Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

// // //
02:12 PM
Simon Marshall
Simon Marshall
Simon Marshall

PreVeil Pushes Encryption Past the End

PreVeil is pushing encryption beyond its normal endpoints to protect data wherever it is.

We all know that perimeter technologies are somewhat now playing second string to newer approaches to data security: acceptance that breaches are inevitable. Once in a while, we find one technology that cuts through the noise and presents an approach that looks very novel and very workable.

Whether or not you believe in "encryption everywhere," its time will come in 2018, when an innovative startup will commercialize and launch an encryption concept incubated from the labs at MIT.

PreVeil CEO Raluca Ada Popa
PreVeil CEO Raluca Ada Popa

Spearheading the new technology, which concept claims that even after an intrusion, information stored on servers remains encrypted and is therefore useless data to cyber thieves, is founder and CTO at PreVeil, Raluca Ada Popa.

Popa holds a double major Bachelor's degree, a Master's and a Doctorate in computer science -- all with a GPA of 5.0 -- and also holds the patents to PreVeil's encryption everywhere concept. She's also an assistant professor at U.C. Berkeley specializing in computer science and applied cryptography.

"I was always thinking of algorithmic, logical things, but at the same time, I also wanted to have an impact on the world," said Popa, "I had to do math, had to think analytically and I was only interested in solving difficult problems."

The math and operational processing behind the concept supports the idea that traditional encryption, although it has served well, just doesn't extend far enough given that intrusions are inevitable. Encryption od data in transit and storage works fine. But encryption during computing and processing of data is missing.

Don't worry about server breaches
"Servers were continually being breached, so my Light Bulb Moment was 'maybe we should stop fighting that battle because we're always losing,' " Popa told SecurityNow, "Let's stop trying to have a wall around data and instead always have it encrypted." Today's encryption protects data when it's at rest or in transit, but it's decrypted at the destination, and that leaves a huge security hole and low-hanging hacker opportunities.

Thinking of taking the concept from the whiteboard to commercialization, there was a healthy dose of reality that the process might be too much of a challenge. Also, it was Popa's first outing into forming a company and trying to drive a new mindset about the use of encryption.

"[But] I had a hard time thinking about only making an incremental change," said Popa, who loves challenges.

Having formed in 2015, PreVeil has been developing the technology and now has productized the concept. Solutions for file sharing and email security will be available by the end of the year for Windows, Mac, Android and iPhone. Its enterprise security solution will also released within a month. Services will be free for individual users, and the business model is to charge enterprises. Currently, PreVeil has about 30 enterprise trials on the go, but no formal customers yet.

Show me the money
Popa reckons that a big driver of enterprise interest is being driven by media coverage of attacks, and is starting some thinking about new solutions rather than necessarily beefing existing systems.

Apparently, some enterprise budget is being moved from perimeter defense towards newer technologies, and some companies are even able to justify additional security spending. There are also worries out there that companies which don't keep up with encryption may become soft targets for hackers.

Another pressure point is consumer expectation. There may be more realistic views on the street about weak data security from consumer brands, and Popa speculates that the next generation of encryption will power competitive differentiators for consumers willing to pay for stronger security-as-a-service.

Enterprise teams adopting new encryption technologies could face a knowledge gap and steep learning curves. "The good thing is that the high-level concepts are actually easy to grasp. There are no more single key-holder approvals, and now firms can get encryption through a group of people," said Popa. "It's definitely a big step to take, and there are those who are still thinking about it."

The past and the future
PreVeil is notable by the presence of chairman and founder Sanjeev Verma. Apart from the practicality of ensuring financing (the firm was initially privately funded) for the idea, Verma has a track record of success that includes being the founder of Airvana, the giant of CDMA in the early Noughties.

As a business partner, Popa liked him because he also had good technical knowledge and bridged the gap between her academic expertise through enabling the packaging of a new service. "We had been friends for a long time, and he was interested in potentially commercializing my research. There were a few other organizations who approached me, but I basically said 'no' to all of them," said Popa.

There are some roadmap items coming up that indicate an extension of PreVeil's ambitions as well as a fledgling move to apply encryption everywhere, well, everywhere. "We're looking at adding chat functionality, and looking to integrate with the blockchain, so that cryptographic identities are really secured by the blockchain."

How does the new technology work?

There's an explainer video here. And yes, the time-honored characters of Bob, Alice and Chris all star in the clip.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.