Secure your Communication Lines

The events in Libya allow a rare glimpse behind the curtain of a government who uses digital surveillance technology against its citizens. It will take some time for the new government to assess the damage in terms of privacy violations, espionage and impact on the security of dissidents. The rebels found stashes of intercepted information ranging from instant messengers, videos, phone calls to e-mails. The eavesdropping was done by technology from companies in Western countries. This is a clear signal to businesses to secure their communication lines and to thoroughly scrutinise the promises of vendors.

Most of us take private conversations for granted. If you write an e-mail, a text message or make a phone call, then the gadgets you use give you the illusion of privacy. In reality next to none product and protocol takes measures to guard the information you are sending or receiving. Usually you have resort to extra effort, and in most cases you cannot reliably protect a communication line due to interoperability problems (maybe the end-point is still analogue or doesn't support certain protocols). You have to be aware of these issues and you have to define what communication lines can be used for which information. This is a very important step. Do not start with the technical issues. Start with an inventory of your communication habits and the data you usually transmit. Technical measures are always second. If you don't know how your internal processes use communication, then you can't do anything to improve their security.

Follow the events in Libya and learn about existing methods for compromising communication. The products are out there and they are not advertised publicly. Of course this doesn't mean that no one uses them. Keep an open mind and a tight grip on your company's digital assets.

• Firms Aided Libyan Spies
• Iranian Man-in-the-Middle Attack Against Google Demonstrates Dangerous Weakness of Certificate Authorities