Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/7/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv

In Pursuit of Cryptography's Holy Grail

Homomorphic encryption eliminates the need for data exposure at any point - something that certainly would be welcome these days.



For the last 40 years, the world has been chasing the holy grail of cryptography — practical homomorphic encryption. Indiana Jones for math dorks? Hardly.

If encryption is a vault protecting your sensitive data, traditional practice requires taking the data out of the vault every time it needs to be used or processed — when users perform a search, apply analytics, etc. This leaves the data exposed and vulnerable to a breach. Homomorphic encryption allows these critical actions to take place within the vault, eliminating the need for data exposure at any point.

If we ignore the need to protect data while it's being processed (in use), it really doesn't matter how secure the data is on the way to the vault (in transit) or while stored in the vault (at rest): an attacker can simply patiently wait until the data is completely exposed during use to steal it. In the data security landscape, data in use has become the point of least resistance for an attacker. Homomorphic encryption can ensure this final piece of the data security puzzle is solved by eliminating the data-in-use security gap.

Sometimes thought of as esoteric mathematics with little practical relevance, homomorphic encryption has been the subject of much study and pursuit in the academic, government, and commercial spaces in the last four decades. Simply put, homomorphic encryption allows operations to be performed on ciphertext as if it were plaintext; this enables applications to perform actions on critical data inside the vault of encryption. It provides the security of encryption while keeping data usable, allowing functions to be performed on the data in its encrypted state. This eliminates both the extra effort and exposure gap required by today's standard practice (decrypt, use, encrypt again).

Until recently, homomorphic encryption had been considered too computationally impractical. In its initial form, it was painfully slow (think around a million times longer for processing), bulky, and expensive to implement, which left most working around and, in some cases, ignoring the vulnerabilities of data in use completely. This is changing, however, as homomorphic encryption is finally moving from the realm of the theoretical to the commercially practical.  

In the commercial world, many powerful horizontal use cases centered around securely using both encrypted and unencrypted data are uniquely addressed by homomorphic encryption. These include secure data processing in the cloud, risk reduction/elimination under various compliance regulations such as the EU's General Data Protection Regulation, protection of the most sensitive "crown jewel" data assets of an organization at every point in the processing life cycle, and a host of powerful unexpected applications such as third-party risk and secure data monetization.

In the realm of third-party risk, homomorphic encryption can enable data sharing while eliminating the need to hand over entire data sets. Imagine being able allow trusted third parties to perform encrypted search on a data set held by the data owner containing sensitive information such as personally identifiable information (PII) or financial data without the risk of incidental exposure to information beyond the scope of relevance. This protects both the data owner and the data consumer from potential compliance/regulatory concerns and, since the full data set now never has to leave the owner's possession, it also prevents trickle-down exposure due to data mishandling by the third party or other affiliates with whom the owner may need to share the information.

There is also clear broad applicability in the area of secure data monetization. Organizations across industries are sitting on troves of existing data assets that could become sources of additional revenue if they had the ability to provide secure search and analytic access without increasing their own organizational risk. Homomorphic encryption can be used to ensure that searchers can obtain information without revealing their interests, a factor that could be advantageous in the financial (think know-your-customer and anti-money laundering efforts) and healthcare fields (query patient data without exposing PII or other sensitive indicators), among others.

With numerous possible applications, the paradigm-shifting potential of practical homomorphic encryption will continue to spur pursuit in the academic and commercial spaces alike. Without question, homomorphic encryption is a game changer — it's been pursued for nearly four decades with good reason. The significance of its potential impact on the broader data security market is moving it from a term recognized within niche circles to a required part of an enterprise's security arsenal. 

Related Content:

Dr. Ellison Anne Williams is the Founder and CEO of Enveil. She has more than a decade of experience spearheading avant-garde efforts in the areas of large scale analytics, information security and privacy, computer network exploitation, and network modeling at the National ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...