Ulf Mattsson

This conversation is closed.

Beyond encryption for Big Data. Encryption is no longer secure. What is the the new way to protect data?

Big Data is very powerful. Analysis of massive amounts of data provides companies the power to identify trends and improve business. Big data is scalable and has superior performance. However companies are now faced with the obstacle of compliance and security regulations that had not been considered before. In addition, the data environment used today must adapt to the ever-changing data security landscape in the future. Now is the time to bridge the gap between security regulations, privacy and compliance, yet still be able to provide powerful analysis and data insight to achieve the power behind a big data environment.

  • Nov 6 2013: Slow down their cowboy, where is “encryption is no longer secure” coming from? You mean encrypted databases are difficult to use in conjunction with big data analysis? Or did I miss something big about encryption?
  • Oct 18 2013: Backup has always been the best form of protection and the best way to keep a secret is to not tell anyone.
  • thumb
    Nov 8 2013: Is the goal here to keep the customer's personal information safe for their own sake, or to protect the data as the company's property, for the company's sake?

    If it's the former, I don't believe users of services can truly be safe unless they're safe from their service provider. Encrypt the data client side and make it impossible for even a sysadmin to view it.

    Otherwise I believe there's a conflict of interest. The data needs to be collected and made accessable for the danger to exist at all. If that's the business model, then any balance between security and accessability is a compromise.
  • thumb
    Nov 6 2013: that topic would be interesting, was it met two criteria: having an opening statement/question that makes actual sense, and not being an obvious self promotion.
  • thumb
    Nov 2 2013: I agree that "there never was any secure data, as long as you didn't make up your own encryption software and constantly updated it", but data tokenization may change the game.

    Ulf Mattsson, CTO Protegrity
  • thumb
    Nov 2 2013: The good news is that some leading companies are finding new ways to bridge the gap between security regulations, privacy and compliance, yet still be able to provide powerful analysis and data insight to achieve the power behind a big data environment.

    I recently read an interesting study from Aberdeen Group about security-related incidents. The study revealed that “Over the last 12 months, tokenization users had 50% fewer security-related incidents(e.g., unauthorized access, data loss or data exposure than tokenization non-users”. The name of the study is “Tokenization Gets Traction”. Aberdeen has also seen “a steady increase in enterprise use of tokenization as an alternative to encryption for protecting sensitive data”.

    Ulf Mattsson, CTO Protegrity
  • thumb
    Oct 23 2013: Encapsulating data with a built in self-erasing / self-garbling mechanism after first use or a pre-determined amount of time is a possible way out. The overheads would be high, but then it could be applied selectively to data-sets that are more sensitive.
  • thumb
    Oct 21 2013: Do not put any of your data on a system that is accessible to the net.

    Then the only problem is NSA and other government agencies.
  • thumb
    Oct 16 2013: Perhaps if the data was only available in a usable state momentarily as it is computed, then reverted to an unusable state, again within milliseconds, In a fluid manner, and each request would be encrypted from billions of combinations, each request being unique,rather than classic static cloud or hard drive storage. For websites, the front user end would be visual frame, but the data behind it would only exist momentarily as the user requested it then reverted to an unusable state again, each time the data encryption would be unique from billions of combinations and only exist for that user momentarily......Sorry just an idea not an encryption expert :)
  • thumb
    Oct 15 2013: If you had followed the 'Encryption Wars' between government agencies and the hacker community, you could have known, that there never was any secure data, as long as you didn't make up your own encryption software and constantly updated it.

    And because big data is powerful, as you said, we should change the laws to avoid its misuse.

    I promote the idea of the 'Individual Data Property Right', which ensures any individual to decide who is allowed to collect his/her data and who isn't. This way, behavioral pattern of groups of people can not been analyzed without all group members agreeing with it.

    This way, information mining companies, such as Google, wouldn't be allowed anymore to put their tracking-cookies in anyones browser - unasked - to spy on the peoples Internet use. Who are they to spy on their customers?

    When people get to see the reason for data collection, they can decide if it makes sense to them or not and give or withdraw their permission. Violation is prosecuted and its penalty jail time only, no fines, as fines would just be another way to pay for those illegal data.

    Once that is in place, alongside strong privacy regulations, isolated data pools become a must. No connection to any network, no connection to the Internet., no standard operating system + individual encryption software.
    • thumb
      Nov 6 2013: Re: "Who are they to spy on their customers?"

      Well, if you want to make money, you need to provide something useful to the customers. And to provide something useful, you need to know what customers need or want. By definition, any business involves collecting information on what people need.

