Op-ed says encryption fails once sensitive data is in use
Original title: Encryption isn’t enough to protect data wherever it goes
An FDD lab assessment found unauthorized restoration of vaultless pseudonyms failed and was logged.
A CyberScoop opinion piece argues that encryption does not protect data while it is decrypted for processing, sharing, or AI pipelines. It describes vaultless, keyless pseudonymization, which replaces sensitive values with realistic substitutes and avoids a central token vault. A Foundation for Defense of Democracies lab assessment reported that multi-party authorization restored correct values while intercepted tokens did not reveal originals. The author urges NIST, the NSA, and procurement rules to evaluate the method.
Unconfirmed: The described benefits come from one lab assessment cited by the op-ed author, not a standards evaluation.
- The lab said no single party could reverse tokens alone.
- Unauthorized restoration attempts failed and were logged.
- Access to a token could be revoked even after it had spread.
- The piece asks vendors to disclose whether raw data or token maps exist.
- Countries
- United States
From the original article
5 min read at cyberscoop.com
Once data is in use, encryption falls short. A tested approach that replaces sensitive values with realistic substitutes could make stolen information far less useful to hackers. The post Encryption isn’t enough to protect data wherever it goes appeared first on CyberScoop.
By Greg Otto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.