Searchable encryption has long been a mystery – an oxymoron – an unattainable dream for cybersecurity experts around the world.
Organizations know that their most valuable and sensitive data must be encrypted to prevent data theft or breaches. They also understand that their data is there to be used – to be searched, viewed, and modified in order to keep business running. Unfortunately, our network and data security engineers have been taught for decades that data cannot be searched or edited in its encrypted state.
The best they could do was wrap plaintext, unencrypted data in a cocoon of complex hardware, software, policies, controls and governance. And how has that worked to date? The T-Mobile breach, the United Healthcare breach, Uber, Verizon, Kaiser Foundation Health Plan, Bank of America, Prudential, the list goes on. All of the data stolen in these breaches remained unencrypted to support day-to-day operations.
It’s probably safe to conclude that our methods for securing data aren’t working. It’s important to evolve our thinking and approach. It’s time to encrypt all data at rest, in transit, and in use. So how do you effectively encrypt the data you need to use?
The Encryption Challenge
As already mentioned, it is clear that most data is not encrypted. Just look at the continuing growth rate of well-documented cybercrime activity. In short, all data breaches and data ransom cases have one obvious thing in common: all targets have millions of personal, sensitive, and secret records in an unencrypted state. Stored as fully indexed, structured, unencrypted, and easily readable plaintext solely to support operational use cases. This challenge falls into the category of “acceptable risk”.
It is often assumed that if an organization has good cyber hygiene, it encrypts data at rest (in storage, archives, or during backups) and data in transit or in motion (such as encrypting email or sending data from one point to another). And many may think that’s enough, or that it’s the best they can do. After all, encryption at rest and in motion is the only encryption focus that compliance and governance bodies currently address beyond database encryption.
The reality is that most compliance efforts lack an actual definition of what strong database encryption is, and unfortunately, many still have the mindset that “if it’s not addressed in compliance, it can’t be that important.”
Let’s expand on this in a bit: Why not encrypt your data? Encryption has a reputation for being complex, expensive, and difficult to manage.
Just looking at traditional encryption of data at rest (archives and static data), it is common for these encryption solutions to involve a complete “lift and shift” of the database to an encryption at rest solution, which often requires extensive work by network architects, database administrators, detailed mapping, time.
Once encrypted, assuming long string encryption such as AES 256 is used, the data is only secure until the point where it is needed. The data is eventually needed to support a business function such as customer service, sales, billing, financial services, healthcare, auditing, and/or general update operations. At that point, the entire needed dataset (either the entire database or a segment) must be decrypted and moved as vulnerable plaintext to a data store.
This introduces an additional layer of complexity that requires the expertise of a DBA or database expert, the time it takes to decrypt, and building a security enclave of complex solutions designed to monitor and “protect” plaintext data stores. This enclave of complex solutions requires a dedicated team of experts with knowledge of each security tool’s capabilities. Add to that the need for each security tool to be patched and updated to remain effective, and you can understand why so much data is breached every day.
Of course, once the dataset is utilized, it must be returned to its encrypted state – and the cycle of complexity (and cost) begins again.
Because of this complex cycle, this sensitive data often remains fully unencrypted, vulnerable, and easily accessible at any time. 100% of threat actors agree that unencrypted data is the best data for easy access.
While this example focuses on encryption of data at rest, it is important to note that data encrypted in transit goes through much the same process – it’s only encrypted in transit and must be decrypted before it can be used on both ends of the transaction.
There’s a much better approach – one that goes beyond baseline encryption. A modern, more comprehensive database encryption strategy requires that critical database data is encrypted in three states: at rest, in motion, and in use. Searchable encryption (also known as encryption in use) ensures that data remains fully encrypted for the entire time it’s available. This eliminates the complexity and cost associated with supporting the old encrypt-decrypt-use-re-encrypt process.
Converging technologies for better encryption
So why is searchable encryption suddenly now becoming the gold standard for critical private, confidential, and controlled data security?
According to Gartner, “For data analytics and privacy teams working with large volumes of data, the need to protect the confidentiality of that data and maintain its usefulness is a top concern. The ability to encrypt data and process it securely is key. The Holy Grail of Data Protection“
Until now, the potential for encryption of data in use has revolved around the promise of Homomorphic Encryption (HE), which is extremely slow to perform, extremely expensive, and requires huge amounts of processing power. However, searchable symmetric encryption technology allows us to process “data in use” while it remains encrypted, while maintaining near real-time, millisecond-level query performance.
