SOC Capability Area #8) Privacy/Confidentiality Management

Finance, Retail, Healthcare, Employment, Credit Bureaus, even social networking and dating sites are all prime targets today for adversaries looking to compromise and exploit private or personal data for their own financial gain. Seemingly weekly reports of huge data breaches demand organizations invest in more robust and more complex Privacy/Confidentiality capabilities such as data labeling, deliberate data segmentation, and/or encryption of data, both at rest and in transit. Each of these types of controls helps to provide privacy and maintain confidentiality, but will also present its own implications on system performance and on scale of management. 

Concepts such as data partitioning, masking, obfuscation, anonymization and tokenization are less commonly used in the commercial sector. So this article focuses on the more familiar concepts of data encryption to highlight the role that the Security Operations team plays with respect to Privacy/Confidentiality Management... especially in cloud environments.

The simplest approach to maintaining privacy is to encrypt sensitive data, both at rest and in transit; utilizing some form of robust, symmetric encryption using a secret key known only to those authorized to access the data.  Most solutions for encrypting data-at-rest (files, filesystems, and full disk encryption technologies) use some form of secret key encryption. Ignoring the strengths and weaknesses of the range of encryption algorithms available, the primary management challenge which Security Operations is tasked with is Key Management. The generation, distribution, and destruction of “shared secret” cryptographic keys does not scale well, even in a moderately large environment. Leading edge advancements such as Quantum Key Distribution (QKD) show some promise for significantly simplifying the scalability issues here. But today, especially for encrypting data-in-transit, most organizations opt to use some form of asymmetric public key encryption for mutual authentication (e.g., via TLS which uses X.509 certificates) and exchange of a shared (symmetric) key for subsequent encryption of communications/exchanges.

This is not intended to be an introduction to, or evaluation of, encryption techniques and technologies. Rather, we use encryption as an example here to illustrate the non-trivial administrative role which Security Operations teams play with respect to managing the full range of Privacy/Confidentiality capabilities.

As your organization adopts more complex techniques and technologies to ensure privacy and confidentiality (both on premise and in the cloud), your Security Operations team will need to adopt a relevant set of capabilities to manage these new controls at scale.