Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/7/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

In Pursuit of Cryptography's Holy Grail

Homomorphic encryption eliminates the need for data exposure at any point - something that certainly would be welcome these days.

For the last 40 years, the world has been chasing the holy grail of cryptography — practical homomorphic encryption. Indiana Jones for math dorks? Hardly.

If encryption is a vault protecting your sensitive data, traditional practice requires taking the data out of the vault every time it needs to be used or processed — when users perform a search, apply analytics, etc. This leaves the data exposed and vulnerable to a breach. Homomorphic encryption allows these critical actions to take place within the vault, eliminating the need for data exposure at any point.

If we ignore the need to protect data while it's being processed (in use), it really doesn't matter how secure the data is on the way to the vault (in transit) or while stored in the vault (at rest): an attacker can simply patiently wait until the data is completely exposed during use to steal it. In the data security landscape, data in use has become the point of least resistance for an attacker. Homomorphic encryption can ensure this final piece of the data security puzzle is solved by eliminating the data-in-use security gap.

Sometimes thought of as esoteric mathematics with little practical relevance, homomorphic encryption has been the subject of much study and pursuit in the academic, government, and commercial spaces in the last four decades. Simply put, homomorphic encryption allows operations to be performed on ciphertext as if it were plaintext; this enables applications to perform actions on critical data inside the vault of encryption. It provides the security of encryption while keeping data usable, allowing functions to be performed on the data in its encrypted state. This eliminates both the extra effort and exposure gap required by today's standard practice (decrypt, use, encrypt again).

Until recently, homomorphic encryption had been considered too computationally impractical. In its initial form, it was painfully slow (think around a million times longer for processing), bulky, and expensive to implement, which left most working around and, in some cases, ignoring the vulnerabilities of data in use completely. This is changing, however, as homomorphic encryption is finally moving from the realm of the theoretical to the commercially practical.  

In the commercial world, many powerful horizontal use cases centered around securely using both encrypted and unencrypted data are uniquely addressed by homomorphic encryption. These include secure data processing in the cloud, risk reduction/elimination under various compliance regulations such as the EU's General Data Protection Regulation, protection of the most sensitive "crown jewel" data assets of an organization at every point in the processing life cycle, and a host of powerful unexpected applications such as third-party risk and secure data monetization.

In the realm of third-party risk, homomorphic encryption can enable data sharing while eliminating the need to hand over entire data sets. Imagine being able allow trusted third parties to perform encrypted search on a data set held by the data owner containing sensitive information such as personally identifiable information (PII) or financial data without the risk of incidental exposure to information beyond the scope of relevance. This protects both the data owner and the data consumer from potential compliance/regulatory concerns and, since the full data set now never has to leave the owner's possession, it also prevents trickle-down exposure due to data mishandling by the third party or other affiliates with whom the owner may need to share the information.

There is also clear broad applicability in the area of secure data monetization. Organizations across industries are sitting on troves of existing data assets that could become sources of additional revenue if they had the ability to provide secure search and analytic access without increasing their own organizational risk. Homomorphic encryption can be used to ensure that searchers can obtain information without revealing their interests, a factor that could be advantageous in the financial (think know-your-customer and anti-money laundering efforts) and healthcare fields (query patient data without exposing PII or other sensitive indicators), among others.

With numerous possible applications, the paradigm-shifting potential of practical homomorphic encryption will continue to spur pursuit in the academic and commercial spaces alike. Without question, homomorphic encryption is a game changer — it's been pursued for nearly four decades with good reason. The significance of its potential impact on the broader data security market is moving it from a term recognized within niche circles to a required part of an enterprise's security arsenal. 

Related Content:

Dr. Ellison Anne Williams is the Founder and CEO of Enveil. She has more than a decade of experience spearheading avant-garde efforts in the areas of large scale analytics, information security and privacy, computer network exploitation, and network modeling at the National ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Could you pass the hash, I really have to use the bathroom!
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9892
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbit...
CVE-2019-10066
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment i...
CVE-2019-10067
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context...
CVE-2019-6513
PUBLISHED: 2019-05-21
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-12270
PUBLISHED: 2019-05-21
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The ...