Posted on

US Government Signal Security Breach

The news that a journalist was mistakenly included in US government discussions about sensitive military operations, reminds us once again that consumer apps for instant messaging are not suitable for sensitive communications.

There’s more to security than end-to-end encryption

Mass adoption apps are simply not secure enough. While they all claim end-to-end encryption that protects data in transit, that doesn’t mitigate the issues that led to the breach.  As we’ve discussed many times before, there is much more to secure communication than encryption.

The particular danger of consumer apps is that there is no central management of users. Anyone can join, anyone can pretend to be whoever they want to be, and that’s before we consider the implications of imposter-based attacks and AI-generated deepfakes that are now frighteningly realistic. Remember the incident last year when the then Foreign Secretary took a call from someone pretending to be former Ukrainian President Petro Proshenko, with whom Mr Cameron had multiple dealings, including face-to-face, during his tenure as Prime Minister.  (Fortunately, when Mr Cameron smelt a rat he ended the conversation, with no sensitive information exchanged.)

For handling sensitive, higher assurance conversations and information, instant messaging apps need to be Secure by Design and Secure by Default. For example, the use of crypto protocols such as identity-based encryption will ensure someone is who they say they are, and so prevent imposter-based attacks. Without built-in security features, with default settings to control users and data, instant messaging apps are prone to human error as well as deliberate mis-use,

Central control of users

While the productivity benefits of using instant messaging are tempting, at higher assurance levels the risk of information being leaked, or stolen, are all too apparent, and clearly unacceptable.

An enterprise level communications platform provides robust security features including the central management of users, which is one of the biggest differentiators between a free-to-use consumer app and an enterprise product that is designed for purpose.

A truly secure communications platform offers a controlled environment in which all users are centrally managed and enrolled.  Users join by invitation only, which they receive from an administrator.  Once their device is enrolled, the user authenticates to the communications app which can include biometric readers. Only once securely provisioned, with a proven identity, can the user use the service.  And when they leave the organisation, or if they or their device is compromised, their account can be remotely wiped, ensuring sensitive information is removed.

Ideally, users should be cryptographically segregated into groups, which can be based on division/department, location, project, or seniority/rank, and (by default) can only contact others within the same group. An administrator defines which groups can communicate with which other groups on an “as needed” basis.

Managing users by groups (or communities) ensures that there is clear segregation of community-related data. This enables organisations to maintain strong internal data segmentation where sensitive data is protected from accidental leakage to other parts of the organisation. Typically, the user has access to the minimum set of contacts and data, by default; this approach – the opposite of consumer apps – ensures that data and communication are controlled and managed appropriately.

 

NCSC provides plenty of guidance

More food for thought.  The National Cyber Security Centre (NCSC) has published 7 Principles of Secure Communication, which are:

  •  Protect Data in transit
  •  Protect network nodes with access to sensitive data
  •  Protect user access to the service
  •  Ensure secure audit of communications is provided
  •  Allow administrators to securely manage users and systems
  •  Use metadata only for its necessary purpose
  •  Assess supply chain for trust and resilience

 

Consumer apps meet 2 or 3 of these at best. Dedicated, Secure by Design, communications platforms that meet all 7 principles, have been available for years… so why are organisations still exchanging sensitive data over consumer messaging apps?

UK leading the way

Thankfully there are some within the UK Government and defence organisations that are making real headway in securing their communications. However, the rate of adoption needs to be faster and broader if we, in the UK, are to show leadership in this field, and so avoid a similar embarrassment and breach of national security as the US.

In a hyper-connected world, it is still, frequently, human error that creates vulnerabilities… make sure it’s not you!

For more details about what you should be looking for when Securing Communications Channels download our Buyer’s Guide.

Posted on

Armour Comms solutions now available on G-Cloud 14

The full range of the Armour Secure Communications Platform can now be ordered via the latest version of the Government’s procurement framework

Visit us on Stand 29B, SDSC UK, 19 – 20 November, Telford International Centre

London, UK, 11th November 2024 – Armour® Comms’ solutions have been accepted on to the G-Cloud 14 procurement framework.  Buying services through the framework is faster and more cost effective than entering into individual procurement contracts. All public sector organisations, including agencies and arm’s length bodies, can use the Contract Award Service through G-Cloud 14 to purchase Armour Comms solutions.

