The heliocentrism of digital world is data and everything whirls around data. Data-driven strategy is taking center stage and has transformed the traditional technology. Data is ubiquitous and many successful businesses have realized, data is a vital asset they possess. They rely extensively on data, for designing new business model, pricing, predicting the market, competitive insights.
Today, sole existence of several global businesses is on data; for making complex decisions businesses rely on data for making meaningful intelligence. As more and more organizations are becoming data driven, securing the data is becoming the number one priority.
Recent mega-breaches have demonstrated one commonality; data is the ultimate target which attackers are behindi,ii. They will get there irrespective of enterprises fortified network security. As the traditional approach of network security is failing, it is wise to protect the core (data) with reinforced data layer.
Cryptography, one of the oldest domain in security, can be the most apt companion for data security. Perfectly designed cryptography with a robust algorithm and strong master key would deter attacker against all types of cryptanalysis attack.
While, cryptography is prevalent as a network layer security, but is least adopted at data layer. This is due two main challenges in cryptography key management process:
i. In multiple data breachesiii, it was found that data was encrypted, but due to improper implementation of crucial key management process, attackers were able to decrypt into plaintext data. Key generation and distribution is an extremely intricate process to design, implement and sustain.
- Management of key exchange protocol
- Key expiry and frequent key change
- Generating unique random seed
- Complexity involved in encryption / decryption during data processing
ii.Inherent risks in traditional key generation and distribution process
- Secure storage of master key
- Risk of eavesdropping
- Susceptible to social engineering attack
These inherent initial implementation challenges and operational issues in key management process have refrained IT and application teams from adopting as data-layer security. These limitations have weakened the case for security practitioners to strongly pursue with application team for implementing data-layer cryptography.
Global technology giants and several start-ups are in a race to design and develop the fastest quantum computer, using quantum physics. As of the writing of this article, IBM had developed 50-qubitiv and Google announced a 72-qubitv system. With this speed not very far, quantum computers will be commercialized and becomes a commodity. The day this happens, attackers get access and start using the power of quantum compute and target traditional cryptography keys.
Is there an elegant solution to this present and future problem?
The answer is in quantum physics. The discovery of “uncertainty principle”, in quantum mechanics, lead to innovation of “Quantum Key Distribution” (QKD) which can be the driver for exchanging secret key used in the process of encryption/decryption.
QKD can transform the way cryptography is used in data encryption and decryption.