Hash Value

A Hash Value is a numeric value resulting from a mathematical algorithm applied to a set of data such as a file. A common hash value is called the MD5 Hash of a computer file. Every computer file in existence has a unique MD5 Hash. VirusTotal.com uses the MD5 Hash of files to track and report whether a particular MD5 Hash represents a virus found in its database.

Hash Values can be thought of as fingerprints for files. The contents of a file are processed through a cryptographic algorithm and a unique Hash Value is generated that identifies the contents of the file. If the contents are changed at all, the value of the hash will also change significantly.

What Does This Mean For My SMB?

Encryption and Cryptography (used to produce Hash Values) are important to an SMB in order to protect the confidentiality of critical and sensitive information. SMB’s may fall under legislative controls such as HIPAA or PCI which require specific forms of data (Health Records, Credit Card PAN information) to be protected from disclosure (protect confidentiality).

The best strategy for SMB’s to deal with such requirements is NOT to have such data in their possession. For example, PCI compliance obligations can often be avoided by partnering with online Web Services that perform the Credit Authorization outside of your Website or store and simply provide the SMB an authorization code back. However, in cases where an SMB must collect and store such critical and sensitive data, then AES encryption is your friend and should be used. Just be sure to protect the decryption keys.

SMB PROTECTIONS BEYOND CRYPTOGRAPHY/Encryption

CyberHoot recommends the following best practices to protect individuals and businesses against, and limit damages from, online cyber attacks:

Adopt a password manager for better personal/work password hygiene
Require two-factor authentication on any SaaS solution or critical accounts
Require 14+ character Passwords in your Governance Policies
Train employees to spot and avoid email-based phishing attacks
Check that employees can spot and avoid phishing emails by testing them
Backup data using the 3-2-1 method
Incorporate the Principle of Least Privilege
Perform a risk assessment every two to three years

If you would like to learn more about this topic, watch this short video:

Source:

TrendMicro

CNSSI 4009

Related Term:

Cryptography

Hashing

CyberHoot does have some other resources available for your use. Below are links to all of our resources, feel free to check them out whenever you like:

Blog
Cybrary (Cyber Library)
Infographics
Newsletters
Press Releases
Instructional Videos (HowTo) – very helpful for our SuperUsers!

Note: If you’d like to subscribe to our newsletter, visit any link above (besides infographics) and enter your email address on the right-hand side of the page, and click ‘Send Me Newsletters’.