Armour packages that can now be procured online include:

Armour Cloud™ – A fully managed SaaS solution for standard deployments for SMB/SME sized organisations, with one simple affordable price. Armour Cloud is aimed at organisations looking to replace the use of consumer apps, improve security of mobile communications mitigating deepfake and impostor-based cyber threats, retain control of corporate data including data sovereignty, and for improved security, GDPR and regulatory reasons.

Armour Cloud is also ideal for organisations looking for an out-of-band communications channel with which to handle incidents or to protect sensitive C-suite communications.

Armour Enterprise™ – Configured to provide a solution that supports the robust requirements of higher assurance and SME/Enterprise organisations that need complete control over all aspects of their secure communications. Armour Enterprise is provided as either an on-premises implementation or via a number of SaaS options. Secure interoperability with enterprise unified communications (UC) including desk and IP soft phones, secure video conferencing and secure archive and audit are also included within the packaged price.

Armour Recall™ – Archiving and Audit solution providing the ability to record and playback messages, audio or video calls subject to strict security processes – essential for regulated industries.

  • All transmitted media (text, attachments, audio) are archived.
  • Tightly managed authorisation for audit access.
  • Individual encryption keys limits access.
  • All access to audit files is audited.

 

Armour Unity™ – enterprise secure conferencing and collaboration solution that is easy and intuitive to use.

  • Strong authentication – be sure who is on the call (helps to mitigate the risk of AI-generated deepfake fraud)
  • Video, documents and chat all remain protected within the Armour ecosystem

 

 Armour Connect™ – provides interoperability options extending the reach of mobile secure communications to the desk phone in the enterprise including integration with SIP, PBX, and other UC installations. 

Armour Bridge™ – a cross-domain gateway that provides interoperability with third party messaging systems. This allows Armour Mobile and Armour Unity users to exchange messages across security boundaries and/or levels, with colleagues that are not able to use the Armour platform. Armour Bridge benefits include:

  • Controlled access to and from third party messaging systems
  • Extends value of existing messaging apps
  • Delivers audit compliance, e.g. for Public Records

 

David Holman, co-founder and director of Armour Comms commented; “This is the widest ever range of Armour solutions to be made available via the G-Cloud framework. This is testament to the growing requirements to protect everyday business conversations from increasing threat levels and Armour’s continued growth and development in providing quick-to-deploy, easy-to-use solutions that help to mitigate the risks from eavesdropping and impersonation-based attacks as well as criminal and nation state sponsored cyber attacks .”

Armour will be exhibiting at SDSC UK, 19 – 20 November, Telford International Centre SDSC UK.  To find out more, visit Armour on Stand 29B, or contact us on: sales@armourcomms.com .

Posted on

Armour Comms announces new industry-leading Secure Video Conferencing solution for higher assurance and enterprise use

Armour Unity enables security-conscious organisations to combat AI-generated deepfake and impersonation-based attacks

Visit us on Stand 29B, SDSC UK, 19 – 20 November, Telford International Centre,

 

London, UK, 16 October 2024 – Armour® Comms has announced that Armour Unity™, its secure video conferencing and collaboration solution is now shipping. Armour Unity extends the Armour secure communications platform to provide an industry-first, secure, enterprise-level mobile video conferencing and in-app messaging for iOS and Android devices. In common with Armour Mobile™, Armour Unity uses the National Cyber Security Centre’s (NCSC) MIKEY-SAKKE protocol to provide identity-based encryption and authentication, and is designed to support the NCSC Advanced Mobile solution architecture.  This means that users can be confident that everyone else on a call is who they claim to be, mitigating the risk of uninvited ‘guests’ joining a call and deepfake, impersonation-based attacks.

 

David Holman, Director at Armour Comms, explained: “Mass-use consumer applications are simply not secure enough for most sensitive communications.  This is because there is no control over communications data, you don’t know where it is stored, who might have access to it or how they might use your data. The rise of impersonation and deepfake attacks on organisations is growing, causing issues for organisations’ processes and governance around sharing sensitive data, and the potential for fraudulent transactions.  In addition, Microsoft has recently admitted that it cannot guarantee data sovereignty for its UK government/public sector customers.

