were some stand-out cyber security stories in the past 12 months that were indubitably worthy of attention.

    Download

  • Your GDPR guide

    Despite the focus on data protection, many organisations are still leaving their data wide open for attack through the digital equivalent of leaving the front door open and the windows unlocked from a hacker perspective.

    Download

  • Computer Weekly – 6 August 2019: Using tech to boost staff morale

    In this week's Computer Weekly, we look at the emerging technologies being used to improve employee experience and raise staff loyalty and motivation. The CIO of the Football Association explains how IT is changing the way the national game is administered. And we examine the growing role of AI in preventing cyber attacks. Read the issue now.

    Download

  • Discover 9 microsegmentation vendors and how they stack up

    To meet their microsegmentation needs, buyers should look for solutions with flow and asset discovery, visualization, a wide range of supported operating systems, and segmentation at the process level. Access this Forrest Report to discover how well 9 of the most significant vendors stack up when scored against 10 criteria.

    Download

  • Top 5 Factors for Choosing a Key Management Solution

    Navigating Key Management can be complex, especially when selecting a new vendor. This webcast covers the top 5 considerations to choose the ideal solution for your business. Learn best practices and get insights into Utimaco's offerings. Watch the full BrightTALK webinar now to learn more and make an informed decision.

    Download