      Google is in a position where they can collect way more information on way more people than anybody else. Naturally, they capitalize on this ability and help other companies to identify their customers. I don't see anything outrageous in this behavior - that's what I would expect. In fact, Google helps salesmen to target specific people saving everyone's time and money. That's valuable.

      So, although I understand the privacy and security concerns, the question is equivocal. Whether I want someone to collect data on me is a question of ethics and trust rather than technology.
      • thumb
        Nov 7 2013: 'Well, if you want to make money, you need to provide something useful to the customers. And to provide something useful, you need to know what customers need or want.'

        Isn't Google mainly a search engine? And isn't the information their customer are interested in what the customers are looking for on this search engine? In other words - the customers are already typing in what their interest is about. So what other information than that is needed?

        Imagine your local baker would backtrack all the other shops you visited on your shopping tour before you entered his/her shop. What for? To offer you a bread which goes well with a a certain butcher you have visited before? No, this is none of the bakers business what you got elsewhere, this is of your private concern only.

        'Naturally, they capitalize on this ability and help other companies to identify their customers. I don't see anything outrageous in this behavior.'

        Well, I do, because they make money with information which they just take freely from their customers. Would you accept your medical doctor, your hospital to sell your private information to private corporations, so that they in return can target you as potential customer for, lets say, broken bones?

        What I do on the Internet is my personal business only. Whether I watch porn, do some online shopping or write here on TED is private, and no one is allowed to spy on my behavioral pattern without my allowance. Why should anyone be allowed?

        If it is valuable to you when Google helps salesmen to target you, saving your time and money, thats absolutely fine with me, yet because you like it doesn't mean that anyone likes it. And by making it necessary to ask for allowance for private data collection both of us are happy. You save your time and money and I keep my privacy. And what can be better than that both of us are fine as well as Google and other salesman?

        There is nothing equivocal in privacy! Where did you get this idea from?
        • thumb
          Nov 8 2013: If you want a search engine that does not care what you want - just provides search results, use http://duckduckgo.com. I do use them. However, I found that many search that duckduckgo are not what I want. While, as I go to Google, most of the top search results are relevant to what I'm searching, most of the time. It's because they are a lot better at figuring the context and what I might be looking for.

          There is a difference between a baker shop where you show up first time and a baker shop where you are a regular customer and the baker knows you personally. He greets you with your name and gives you your favorite bread ready and waiting for you and, in case you forgot your wallet, he would give you credit knowing that you will pay next visit. Imagine walking into a bread shop where the baker knows that you just visited a meat store and bought some burgers. He would already know that you are after burger buns rather than hotdog rolls. What's wrong with that?

          Well, of course, you won't want a porn shop owner greet you as a regular customer :-). I don't think it's realistic to prohibit people watching you. If you don't want others to know what you do, then hide - use encryption, locks, vaults, and what not. But, in many cases, the question is, should I be doing things I don't want others to know I'm doing?

          I cannot say that all tracking is outrageous and must be prohibited. There are cases when it is. It's an ethical question. It needs discretion.

          E.g. I post on TED using my real name. The posts show up on Google. I know that and I try not to say anything here that I might later regret. Many people are uncomfortable with such tracking. I figured that I have to live with it. So, I'd rather adjust my own behavior.

          It's just my attitude. I don't mean that everyone else must follow my philosophy.
      • thumb
        Nov 8 2013: While Google comes to mind as a company that collects a tremendous amount of data for advertising purposes, they're not the first company to come to my mind when I think of data brokers and behavior analytics. Large companies such as ComScore also use cookies and pixel tags to track browsing habits, which they hide on most news outlets and mainstream services. These companies the average web user is hardly aware of. Even after disabling cookies and javascript, hidden images are still used to track users, and blocking them is incredibly difficult, even for someone who writes their own browser extensions.
      • thumb
        Nov 8 2013: How do you connect a search engine '... that does not care what you want ' with data collection that got nothing to do with what you want?

        Whats wrong with a baker who already knows what I want without me naming what I want? Well, anything, because the baker has to invade my privacy to gain this knowledge and without my permission to do so, this is an illegal invasion of my private space. It is interesting that you don't seem to realize that.

        Imagine you meet a friend in a pub for a good conversation. How would you feel when you find this 'friend' checking your jacket and wallet for random invoices and bills of your latest purchases when you return from the restroom? Would you enjoy this in expectation for a better matching Christmas present from his(her side this year, or would you rather reconsider the general 'friendship' to this person? And this was someone you at least considered a friend and not even a total stranger.