 

“Armour Unity solves these problems by providing organisations with complete control over their secure communications platform including where sensitive data is stored. Central administration controls all aspects of security settings as well as users.  Only those that are invited to join the platform and provisioned can subsequently then join a call, keeping all users’ and the organisation’s data secure.”

 

Armour Unity highlights

Collaborate

  • Make predefined and on-the-fly video conference calls
  • Same robust protection even across different organisational boundaries
  • Only invited attendees already on Armour may join
  • Set up reminders and alerts

 

Message

  • All transmitted media (text, attachments, audio) is handled securely within the Armour platform
  • Share screens, documents, and chat/text with confidence
  • Message Burn means chat/text can be set to delete at a predefined time by the sender

 

Share

  • MIKEY-SAKKE identity-based encryption means participants can be certain who else is on the conference
  • Users can be segregated into secure, centrally managed Communities
  • Conferences can be set up within or across different user groups according to your security stance

 

Commercial Benefits of a Secure Communications Platform

The Armour secure communications platform can be used throughout the organisation and across the entire supply chain to provide:

  • Flexible secure communications for mobile workers
  • Multi-domain connectivity into existing communications environment maximises investment and security
  • Secure group messaging and collaboration functionality to support cross-organisational, and cross-domain teamwork
  • Secure virtual meeting environment wherever employees are located, reducing commute expenses, saving time, helping towards lower carbon emissions
  • Protection against intercept and therefore potential loss of valuable commercial information including contract and bid investment/industrial secrets

To find out more about Armour Unity visit us on Stand 29B, SDSC UK, 19 – 20 November, Telford International Centre, or contact us on: sales@armourcomms.com .

Posted on

UK Foreign Secretary falls victim to hoax video call

News broke at the end of last week that ex-prime minister and now UK Foreign Secretary David Cameron has fallen victim to a hoax video call.  The call was with someone  pretending to be former Ukrainian President Petro Proshenko, with whom Cameron had multiple dealings, including face-to-face, during his tenure as Prime Minister.  As soon as the impostor started asking for contact details, Cameron smelt a rat and ended the conversation, with no sensitive information exchanged.

If the very top of the UK establishment can be contacted via a hoax video call, what chance is there for the rest of us?  This was clearly a sophisticated targeted attack, given that Mr. Cameron was taken in by the impersonation.

Know who you are talking to with Identity-based encryption

Once again, we are reminded of the need to be vigilant with sensitive communications, and this incident highlights the benefits of using a centrally managed communications platform over which your organisation has complete control, so that all users are verified before they join the platform. Using identity-based encryption, such as the NCSC’s MIKEY­-SAKKE protocol, means that users can be confident that the person contacting them via the platform is who they say they are, and not an impostor, or an AI-generated deepfake.

Other recent worrying stories, include the publication of 361 million email addresses, username and passwords via Telegram channels, and a ransomware attack on London hospitals. Indeed, even mainstream business titles like the Economist are now also writing about the vulnerabilities of global telecommunications infrastructure with a recent article pithily entitled ‘Snooped dog and bone’ that talks about the shortcomings of Signalling System 7 (SS7). This is something that Armour highlighted many years ago in our blogs such as SS7 vulnerability still going strong near the White House and the now  classic, What’s up with WhatsApp.

Secure by Design beats unsanctioned shadow IT

All of this points to a requirement for all organisations to step up cyber security, particularly when dealing with external third parties. When it comes to enterprise secure communications, organisations should avoid unsanctioned ‘shadow IT’ solutions. A built-for-purpose, Secure by Design secure comms platform can provide a slick user experience to rival any consumer app, plus the ability to manage and control data.  Whether on-premises or a secure hosted solution, an enterprise-grade secure comms platform that covers voice calls, instant messaging and video conferencing ensures data sovereignty (your data stays on sovereign soil, i.e. you know where it is being held) and data separation (no mixing of data, be that of different classifications of data, or business and personal).

