Quick Takeaways
-
Encryption protects data at rest and in transit—but not when authorized systems decrypt and process it. As information moves through cloud services, vendors, analytics and AI pipelines, every handoff creates another exposure point.
-
Vaultless, keyless pseudonymization could reduce the damage of a breach. It replaces sensitive values with realistic, usable substitutes, so stolen data is less revealing without a central vault or master key.
-
A FDD lab assessment found promise, not proof of readiness. Unauthorized attempts to restore original data failed and were logged; restoration required multiple-party authorization, and access to tokens could be revoked downstream.
- The government should independently evaluate the approach before adoption. NIST and the NSA should assess its risks and real-world requirements, while procurement rules should require vendors to disclose data handling, re-identification controls and independent reviews.
Problem Explained
CyberScoop reports that conventional cybersecurity measures leave sensitive information exposed when authorized systems use, copy, or share it. Encryption protects data in storage and transit, but once information is decrypted for processing, it can be read—and potentially stolen—by attackers. This risk affects hospitals, banks, defense contractors, government agencies, and others that depend on moving data among cloud providers, vendors, analytics platforms, and AI systems. The article argues that breaches and future advances in computing could make exposed data especially damaging.
As an additional safeguard, the article describes vaultless, keyless pseudonymization, which replaces sensitive details with realistic-looking substitutes while allowing authorized parties to restore the originals under controlled conditions. The Foundation for Defense of Democracies’ Transformative Cyber Innovation Lab assessed a model of this approach; its tests found that unauthorized restoration attempts failed, while approved multi-party restoration worked. The article therefore urges the National Institute of Standards and Technology and the National Security Agency to evaluate the method, and calls for clearer vendor disclosure. Its central point is that cybersecurity must not only keep attackers out; it should also make stolen data less useful.
Potential Risks
“Encryption isn’t enough to protect data wherever it goes” is a real risk for any business. Encryption can protect files while they are stored or moving, but authorized users and systems must often unlock them to work. At that point, stolen credentials, compromised devices, careless sharing, or weak access controls can expose the data. Moreover, copies may spread across email, cloud services, and personal devices, where protection is inconsistent. A breach can therefore trigger response costs, operational delays, legal penalties, lost contracts, and lasting damage to customer trust. Encryption matters—but it must be paired with strong access controls, device security, monitoring, and clear rules for handling data.
Fix & Mitigation
Encryption can shield data in transit or at rest, but timely remediation is essential once it is copied, shared, or accessed in an unsafe context.
Contain and Remediate
- Map and classify data flows: Identify sensitive data, where it resides, how it moves, and which users, devices, applications, and third parties can access it.
- Limit access: Apply least privilege, role-based permissions, multifactor authentication, and time-bound access; promptly revoke stale accounts, tokens, and sharing links.
- Strengthen controls beyond encryption: Use data loss prevention, endpoint and mobile-device management, secure configuration, and restrictions on downloads, printing, copying, and unmanaged storage.
- Harden key management: Rotate or revoke exposed keys, separate key administration from data access, and protect keys in approved hardware-backed services.
- Contain active exposure: Disable unsafe integrations or transfers, quarantine affected devices, and suspend compromised credentials or external access.
- Investigate and monitor: Review access, sharing, and transfer logs; establish alerts for unusual activity; preserve evidence and determine what data may have been exposed.
- Remediate and verify: Remove unauthorized copies where feasible, correct misconfigurations, notify affected parties as required, and test that revised controls prevent recurrence.
- Improve governance: Set retention and secure-disposal rules, assess vendor handling, and update incident-response procedures in line with NIST CSF outcomes.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Access world-class cyber research and guidance from IEEE.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
