Data security is at the top of many companies' agendas. At the same time, conventional security solutions are no match for the latest attacks. In a networked world in which you can be attacked at any time, sensitive data must be protected against misuse: ‘at rest’, ‘in motion’ and ‘in use’ alike. Data-centric security is – as things stand today – the only viable approach that makes it possible to protect data throughout its entire lifecycle. The future of data security has already begun – and you can benefit from it right away, even with smaller projects.
Data immunity against rising threats, data protection laws and fines
We are at a turning point[1] in the way data must be protected: the risk of falling victim to a cyberattack is rising noticeably. Almost every day there are reports of digital attacks or data thefts carried out with ever greater sophistication. At the same time, companies are more frequently penalised for non-compliance with data protection laws and regulations – with ever higher fines. Although the reports are increasing, data theft is not detected, or detected late. The consequences are devastating and can even endanger human lives, as the example of the International Committee of the Red Cross (ICRC) shows. With the latest scam used by cybercriminals, companies and their customers are extorted several times per attack through what is known as ‘triple extortion’. Company data is increasingly located in data centres that are no longer controlled by the data owners – and is therefore inherently more exposed to data theft.
The reassuring news: there is a way out. The way out requires a change in thinking and an understanding that companies' sensitive data must be pseudonymised and thus protected in itself. We call this ‘data-centric protection’. Since encryption algorithms are used for pseudonymisation, people also speak of ‘data-centric encryption’. If the data is ‘encrypted in a data-centric way’, the data is immune to data theft. This is because pseudonymised data can neither be read nor misused.
Data security: upgrade culture at the end of the line
Just a few years ago, it was enough to use the next generation of an existing security tool that one was already reasonably familiar with. But this way of thinking is outdated. For some time now, the arms race between attack and defence, or the evolution of security tools, has no longer been enough to reduce the risks sustainably. Even before a new system is up and running, it is already outdated again and no match for the attackers.
With data-centric protection through pseudonymisation, it is possible to escape this arms race. However, this protection cannot simply be bought like any other tool. It requires a change in thinking about how data is handled. Until now, security has mostly been implemented in the IT infrastructure. With data-centric protection, the actual work moves to the application developers. Until this change has taken place, it will consequently hardly be possible to comply with strict data protection laws and not be at the mercy of hackers.
Paradigm shift in data security: the implications
As Dave McComb writes, the paradigm shift to a data-centric perspective is in many respects comparable to the second industrial revolution, when independent small machines powered by electric motors displaced centralised production facilities driven by steam and crankshafts.
As early as 1880, it was obvious that new electric motors would change the industrial revolution, but this transition took over 40 years. There are astonishing parallels between the transition from steam power to electricity and the transition from conventional methods to data-centric protection[2]. It was not that the technology for the transition from steam to electricity was lacking, any more than it is a lack of technology that is preventing the transition from conventional to data-centric security. What held back the transition from steam to electricity were the established experts who clung to the status quo. The same applies today to data-centric protection.
When new infrastructures or factories were being planned in the 1880s, entrepreneurs were advised by experts who were thoroughly familiar with the existing forms. These experts had neither the latitude nor the incentive to change things fundamentally. This is how the transition from steam to electricity came to take over 40 years. At this point, history differs from the present: the accelerated world of 2022 will complete the paradigm shift more quickly.
The pressure for this change grew at the time when newer firms displaced established competitors by being more agile and efficient.
As with the drive systems of the time, data protection today is usually not a company's core business, but it is becoming increasingly important – fuelled by higher penalties for non-compliance with data protection and a greater risk of hacker attacks, which can be existential. Companies that have already introduced data-centric security are safe from data theft and are also more agile and efficient – and benefit accordingly from their head start. Data and applications can be migrated as they are to a new technology in a very short time, provisioned differently or operated by external partners.
How Swiss pioneers use data-centric security: go to the Swisscom and SIX Group references.
Data security: a C-level issue
Since 2016, Prewen has been helping companies make the paradigm shift to data-centric security. At first, we concentrated on classic data projects such as data warehouses with particularly sensitive data collections. In the course of these projects, it became clear that it is not enough to implement data-centric security in the IT departments for specific data. To benefit from the technology to its full extent, it is a matter of making management aware that a change in thinking is required. Only then can company data continue to be properly protected in the future, regardless of the application, database or provisioning used.