For more information about how the award-winning, Armour Secure Communications Platform can protect your organisation’s sensitive conversations, contact us today: sales@armourcomms.com

Posted on

Armour wins top honours at SC Awards for 3rd time

We are delighted to announce that the Armour Secure Communications Platform has won Best Communications Security Solution at the SC Awards Europe 2024.  This is the 3rd time that we have won, the previous times being 2019 with Armour Mobile™, and 2022 with Unity by Armour, while in 2021 Armour Mobile was Highly Commended.

David Holman, co-founder and Director of Armour stated: “This award is a testament to Armour’s continued focus on developing solutions that balance security with usability ensuring that our products are as engaging and easy to use as consumer-grade products, but with significantly more robust security. We are particularly pleased with the Judges’ comments which included saying that the platform seems highly convenient for customers to use and integrate, and that it meets the highest security standards.” 

“And I’d like to say a huge well done and thank you to everyone on the team at Armour that has made this happen!”

The Armour Secure Communications Platform was developed to address the escalating need for secure mobile business communications amidst the proliferation of AI-powered impersonation attacks and deepfakes. It provides an integrated, user-friendly solution designed for secure collaboration across BYOD phone and tablet devices and desktops, suitable for use even on untrusted networks. This platform combines several critical functions, including Armour Mobile for secure calls and instant messaging, Armour Unity™ for secure video conferencing, and Armour Recall™ for archiving and auditing communications information.

Armour Bridge™ and Armour Connect™ provide interoperability for cross domain solutions with other messaging and voice platforms so that users of Armour Mobile and Unity can communicate with others outside of the Armour ecosystem, when required.

The platform encrypts data throughout its lifecycle and is fortified with stringent security measures, such as constraints on message retention and data forwarding, along with the capability to automatically erase all Armour data in the event of device compromise. It utilises identity-based authentication with NCSC’s MIKEY-SAKKE protocol, significantly enhancing security by preventing identity spoofing and securing communications, especially during video conferences.

Armour technology is widely adopted by the defence sector and is also crucial for regulated industries such as financial services and legal, enabling them to adhere to strict regulatory requirements. The Armour Recall function, in particular, conserves details of communications which can be reviewed as required for public records and Freedom of Information requests, to prove compliance with data protection regulations, or to investigate potential wrongdoing, saving significant time over traditional methods.

 

Contact us today for more information about how to protect your sensitive communications with an app that provides all the convenience of consumer systems, but with significantly more robust security: sales@armourcomms.com

Posted on

Now Shipping – Armour Mobile Configuration Management System

Secure central management of mobile communications on BYOD devices, without the need for Mobile Device Management (MDM).

The new Configuration Management System (CMS) is now available for Armour Mobile. This latest upgrade includes a whole host of powerful features to enable the central management of data held within Armour Mobile on remote devices, significantly reducing the data security risk from the use of BYOD smartphones and tablets.

Stay in control of sensitive data, even on remote unmanaged devices

Armour Mobile CMS provides authorised administrators with complete control over data held within the Armour ecosystem on remote devices. This means that the end user can continue to use their phone as they would normally, while all sensitive communications are safely stored within the application’s ‘container’. Data held in the Armour container can only be accessed by the end user via the Armour Mobile app (i.e. it is not accessible to other applications, such as the device’s photo gallery).

Configurations set centrally can be made visible to end-users, i.e. they can see the settings, or, invisible, where end-users are not specifically aware of settings and limitations made.  Some limits may optionally be editable by the end user, but only where the user chooses to further increase the security limits.  Armour Mobile CMS can remove the need for a Mobile Device Management solution (which users are often reluctant to agree to for their own personal devices), because CMS performs some of the functions of a Mobile Device Management (MDM) solution such as being able to wipe data remotely from the device.  All information shared via Armour Mobile is kept within the Armour ecosystem which guards against data leakage whether accidental, or otherwise.

