Top Highlights
-
Encryption alone is not enough: Data becomes readable when authorized systems decrypt it for processing, and every cloud, vendor, backup or AI handoff creates another exposure point.
-
FDD recommends evaluating vaultless, keyless pseudonymization: It replaces sensitive values with realistic, format-preserving substitutes, keeping data useful while reducing its value to attackers.
-
FDD’s assessment found unauthorized re-identification attempts failed and were logged; approved multi-party restoration worked, and access to tokens could be revoked to block downstream re-identification.
- FDD urged NIST and the NSA to assess the technology’s risks and operational needs, and called for stronger vendor scrutiny—so exposed data is less damaging when breaches occur.
Problem Explained
The Foundation for Defense of Democracies (FDD) warned that encryption cannot fully protect sensitive data once authorized systems decrypt it for processing. As information moves among cloud platforms, vendors, backups, analytics tools, and artificial intelligence systems, each transfer creates another chance for theft or misuse. Georgianna Shea, FDD’s chief technologist, said conventional defenses protect systems and restrict access but do not make exposed data less sensitive.
Instead, Shea urged agencies to assess vaultless, keyless pseudonymization, which replaces sensitive values with realistic substitutes while keeping data usable. FDD’s Transformative Cyber Innovation Lab found that unauthorized attempts to restore the original values failed and were logged, while restoration required approval from multiple parties. Shea called on the National Institute of Standards and Technology and the National Security Agency to evaluate the method, and urged stronger scrutiny of vendors’ claims. Industrial Cyber reported on FDD’s warning and recommendations.
Potential Risks
Ransomware can strike any business, regardless of size or industry. Attackers may steal customer, employee, or financial records before encrypting systems, then threaten to publish the data unless the company pays. The consequences can include operational shutdowns, lost revenue, legal exposure, regulatory penalties, and lasting damage to customer trust. Vaultless, keyless pseudonymization replaces sensitive details with substitutes without relying on a central vault or decryption key, potentially making stolen data less useful to criminals. FDD is urging NIST and the NSA to evaluate this approach as a safeguard. Still, it is not a cure-all: businesses also need backups, access controls, monitoring, and tested recovery plans.
Fix & Mitigation
Timely remediation limits ransomware exposure before attackers can turn sensitive data into leverage; FDD’s call for NIST and NSA evaluation of vaultless, keyless pseudonymization merits careful security testing.
Priority Actions
- Assess the design: Threat-model the proposed approach, test its security claims, and identify risks such as data-linkage or inference attacks.
- Map sensitive data: Inventory and classify information, then identify where pseudonymization can reduce exposure across systems and workflows.
- Apply layered safeguards: Pair pseudonymization with least-privilege access, multifactor authentication, network segmentation, and encryption where appropriate.
- Secure the implementation: Review software dependencies, configuration, vendor access, and system changes; patch known vulnerabilities promptly.
- Monitor for misuse: Log access and data transformations, alert on unusual activity, and regularly test detection controls.
- Prepare for incidents: Maintain a ransomware response plan with clear roles, reporting procedures, and steps to isolate affected systems.
- Protect recovery paths: Keep offline or immutable backups, test restoration, and verify that recovery does not depend on compromised systems.
- Validate before broad use: Pilot the approach, conduct independent security testing, and measure whether it reduces risk without disrupting recovery or legitimate data use.
Continue Your Cyber Journey
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