Are you part of a company's executive team? Very good – we will be happy to show you what executives need to consider regarding data-centric protection. Contact us
Not an executive? No problem, there are also other ways in which you can contribute to a change in thinking – even though a paradigm shift has to be supported by the entire company.
Where to start? Compliance and ICT as drivers of innovation
Technological changes such as data-centric protection can hardly be introduced without the approval of management. However, there are important exceptions to this. The two areas most affected by today's changes in data security offer a possible starting point: compliance and ICT.
Data protection and compliance: especially for companies in industries subject to strict regulatory requirements, budgets in the seven-figure range are not uncommon. Even budgets for sub-projects resulting from changed data protection guidelines or precedents are suitable for introducing data-centric security. This is because data-centric protection makes many aspects of compliance easier, from legal data protection requirements to the annual audit. In addition, provisions for fines can be reduced.
Smaller ICT projects: the innovative initiative for change often comes from individual specialists. Project managers for cloud, data warehouse and data science platforms, or those responsible for IT solutions such as CRM, have the opportunity to bring innovations such as data-centric security into the company as a feasibility study or proof of concept. This concrete approach can also convince management and serve as a first step towards initiating larger changes.
As McComb's example already shows, large existing structures are slow to change, especially when it comes to a paradigm shift such as data-centric security. But smaller, specific projects are the spearheads for the new approaches. Because of their project volume, they are less expensive and allow experiments with new approaches. In this way, parts of data-centric protection can be implemented in the existing infrastructure and used to start the transition to data-centric security.
An example from practice: at one of our customers, it was the SAP team that was this spearhead. The SAP team wanted to offshore operations. However, the regulatory requirement stipulated that people abroad were not allowed to see the data. Prewen encrypted the data in such a way that it could not be seen abroad. As this project had no need for the highest availability and there were few interfaces to other applications, the initial project could be implemented relatively inexpensively.
Data immunity for the future: step by step towards data-centric protection
The biggest sticking point in getting innovation started is usually funding. It is often easier to obtain funding for current technology – and this can be used to introduce data-centric security.
Cloud: almost all companies already have data and applications in the cloud or will do so in the near future. Even if you merely carry out a so-called ‘lift and shift’ – i.e. move the data unchanged from local data storage to the cloud – security absolutely must be increased. The cloud providers' data centres are no longer under the company's control, and the data is usually processed by US or Chinese hyperscalers. There is a danger that the data is not legally safe from access by state institutions. (See also ‘Data protection laws and access by US authorities’)
Machine learning: almost every large organisation today is carrying out machine learning projects. Many have discovered that artificial intelligence and machine learning bring enormous business benefits. But the dangers are also increasing: combining data from different sources can create potentially ‘explosive’ data combinations from which highly sensitive conclusions can be drawn. In the past, such projects were often abandoned because of their sensitive content. That need not be the case: data-centric security makes it possible to carry out such projects despite and with sensitive content.
Off-/nearshoring: with the aim of saving operating costs, companies are moving the operation of their applications and systems to nearby or more distant countries. Depending on the case, either people abroad access the local systems, or the systems and applications are also moved abroad. In both cases, people with extensive permissions (very often administrative permissions) have access to business-critical applications, systems and databases. However, sensitive content must remain hidden from these people, i.e. encrypted. Data-centric security prevents this content from being viewed, even by administrators with the highest access privileges.
Data-centric security is here to stay.
Today's trend in the handling of data shows itself in various facets. In marketing, customer and user data is used to personalise customer journeys. The hybrid world of work requires access to company data from anywhere in the world. Industries with very sensitive data, such as insurance, healthcare or finance, are stepping up their efforts to protect data against theft. And with lean management, all production and supply chains are by now global and data-driven. In short: more data is being collected and stored than ever before. And more data is being stolen and misused than ever before. To master these challenges securely, a change in thinking is needed, a paradigm shift to data-centric protection.
Learn more about data-centric protection or Prewen's data security offering.
—
Footnotes:
[1] ‘We are at a turning point’ – with these words, Dave McComb begins his book entitled ‘The Data-Centric Revolution: Restoring Sanity to Enterprise Information Systems’. And he is right. In this article, I follow McComb's line of argument and show how this ‘turning point’ also marks a fundamental paradigm shift for data security.
[2] Cf. Brian Arthur, The Nature of Technology: What It Is and How It Evolves
Questions on this topic? We look forward to talking with you.
Get in touch