In addition, new enhanced security controls include:

Message Retention Limit

This sets a time limit for messages being retained on a device. Once the time limit is reached messages, and any attachments relating to a message, are automatically deleted. This integrates with Armour Mobile’s feature, and is a further aid to secure data management. The limit can be set centrally by an administrator, or by the end-user. If the limit is set centrally, the user may set a shorter time limit, but may not override with a longer time limit. In addition, the time limit may be adjusted dynamically should the device move into a higher threat area, for example, leaving the corporate network environment, working on an unknown and/or untrusted network/wifi, or visiting an unfriendly or hostile regime.

Remote Wipe

An administrator can remotely wipe all data held in the Armour app without needing to physically access a device.  This protects against sensitive data being accessed should a device be lost or  stolen, or when an employee leaves the organisation, and provides a more proactive way to ensure data is wiped, even if a device is deliberated kept offline.

Central Copy and Paste Control Policy

Copy and Paste policy for the Armour Mobile app can be controlled centrally.  The administrator can set copy and paste to be enabled or disabled, and as mentioned earlier, this policy can either be visible or invisible to end-users, and/or editable, but only to make the data handling more secure, not less so.   Depending on the setting selected this prevents information from a secure message potentially being copied into an app outside of the Armour Mobile platform, and therefore, into a less secure environment. This feature helps to ensure the integrity and security of data, to help avoid data leakage.

These new central management features enable organisations to take tighter control of secure communications and the sensitive information that they may contain.  It helps CISOs and compliance departments  to automate security with a series of centrally managed features without having to rely on the weakest link in the security chain – the end-user.  Meanwhile, the end-user can continue to use their devices, either BYOD or company-issued, as they would normally, with no interference to their usability or requirement to change working practices.

For more information contact us today: https://www.armourcomms.com/contact/

 

 

 

 

 

 

 

 

Posted on

Armour Comms announces enterprise scalability for up to 200,000 users with Armour Core v5

Armour Mobile, the NATO-approved WhatsApp replacement, available for large scale users with Kubernetes deployment options

London, UK, 4 October 2022 – Armour Comms is now shipping Armour Core v5, which includes Kubernetes capabilities for enterprise-wide deployments. Already in use by strategic Government departments and large organisations, Armour Mobile can now be installed across broad groups of disparate users remotely and at scale.  Software updates, patches and the application lifecycle can be managed more easily and quickly, transparently to the end-user.

Armour Core v5 supports the latest requirement from Apple for APNS push notifications, and also push notifications for Bittium Tough Mobile™ 2 series of ruggedised and secure smartphones (subject to Bittium Secure Suite being installed).  In addition, Armour Core now utilises NginX, to provide an extra layer of security at Transport Layer Security (TLS) level and simplify interfaces accessing the service; and uses Prometheus to provide extra monitoring options for SIP and XMPP.

David Holman, Director at Armour Comms, stated: “When secure products are easy to use and quick to deploy, people are far more likely to use them, meaning that the security is more effective. With this in mind, Armour Core v5 brings enterprise grade scaling for our larger customers, and for those organisations that wish to use Kubernetes.

“Armour Core also supports our new Configuration Management System which enables organisations to manage Armour on BYOD devices without the need for a Mobile Device Management (MDM) solution. The IT/Security department are able to manage data, apply updates and wipe Armour data remotely (useful for when someone leaves or a device is lost/stolen), transparently, quickly and with minimal resource overhead.”

Armour Mobile Configuration Management (CMS) provides authorised administrators with complete control over data held within the Armour ecosystem on the device. The end user is able to continue using their phone as they would normally, while all sensitive communications are safely stored within the Armour ‘container’, without the need for a Mobile Device Management (MDM) system. Data held in the Armour container can only be accessed by the end user via the Armour Mobile app (i.e. it is not accessible to other applications, such as the device’s photo gallery).

Advanced features of Armour Mobile CMS include message retention limits where messages and any attachments are deleted automatically when the retention limit is reached – which minimises risk of loss of organisational data and aids internal audit and compliance. This integrates fully with Armour Mobile’s existing ‘Message Burn’ feature, providing additional security and flexibility.  CMS also provides remote wipe, whereby Armour data is wiped from a user’s device without the need to physically access the device – critical for when people leave the organisation or lose their device.

