Kocher, 'Design and Validation Strategies for Obtaining Assurance in Countermeasures to Power Analysis and Related Attacks', NIST Physical Security Testing Workshop -Honolulu, Sept. Boneh, “Remote Timing Attacks are Practical” Ħ.P.

Bernstein, ''Cache-timing attacks on AES'',, 2005.ĥ.D. Popp, “Power Analysis Attacks -Revealing the Secrets of Smartcards” Ĥ.Dan J.

Ģ.Josh Jaffe, “Differential Power Analysis”, Summer School on Cryptographic Hardware. Here are a few more (somewhat) related to this topic:ġ.Joe Grand, “Advanced Hardware Hacking Techniques”, Defcon 12. The parent was probably talking about this paper: Go big, or run the risk of putting blinders on yourself. Nobody wants to poke holes in their own solution, and so they stop looking.īut, hey, we're catching the odd employee accidentally sharing confidential documents via OneDrive.įast forward a year, and an entire DB gets transferred out via an unknown vector, nobody finds out about it for a couple months, and it's all 'Oh! How did this happen? We had monitoring in place.'

Particularly with things like data exfiltration, this is potentially harmful because then you've organizationally blinded yourself. People are saying that because it's misguided and potentially harmful.ĭoing so is security theater, where the solution is scoped down to something incomplete but easier, and then everyone walks away happy they solved 90% of the smaller problem they chose to attempt.

In most situations, covering 90% of attacks is still worthwhile I am continually frustrated by the number of people who claim that protection is worthless if it's potentially circumventable.

S3 amazon psiphon