        Following your logic, why wouldn't I want my favorite porn shop owner greet me in public as a regular customer? Why should my sexual preferences and interests be part of my privacy? Why not allow also here to be reduced to a transparent consumer? Wouldn't it also save my time and money if he shouts across the street his newest 'specials' which I may be interested in, given my latest purchase history in his books? Isn't sex just a natural thing?

        The problem with the argument 'should I be doing things I don't want others to know I'm doing?' is, that it does allow for anything and protects nothing. Why not have governments and corporations install video cameras in our homes? If we have nothing to hide, there is no reason not to want that, right? Wrong!

        I assume the laws in your country protect you against physical stalking of people you don't wish to invade your privacy. At least I hope you have this protection. So why should our digital privacy any different from that? Just because its digital? Is that the only difference?
      • thumb
        Nov 8 2013: I accept your attitude, that is perfectly fine with me, yet my attitude is different and I don't agree on digital transparency just because it has become common practice due to lacks within the legal framework since we entered the informational era.

        I know how and do protect my computer as good as possible against information hijacking, yet this knowledge goes way beyond the 'common knowledge' I expect a normal computer user to have, which, in itself, generates many victims which don't even know what is happening to them.

        This got to be stopped and transparency reversed, so that any user can freely chose to allow data-mining on his computer or not, which does not hinder service provider to reach their customer, yet protects those who don't wish service provider to sniff in their pockets unasked.

        Because why should service provider be doing things they don't want their customers to know they are doing?

        And because this argument works both ways, the majority interest has to determine the legal framework and on this, customers are way larger in numbers and therefore their privacy interest outperforms the interest of a view service provider to break into it.

        And as privacy is no matter of choice but a right in democratic societies, we should re-claim them in our new digital landscapes as well, at least within the legal boundaries of our democratic nations.

        Violations from non democratic nations can of course not be avoided on the Internet, yet it is not likely, that a service provider located in non democratic nations have much use of our customer information anyway, not to mention that those information were illegal in the first place and therefore more than risky to attract interest in our nations.

        So no, I like to talk to my baker the old fashion style to tell him what I like to buy from him today, because this is the only foundation on which trust can grow and by which both of us can become friends if we so chose to.
        • thumb
          Nov 8 2013: Re: "Because why should service provider be doing things they don't want their customers to know they are doing?"

          Exactly. This is an ethical question, as I mentioned. What I said about consumers, definitely, applies to the service providers or government. Ethical questions are tricky. In most cases, not only it's important to consider how the data IS used, but also how it IS INTENDED to be used or how IT CAN or MIGHT be used. I recently watched some corporate training course on ethics. One example was about conflict of interests. In this example, a company official was considering bids from service contractors and accidently learned that one of the contractors is her son's professor who might hire her son for an internship. She is advised to disclose this connection to the corporate legal department although nobody even knows about the connection and she herself just learned about it accidently, and this bid might be the best anyway.

          Ethical questions are about feelings, not about facts. Some people are comfortable discussing their sex life on Facebook and posting pictures from their recent colonoscopy, while some are not. Some people have the "leave me alone" attitude, while others feel depressed because nobody pays any attention to them.

          It's ironic how people complain that the government does not listen to the citizens and when they find out that they, actually, do, they are outraged.

          Not that I disagree with you, I just wanted to point out that this is a controversial issue. I also do not like Facebook attitude towards privacy and do not like the latest change on Google making it impossible to check your email without logging into the Google account that combines everything else including Youtube, Drive, Picasa, Google+, etc. But I don't blame them for doing that. Whether I like it or not, I can't blame cats that they meyow or dogs that they bark or rain that it's wet.
      • thumb
        Nov 8 2013: 'Ethical questions are about feelings, not about facts'

        But what makes you think, that feelings are no facts? Is your favorite color or dish questionable by anyone? Both may change over time, yet this wouldn't change their current validity.

        Wherever possible, I prefer wise compromises over stupid and unreflected regulations, yet there are also indisputable morals on which we continuously have to agree on as a society or even as a whole species, out of which we began to define the basics of human rights.

        And although many people truly wish for economics to be seen as fundamental laws of physics, it simply isn't and therefore its mechanics changeable at any time and to any degree as soon as enough people decide for it. Therefore, Google and facebook terms of use can only operate legally within the frameworks given by society, and this is what separates them significantly from barking dogs, meowing cats and the fact that water is wet.

        I assume you would not tolerate when facebook would sell information they collect from their teenage customers, as well as their 'personality profiles' the could extract to certain degrees to pedophile circles for them to easier identify their next potential victims?