Posted on

Armour Comms launches secure management of mobile communications on BYOD devices, without the need for Mobile Device Management (MDM)

New Configuration Management System safeguards sensitive conversations and messages and reduces the risk associated with BYOD or locally purchased devices

International Cyber Expo: 27-28 September, Olympia, London

Stand: C20 TechUK & ADS Pavilion

London, UK, 20 September 2022 – Armour Comms is launching its new Configuration Management System at the International Cyber Expo, being held at London Olympia, on 27 and 28 September. The new solution is part of Armour’s award-winning secure communications flagship platform, Armour Mobile, and will enable organisations to securely manage risk associated with communications data transmitted over Armour Mobile, even on an unmanaged Bring-Your-Own-Device (BYOD) or locally purchased devices.

David Holman, Director at Armour Comms, stated: “The use of BYOD devices has long been an issue for many organisations, and is particularly pertinent in sectors that require data protection, such as defence, government, finance, legal and healthcare. However, people do not like their personal devices to be subjected to corporate Mobile Device Management (MDM) solutions and organisations are concerned about the legal issues of controlling data on devices not owned by them. The Armour Mobile Configuration Management System successfully addresses this conundrum.”

Armour Mobile Configuration Management (CMS) provides authorised administrators with complete control over data held within the Armour ecosystem on the device. This means that the end user can continue to use their phone as they would normally, while all sensitive communications are safely stored within the application’s ‘container’, without the need for a Mobile Device Management (MDM) system. Data held in the Armour container can only be accessed by the end user via the Armour Mobile app (i.e. it is not accessible to other applications, such as the device’s photo gallery).

Advanced features of Armour Mobile CMS include message retention limits where messages and any attachments are deleted automatically when the retention limit is reached– which minimises risk of loss of organisational data and aids internal audit and compliance. This integrates fully with Armour Mobile’s existing ‘Message Burn’ feature, providing additional security and flexibility. CMS also provides remote wipe, whereby Armour data is wiped from a user’s device without the need to physically access the device – critical for when people leave the organisation or lose their device.

Posted on

Unity by Armour Secure Conferencing wins Best Communications Security Solution at SC Awards

We are delighted to announce that Unity by Armour has won the SC Award for Best Communications Security Solution. Unity is the third Armour product to be honoured by these highly prestigious Awards (previous accolades went to Armour Mobile and SigNet by Armour).

The award was presented at the first live celebration of the SC Awards in three years, held yesterday (21st June – midsummer’s day) at the London Marriott, Grosvenor Square, where we were joined by clients for a glitzy evening.  According to the organiser: “The SC Awards Europe recognise and reward products and services that continue to stand out from the crowd, exceeding customer expectations to help defeat imminent threats and cyber-security attacks.”

From our perspective, we are pleased that our products stand out for their innovation and value to business in the fight against cyber threats.  However, the award is also a huge ‘well done’ to our employees who have worked so hard to deliver real-world solutions to the dilemma of providing the functionality of a consumer app, with the Secure by Default design and security required for business communications and collaboration.

Here’s a summary of the winning entry……………

Enterprise Conferencing that’s more secure and easier to use

Unity by Armour® delivers secure conferencing in an easy-to-use app for mobile and desktop use, with enterprise security features not provided by free-to-use consumer products including a choice of cloud or on-premises installation to ensure data sovereignty. Unity is available in several configurations to ensure the level of security matches the sensitivity of the conversation. Unity combats the issue of ghost callers that may eavesdrop on sensitive conversations by highlighting to all users whether a participant has joined the call via Armour’s secure app, or via a browser – the latter often introduce vulnerabilities.

Unity extends the Armour ecosystem by working in conjunction with Armour Mobile to provide pre-defined or on-the-fly secure video conferencing, screen sharing and integration with secure chat groups and interconnectivity with trusted unified communications systems.

Unity delivers picture-in-picture and multiple screens, and offers a familiar video conferencing interface, making it easy and intuitive to use.

Armour Mobile won the award for Best Mobile Security Solution in 2019 and SigNet and Armour Mobile were Highly Commended in the same category in 2021.

If your organisation needs a conferencing tool with enterprise capabilities and security credentials to match, call us today to find out more +44(0)20 36 37 38 01