“Digital transformation has made data more portable and usable by business units, but it has also made it more exposed,” said IDC analyst Jennifer Glenn. “Searchable encryption offers a powerful way to unlock the value of that data while keeping it secure and private.”
“Technologies such as searchable encryption are becoming essential for organizations to keep their data usable while ensuring its integrity and security,” Glenn said.
Paperclip, a data management company with over 30 years of experience, has developed a solution that achieves what was once called the “Holy Grail of data protection” – encryption of data in use. By leveraging patented shredding technology and searchable symmetric encryption used at data storage, the solution eliminates the complexity, delays, and risks inherent in traditional data security and encryption strategies.
SAFE Encryption Solutions
Understanding that necessity is the mother of invention, Paperclip was founded in 1991 as a content supply chain innovator and realized they needed to do more to better protect the sensitive data their customers trusted them with. In analyzing the increasing number of data breaches and data ransom attacks, one thing became crystal clear: threat actors weren’t compromising or stealing encrypted data.
They zeroed in on the vast amounts of unencrypted, plaintext data that’s used to support key business activities. That’s where they can do the most damage. That’s the perfect data to hold hostage. It was this critical data that needed to be addressed. It was time to evolve how we encrypt our most active data at the database layer.
This was the beginning of SAFE, first as a solution and then into the commercial market.
Of course, identifying the challenge was easy – every organization has sensitive data that needs to be protected, and every organization has sensitive data that they rely on to run their core business. The next step was to build a working solution.
Paperclip SAFE is a SaaS solution that makes fully encrypted, searchable data encryption a reality. It eliminates the entire process of encryption, decryption, use, and re-encryption, and the resources required to perform those tasks. More importantly, SAFE eliminates the excuses as to why millions of records currently remain completely vulnerable to data theft and ransom attacks.
SAFE Searchable Encryption is commonly referred to as a Privacy Enhancing Technology (PET) platform. As a PET, SAFE advances the way data is protected at the core database layer. SAFE is different from all other encryption solutions because it:
- Full AES 256 encryption with support for data owner and data holder key vaults – a threat actor would need to compromise both distinct keys and still not be able to access the data.
- Patented Paperclip Shredder Data Storage (SDS) – Before your data is encrypted with AES 256, a complex encryption, it is shredded, salted, and hashed. This destroys all context and generates entropy. Imagine a threat actor compromises both encryption keys. Ultimately, it’s like shredding a million documents in a micro cross-cut shredder, throwing away a third of the shredded pieces, replacing that with a third of an old shredded encyclopedia, shaking it, and tossing it on the floor like a sick, deranged jigsaw puzzle. With current technology, it would take roughly 6,000 years to reassemble all those pieces.
- Always Encrypted Datasets with full Create, Read, Update, and Delete (CRUD) support – Essentially, when data is not in use, it remains fully encrypted at rest. No more encrypted and unencrypted – always encrypted.
- Fast encrypted compound searches (<100ms faster than standard SQL queries). End users won't even know that SAFE is running in the background.
- Continuous Machine Learning and AI Threat Detection and Response (TDR) – SAFE is based on Zero Trust, so the solution monitors and learns from user trends. Any out-of-band activity is blocked and administrative action is required. The solution also monitors for SQL injection, data fuzzing, and other threat actor actions. As part of the solution, SAFE generates a large amount of telemetry that can be provided to the client’s SOC monitoring services.
- Simple JSON API integration. Requires some development, but the result is a seamless experience for end users, providing an always-available, always-encrypted dataset of data.
- Implementation flexibility – While SAFE is a SaaS solution, it is also designed to be implemented as a lightweight on-premise solution. Additionally, SAFE can be integrated within third-party applications that hold sensitive data on behalf of clients (outsourced applications such as HR, payroll, banking platforms, healthcare EMRs and PHRs, etc.). If you outsource sensitive data to a third-party vendor, you should ask how they encrypt that data. What happens if that vendor is breached? Is the data encrypted?
We are now in a race where threat actors seem to be winning. The time has come to build a better encryption engine. The time for SAFE has come.
In today’s cyber-centric business environment, the need for searchable encryption spans many industries and use cases, including financial services, healthcare, banking, manufacturing, government, education, critical infrastructure, retail, and research – there is no area where data doesn’t need to be made more secure.
As a SaaS solution, SAFE can be implemented in less than 30 days with no disruption to end users or network architecture. To learn more about SAFE searchable encryption, visit paperclip.com/safe.
Notes: This article was expertly written and contributed by Chad F. Walter, Paperclip’s Chief Revenue Officer since June 2022, who has more than 20 years of experience in cybersecurity and technology, leading sales and marketing efforts.