        I think this 'ethical question' isn't as tricky as it seems, is it?

        But why should our privacy be any more difficult from that? Isn't exactly this privacy what our legal system is so sensitive about? Why do we not allow our state executives to decide alone when to break into privacy and when not? Why do we back this up with judges to decide and this based on reasonable and defined rules and laws?

        Yet as soon as 'the market' gets involved all of this security arrangements seems not to apply anymore. Why? For what reason?

        And it would be such a simple rule! No data collection without conscious permission. Period.

        And 'conscious permission' is important here to avoid this to get hidden deep within 30 pages of 'terms of conditions' which no one reads anyway. And Bingo!
        • thumb
          Nov 8 2013: You seem to be more emotional about this issue than it deserves.

          There are contradictions in what you say:

          Re: "Wherever possible, I prefer wise compromises over stupid and unreflected regulations, yet there are also indisputable morals on which we continuously have to agree on as a society or even as a whole species, out of which we began to define the basics of human rights." ... "And it would be such a simple rule! No data collection without conscious permission. Period."

          1. Wouldn't prohibiting to collect any information on the customers be stupid and unreflected? If I am selling something to a customer and ship it to his home address, I have to collect the name of the customer, what he bought, how much he paid, card number and such, and where I shipped the product. Over time, I will have a history of purchases from the same customer. Do I need an explicit customer consent to collect such information or is consent "implied"? How far should I go with my outrage and protest?

          2. I do not understand the phrase "there are also indisputable morals on which we continuously have to agree on as a society". It sounds like we have to continuously dispute your "indisputable morals". To me, morals resemble left and right hand. I can swear that my right hand is on my right side. It is indisputable and absolute. It does not matter where I turn - it's ALWAYS on my right side. Now, YOUR right hand is a different matter. If we face the same direction, your right hand is on my right. But if we stand against each other, your right hand is on my LEFT. Ethical questions are as tricky as the question "on which side is the right hand"? The answer *seems* obvious and indisputable - on the "right" side until we start thinking, *whose* right side. The key to answering this question is the ability to "put ourselves in other person's shoes". This is the way to make wise compromises instead of stupid rules.
        • thumb
          Nov 9 2013: I also prefer wise compromises over stupid rules. This is why I'm OK with what Google and Facebook are doing. I let them do whatever they want, and I do whatever I want. Sounds like freedom to me. When I use Google and Facebook, I always assume that whatever I type in their web sites is public. If I don't want this information to be public, I do not submit it to Google and Facebook. This is why my Google and Facebook profiles do not contain much except my name and email address. It's simple. I don't need or require any regulations or court decisions.

          I used to be riled-up about this stuff. It's not new. Take the use of social security numbers to track ALL aspects of your financial life. The history goes way before the Internet. As I got older, I realized that this is not the biggest problem in my life. E.g. it's more important for me to work and provide for my family than to hide my income from the IRS; or to conveniently pay my bills using a checking account than to hide my expenses from the bank and the government and pay my bills using cash.
      • thumb
        Nov 9 2013: '1. Wouldn't prohibiting to collect any information on the customers be stupid and unreflected?'

        Why stupid? Why unreflected? Any customer can give permission for its data to be collected or not. So where is the problem to make a law, that data necessary for shipping & handling have to be deleted without further permission after a reasonable time period, which would be needed in case of shipping problem? If you so choose so, your data will be stored, mine has to be be deleted. One year later you just click &buy and I have to fill in my shipping data again. No big deal for both of us.

        2) 'there are also indisputable morals on which we continuously have to agree on as a society

        Sounds contradictory, doesn't it? Yet in fact it isn't and I choose these words consciously. Other than facts, such as your left & right hand, morals can and do change over time yet although changeable this doesn't mean that they can not be indisputable within certain periods, as often they are.

        Not that long ago homosexuality was considered a taboo, unnatural, immoral or even a disease and we have developed since. Nevertheless at those days it even formed laws and additional morals, which were indisputable in those days. And do we know today what human right will look like in 2000 years from today? No. But does this mean that those we have today are disputable to anyone? No, because then we could not make laws around them, at to enforce its validity.

        The relativity problem on morals you rightly rise and this is why I already referred to the majority interest in this context. There are more private individuals (customers) in this world then there are private corporations, and a wise decision should always aim at the most beneficial. Therefore this moral is not as difficult to find.

