SAFE

Compliance has become the way we measure what cybersecurity actions are necessary to defend our electronic assets. The process of cybersecurity rulemaking and subsequent examinations for compliance (e.g., SOC2, ISO, SEC, FINRA, HIPAA) sets the roadmap for organizations. Cybersecurity compliance embodies our collective institutions of standards via controls, rules, regulations, and laws—yet these institutions often have differing agendas and confused messaging. What we do know is that cybercrime continues to grow despite the “Defense in Depth” approach we pursue today—often driven by compliance. We utilize a mix of products and services designed to play “hide and seek” without solving the challenge of data protection and privacy. Epistemology is a philosophy that explores the nature and limits of human knowledge. It is concerned with one’s knowledge in relation to reality: what do I know and how did I learn it? In cybersecurity, our knowledge is what we learn from previous cyber-attacks. […]

Earlier this month we exhibited at the Gartner Security & Risk Management Summit—one of the largest cybersecurity conferences that brings together cybersecurity leaders and specialists. And after three days with the best minds in cybersecurity, we learned that none of the leaders we talked with are protecting operational data through searchable encryption. It’s not because they don’t understand the importance of protecting searchable data, but rather because they didn’t know it was possible to search encrypted data. For over 20 years, searchable encryption has been theoretical. It’s been on wish list of every organization with sensitive data but wasn’t practical. It simply couldn’t be done at the speed of business. When we told people that Paperclip SAFE delivers complete, searchable encryption without compromising speed or security—they were skeptical. So, how did we do it? We were thrilled to hear this question from Gartner Summit attendees, and even more thrilled to share […]

We often get asked, is there a difference between data masking and data encryption? The short answer: there is a HUGE difference. Data masking (DM) or data anonymization is required by many compliance frameworks such as GDPR and ISO 27002:2022 (Control 8.11) and is recognized by Gartner as a growing category within data security technology. While it’s touted as a solution for protecting sensitive data, the reality is that most DM solutions only provide a band-aid for the gaping wound that is data theft and data ransom. According to Gartner, DM is based on the premise that sensitive data can be transformed into less sensitive, but still useful, data. The market for data protection, DM included, continues to evolve with technologies designed to redact, anonymize, pseudonymize, or in some way deidentify sensitive data in order to protect it against confidentiality or privacy risk. Masking techniques have become almost common place […]

The vulnerabilities related to critical data residing as plaintext (unencrypted in RAM, cache, CPU, storage, processing server, etc…) to be searchable is the truest definition of a cybersecurity epidemic. The news headlines have been filled with a never-ending stream of data-theft breaches and ransomware data abductions. These attacks are spreading at a rate similar to any flu virus. CRN – The 10 Biggest Data Breaches of 2022 To date, businesses of all sizes, from healthcare to insurance to banking, and even critical infrastructure utilities have relied on industry best practices related to encryption. When it comes to critical data at the core, transactional database layer, the go-to solutions have been encryption at rest and encryption in transit. Today, there are many excellent encryption at rest and encryption in transit solutions available, and they do a great job securing critical data while in those proper states. When the data is static […]

by Chad F. Walter, CRO at Paperclip Inc. and Mark McCreary, Partner and Co-Chair of the Privacy and Data Security Practice Group at Fox Rothschild. There’s no mistake, we’re in a recessionary cycle. We can stay out of the politics and debate related to predicting the exact cause, effect, size, and timeline of the recession. Debate or no debate, we’re already seeing businesses fall back to a more conservative approach to spending across the board. I know businesses and consumers are concerned because one of the top questions asked over the past few months is “How do you think the recession will impact cybersecurity?” Of course, the answer is relevant to the individual asking the question. If the question comes in from a cybersecurity student or someone breaking into the cybersecurity workforce, the answer is different than if it comes in from a business leader. For this discussion, let’s stay focused on […]

Data security experts and policy makers all agree, encryption is the best way to secure data. Encryption is essential to any business’s cybersecurity program, but many companies remain exposed. It’s estimated that hackers will steal over $24 trillion of data in the next three years. This is because many companies fail to understand encryption-in-use. What is encryption-in-use? It refers to is the ability to do computations on critical data while it remains encrypted. Right now, your most valuable and vulnerable data sits fully exposed as plaintext within your memory stack. Every threat actor knows this. Data theft is a growing epidemic, but it can be addressed with better data encryption.

I’m sure we all remember the parable of the Emperor Who Had No Clothes. Clever weavers promise a fabulous outfit that is invisible to the unworthy and then leave the emperor naked, with nobody willing to admit it because they don’t want to seem unworthy. There are unfortunate parallels between this and the state of modern database security. Modern cybersecurity has a whole host of impressive technology and tools. Perimeter security using complex passwords, physical keys, and endpoint detection builds a wall around critical data. Some attackers still get in. Various types of on-disk encryption raise the difficulty of exploiting a stolen database file. Technologies like SSL protect the pathways as critical data is transported. These technologies work, and new and inventive improvements are made every year. With such widespread technology the industry establishes protection at the perimeter, while data is in rest on disks, and while data is in […]

As we move into the end of summer, cyber attacks are rising like the temperatures outside our front door. The bad actors are organized, well-funded machines, and they’re after your critical data, your money, and your business. And the business of cybercrime is changing for all of us, good and bad actors alike. Economic uncertainty, war in the Ukraine, and political unrest is fueling the winds of cybercrime innovation and audacity. We as business leaders are being pressured to be better and to meet the challenges of an invisible foe hellbent on destroying everything we’ve built. One of the first cybersecurity incidents I was exposed to happened almost 20 years ago. It involved a Russian hacker who social engineered an employee in distress. This employee didn’t actually work for the target client. They were part of a larger third-party contract and had access to the target client’s critical data. In […]

If you are the owner or the caretaker of a financial services industry firm, then you have a $4 million plus liability waiting for you—the data breach. The financial services industry collects personal information (PII data), financial information, and—in the insurance field—health information (PHI data). This is the data the cyber criminals want to steal. Just to be clear, the information cyber criminals are after is mainly PII data—our names, social security numbers, date of birth, and anything that identifies an individual. Next is nonpublic information (NPI), typically financial information encompassing credit cards, bank accounts, loans, and mortgages. Cyber criminals are also after personal health information (PHI). This is any type of information regarding medical conditions, pharmacy, family history and more. These three categories of confidential information are at the center of transacting business in the financial services industry. According to the IBM 2021 Cyber Security Report, the average breach […]