Greetings,
Our point of view has been honed from years of defending infrastructure using (and building) perimeter defense technologies -- web application firewalls, intrusion prevention systems, etc. But these technologies are deeply flawed. They can stop common attacks from common tools, but they can be easily evaded. And if it's easy for an admin to peek at data, then it's easy for someone who tricks or compromises that admin to peek at it, too.
This is how I came to be an advocate for application-layer encryption. We can design and build systems that are resilient in the face of common problems and first-level breaches. Without application-layer encryption, those first-level breaches are often game-over for the data.
We've been gratified over the past few years as application-layer encryption has become more mainstream and started to move into standards. I wrote recently about PCIv4 and how it uses application-layer encryption as well as improves the security of account holder data including names. There are additional requirements just for SaaS providers in there, too.
At the same time, while we're helping to drive better data protection, organizations have instead been duplicating it all over the place. It's like the movie Gremlins where any little thing you do causes them to duplicate and turn evil. AI data are like Gremlins except instead of contacting water or eating after midnight, anything that AI touches reproduces into less protected environments. We've talked about this before, but we have a new white paper focusing just on the "shadow data" problems with AI. Please check it out.
That's it for this month, watch out for the AI gremlins...