        And as I said before, I have no problem when Google stores my search query and does with this data what they want, but they have no right to spy on my Internet habit beyond their site and service. Pretty logic.
      • thumb
        Nov 9 2013: 'I used to be riled-up about this stuff. It's not new.'

        Yes, I understand your frustration, but privacy is nothing to defend just once in a lifetime to then be be granted afterwards and ever since. And the reason for this is, that it is of such delicate interest to so many, that there will always be highly erosive tides waving at it. Governments, corporations, secret services, you name it, you'll find it.

        And as technology and its misuse develops faster than our usual legislative processes, we either speed the latter up (nice thought though) or formulate privacy protection in wider but clear terms, so that future technological back-doors are covered as best as possible.

        On this, conscious permission and agreement on data collection is not only simple yet also pretty straight forward, as it neither hinders corporation to improve on their services with agreeing customers, nor does it allow for 'transparent customers' without protection. And because of this, I would consider this a very wise compromise, as it kills more than one bird with one stone.
        • thumb
          Nov 9 2013: Yet again, it seems that we deal with one of those circular questions without an answer. "and a wise decision should always aim at the most beneficial." - beneficial to whom? To the majority? What about the minorities? Ignore and suppress?

          I guess, the answer to moral questions is in paying attention to each other - trying to understand each other's needs and feelings. But too much of attention pretty soon turns into nagging and spying and invasion of privacy. As usual, we need to practice moderation... But not excessively. :-)
      • thumb
        Nov 9 2013: What better than the majority rule do we have to maximize fairness in beneficial outcomes in democracies?

        Minority rule? Rule of financial power?

        And why should Google & Co. be suppressed or ignored if they had to ask first to collect data legally? I am pretty certain that enough people would give heir allowance for them to optimize their customer service. You may well be one of them. And if no one would allow it, then this would be a highly valuable information for their business as well, as it is in not in any business interest to put off their customers.

        Excessively is big data collection at the moment and this because of any lack of moderation. Its time for this to change as soon as possible, so that the digital age becomes profitable to all of us and does not continue as expected privacy striptease.
        • thumb
          Nov 9 2013: As W. Churchill famously said, "Democracy is the worst form of government, except for all those other forms that have been tried from time to time."

          Re: "And why should Google & Co. be suppressed or ignored if they had to ask first to collect data legally?"

          When Google gained ability to collect such data, it wasn't clear that they should ask permission to do that. In retrospect, we think, they should, but its the "20/20 hind sight". In a free society, people don't ask permission to do something that is not prohibited. Things are developing as they should: as people gain ability to do new things, they do them. Lawmakers cannot predict everything people can do, and nobody can predict all possible outcomes of every possible activity. I don't think it is possible to create laws to prevent harm which has never been done.
          I think, in 20-30 years, these issues will be figured out. I have no worries about it.

          I think, how people view their privacy will also change. E.g. in 1895, the idea of income tax was so outrageous, it was deemed unconstitutional by the U.S. Supreme Court. After a century of brainwashing, paying income tax is now considered a patriotic duty and a cornerstone of U.S. democracy.
      • thumb
        Nov 11 2013: I take you quotation as an agreement that we have no better than the majority rule to maximize fairness in beneficial outcomes among grouping people.

        On '20/20 hind sight' is to say, that privacy issues existed even before Google, long before, although this may surprise some and their freedom is naturally restricted by the freedom of others, and this especially if it is about privacy.

        Finding new technical ways to invade privacy is no justification to do so. Or would you welcome your neighbors quad-copter, hovering in front of your window and aiming its video camera at you, just because we have no explicit law at the moment to forbid that? If my neighbor would do that, or my baker (to stay in the picture), both would have violated my privacy, or would you disagree on that?

        As you rightly stated, lawmakers cannot predict everything people can do, and this is the reason why they defined murder by its essence and not by all possible or thinkable ways in which it can be done. And this for good reasons.

        The same goes for privacy protection. When defined by its essence, the way it gets violated becomes irrelevant and this today as well as in 500 years from now, of which no one could possibly know what technologies are at hand at that time. And nobody needs to know by those kind of laws, just like it is with murder.

        Maybe you overestimate the preventive power of laws. And in my view, this is not their main intention at all. Yet what they do is to enable people to make their case legally pursuable and violators legally punishable, which is a bit more sophisticated than arbitrary law or the club method from stone age.

        Regarding brain washing is to say, that it is not only relative yet also needs those who wash and those who let their brains washed and here again, democracy is the best system we have to prevent this from happening. Yet democracy doesn't come free and has to be actively lived by their people. Maybe in 2095 there is no more US income tax, maybe even more.