Vulnerabilities / Threats

6/7/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

In Pursuit of Cryptography's Holy Grail

Homomorphic encryption eliminates the need for data exposure at any point - something that certainly would be welcome these days.

For the last 40 years, the world has been chasing the holy grail of cryptography — practical homomorphic encryption. Indiana Jones for math dorks? Hardly.

If encryption is a vault protecting your sensitive data, traditional practice requires taking the data out of the vault every time it needs to be used or processed — when users perform a search, apply analytics, etc. This leaves the data exposed and vulnerable to a breach. Homomorphic encryption allows these critical actions to take place within the vault, eliminating the need for data exposure at any point.

If we ignore the need to protect data while it's being processed (in use), it really doesn't matter how secure the data is on the way to the vault (in transit) or while stored in the vault (at rest): an attacker can simply patiently wait until the data is completely exposed during use to steal it. In the data security landscape, data in use has become the point of least resistance for an attacker. Homomorphic encryption can ensure this final piece of the data security puzzle is solved by eliminating the data-in-use security gap.

Sometimes thought of as esoteric mathematics with little practical relevance, homomorphic encryption has been the subject of much study and pursuit in the academic, government, and commercial spaces in the last four decades. Simply put, homomorphic encryption allows operations to be performed on ciphertext as if it were plaintext; this enables applications to perform actions on critical data inside the vault of encryption. It provides the security of encryption while keeping data usable, allowing functions to be performed on the data in its encrypted state. This eliminates both the extra effort and exposure gap required by today's standard practice (decrypt, use, encrypt again).

Until recently, homomorphic encryption had been considered too computationally impractical. In its initial form, it was painfully slow (think around a million times longer for processing), bulky, and expensive to implement, which left most working around and, in some cases, ignoring the vulnerabilities of data in use completely. This is changing, however, as homomorphic encryption is finally moving from the realm of the theoretical to the commercially practical.  

In the commercial world, many powerful horizontal use cases centered around securely using both encrypted and unencrypted data are uniquely addressed by homomorphic encryption. These include secure data processing in the cloud, risk reduction/elimination under various compliance regulations such as the EU's General Data Protection Regulation, protection of the most sensitive "crown jewel" data assets of an organization at every point in the processing life cycle, and a host of powerful unexpected applications such as third-party risk and secure data monetization.

In the realm of third-party risk, homomorphic encryption can enable data sharing while eliminating the need to hand over entire data sets. Imagine being able allow trusted third parties to perform encrypted search on a data set held by the data owner containing sensitive information such as personally identifiable information (PII) or financial data without the risk of incidental exposure to information beyond the scope of relevance. This protects both the data owner and the data consumer from potential compliance/regulatory concerns and, since the full data set now never has to leave the owner's possession, it also prevents trickle-down exposure due to data mishandling by the third party or other affiliates with whom the owner may need to share the information.

There is also clear broad applicability in the area of secure data monetization. Organizations across industries are sitting on troves of existing data assets that could become sources of additional revenue if they had the ability to provide secure search and analytic access without increasing their own organizational risk. Homomorphic encryption can be used to ensure that searchers can obtain information without revealing their interests, a factor that could be advantageous in the financial (think know-your-customer and anti-money laundering efforts) and healthcare fields (query patient data without exposing PII or other sensitive indicators), among others.

With numerous possible applications, the paradigm-shifting potential of practical homomorphic encryption will continue to spur pursuit in the academic and commercial spaces alike. Without question, homomorphic encryption is a game changer — it's been pursued for nearly four decades with good reason. The significance of its potential impact on the broader data security market is moving it from a term recognized within niche circles to a required part of an enterprise's security arsenal. 

Related Content:

Dr. Ellison Anne Williams is the Founder and CEO of Enveil. She has more than a decade of experience spearheading avant-garde efforts in the areas of large scale analytics, information security and privacy, computer network exploitation, and network modeling at the National ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.