Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Protection

Data in Use Is the Point of Least Resistance

If Left Unprotected During Processing, Data is Vulnerable to Various Attacks

No matter our pursuit, we’re all looking for opportunities to push the proverbial ‘Easy Button’ – to find a way to accomplish tasks in a timely, efficient manner while exerting the least amount of effort.

If Left Unprotected During Processing, Data is Vulnerable to Various Attacks

No matter our pursuit, we’re all looking for opportunities to push the proverbial ‘Easy Button’ – to find a way to accomplish tasks in a timely, efficient manner while exerting the least amount of effort.

Attackers working to compromise networks and steal our data are no different; they are on the hunt for the most convenient point of entry. In security, the ‘Easy Button’ attack vectors are not always the most obvious as the well-known vulnerability points tend to receive a fair share of the security budget and are therefore reasonably (or at least adequately) guarded. The path of least resistance for an attacker is often an overlooked and unprotected portion of the enterprise environment such as the data processing layer – while it may take slightly more skill to access, knowing that such effort is highly likely to yield positive results makes it an open invitation for an opportunistic attacker. 

Today, most organizations are aware of the need to secure their data while at rest and encrypt their data while in transit, but what about securing data as it’s being used or processed? Extracting value from data by performing actions such as search and analytics requires decryption, creating critical points of exposure. Of the three states of data within an organization that constitute the Data Security Triad (Data at Rest, Data in Transit, Data in Use), Data in Use has become a point of least resistance for an attacker. There is a major industry need to recognize this lapse and close the gap in data security by protecting data while it is being used to ensure sensitive assets such as Intellectual Property, PII, and other compliance-critical data are protected throughout the processing lifecycle. 

The security industry is built on the basic assumption that there are certain fundamental protections computers promise, such as the belief that our core elements (like kernel memory) are safe. The chip flaw disclosures over the past year by Intel and others rattled this basic understanding, exposing a massive and pervasive memory attack surface. In a post on his popular Schneier on Security blog, security expert Bruce Schneier described the threat this way: 

Spectre and Meltdown aren’t anomalies. They represent a new area to look for vulnerabilities and a new avenue of attack. They’re the future of security – and it doesn’t look good for the defenders.”

If left unprotected during processing, the data is vulnerable to targeted attacks such as RAM scraping, advanced persistent threats, perimeter and fencing attacks, insider threats, side channel attacks, and compromised data environments. While the chip flaws may be the most pervasive example of memory attack surface vulnerabilities we’ve seen to date, they won’t be the last. Memory exploitation is now ‘low hanging fruit’ for attackers. The exposure of these type of exploits, coupled with the near-daily headlines announcing massive data breaches around the globe, are shredding consumer confidence in the ability of major institutions to protect sensitive data. And since consumer trust may be the only company asset more valuable than the data an organization possesses, security teams need to act quickly.  

It’s not that memory vulnerability or memory attack hasn’t existed up to this point, but we have typically seen it in more esoteric channels. For those of us who have spent time working in the national security space, this threat category is nothing new. But in the commercial world, it is shocking to comprehend such a broad and serious memory vulnerability across ubiquitous chipsets, which are inherent in almost every modern server or processor that is shipped out. Meltdown and Spectre introduced of a new class of security problems: the ability to exploit a vulnerability inherent in the foundation upon which our entire cyber security system is based. Naturally, this type of broad breach is appealing for attackers of all sizes and levels of sophistication. 

What can be done to combat Data in Use as a point of least resistance for the attacker? Organizations should start by taking three steps to lay the groundwork for protection: 

Advertisement. Scroll to continue reading.

1. Know Your Data – Where is it? Why do you have it? Who has access? What is its value? Protecting your whole data environment should be the ultimate goal and not all data is created equal. Crown jewel data must be identified and prioritized. Basic data stewardship should be the first step to identifying potential challenges, ranking data according to level of security required, and allocating budget accordingly. 

2. Evaluate Current Protections – What, if anything, is currently being done to protect data during processing? Are perimeter defenses in place? Basic access controls? Data in Use security solutions? Identify the strengths and weaknesses of your security posture as it relates to Data in Use in your overall security strategy. Ensure that protections for Data in Use are scheduled to be regularly evaluated as part of future risk assessments.  

3. Recognize Your Options – There are a variety of technical methods being used to combat the Data in Use vulnerability including market-ready solutions supporting homomorphic encryption, secure multiparty compute, and secure enclave technologies. While some require systems changes, others are compatible with existing infrastructure and may be able to seamlessly integrate with your underlying environment. 

Today’s security playbook is constantly changing and it is challenging to keep up with emerging threats and attack surfaces. Evaluating your security profile with a data-centric focus through the lens of the Data Security Triad can help eliminate commonly overlooked vulnerabilities such as those in the memory/processing layer. There’s too much at stake to continue business as usual. 

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

Compliance

The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often...

Data Protection

While quantum-based attacks are still in the future, organizations must think about how to defend data in transit when encryption no longer works.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Cybersecurity Funding

Los Gatos, Calif-based data protection and privacy firm Titaniam has raised $6 million seed funding from Refinery Ventures, with participation from Fusion Fund, Shasta...