Keynote: Data is a new security boundary
summary
Claim: treat data as the security boundary and use encryption so it “can’t be suddenly, unnoticeably decrypted.” Concrete examples: client-side field-level encryption for MongoDB, a proxy like acra or a DAO backed by HashiCorp Vault to compartmentalize keys for multi-tenant SaaS and fintech, and an HPKE-like approach to protect ML models. Searchable/deterministic schemes and blind indexes enable queries on encrypted fields. Key management — generation, storage, rotation, revocation, and recovery — turns out to be the hard, make-or-break part; losing a master key destroys access.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:23Things we won't talk about
- 5:06Data security depends on a data flow
- 6:42Data security 101
- 8:18Encryption is an ultimate data security measure
- 11:43A02:2021-Cryptographic Failures. Focused mostly on crypto usage and implementation.
- 13:25A04:2021-Insecure Design. Focused on design, missing or wrong security controls.
- 17:10Application-level encryption (ALE)
- 20:31End-to-end encryption
- 25:42Zero Trust / Zero Trust Architecture
- 26:39Zero Knowledge Architecture (ZKA) - system where no one has access to unencrypted data, except the user (node, service, person). Also known as No Knowledge Systems
- 30:33Other exciting crypto terms Privacy enhancing cryptography: SMPC, PSI, PIR, FHE, PAKE, OPAQUE.
- 37:47Security controls to support crypto
- 41:55Pros & Cons
- 42:49Proxy-side field-level encryption Acra
- 43:57Key hierarchy Database
- 45:26ALE for NoCode platform
- 46:48Crypto + supporting controls 1. Key management, separate key per customer (BYOK). 2. Full compartmentalization: customer's data is located in different DBs, encrypted by different key, each app uses its own DAO. 3. Full transparency - the platform doesn't have access to customer's
- 47:47ALE for fintech platform
related talks
06mKeynote: Evolutions in data privacy: threats and opportunities
41mKeeping Secrets: Emerging Practice in Database Encryption
40mSecure application design with high data privacy requirements
55mKeynote - Preparing the Long Journey for Data Security
04mKeynote: Welcome – Nelly Porter
35mKeynote
13mEncrypting Your Way to Safety: Data Security in Kubernetes
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!