Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

11/28/2017
02:12 PM
Simon Marshall
Simon Marshall
Simon Marshall
50%
50%

PreVeil Pushes Encryption Past the End

PreVeil is pushing encryption beyond its normal endpoints to protect data wherever it is.

We all know that perimeter technologies are somewhat now playing second string to newer approaches to data security: acceptance that breaches are inevitable. Once in a while, we find one technology that cuts through the noise and presents an approach that looks very novel and very workable.

Whether or not you believe in "encryption everywhere," its time will come in 2018, when an innovative startup will commercialize and launch an encryption concept incubated from the labs at MIT.

Spearheading the new technology, which concept claims that even after an intrusion, information stored on servers remains encrypted and is therefore useless data to cyber thieves, is founder and CTO at PreVeil, Raluca Ada Popa.

Popa holds a double major Bachelor's degree, a Master's and a Doctorate in computer science -- all with a GPA of 5.0 -- and also holds the patents to PreVeil's encryption everywhere concept. She's also an assistant professor at U.C. Berkeley specializing in computer science and applied cryptography.

"I was always thinking of algorithmic, logical things, but at the same time, I also wanted to have an impact on the world," said Popa, "I had to do math, had to think analytically and I was only interested in solving difficult problems."

The math and operational processing behind the concept supports the idea that traditional encryption, although it has served well, just doesn't extend far enough given that intrusions are inevitable. Encryption od data in transit and storage works fine. But encryption during computing and processing of data is missing.

Don't worry about server breaches
"Servers were continually being breached, so my Light Bulb Moment was 'maybe we should stop fighting that battle because we're always losing,' " Popa told SecurityNow, "Let's stop trying to have a wall around data and instead always have it encrypted." Today's encryption protects data when it's at rest or in transit, but it's decrypted at the destination, and that leaves a huge security hole and low-hanging hacker opportunities.

Thinking of taking the concept from the whiteboard to commercialization, there was a healthy dose of reality that the process might be too much of a challenge. Also, it was Popa's first outing into forming a company and trying to drive a new mindset about the use of encryption.

"[But] I had a hard time thinking about only making an incremental change," said Popa, who loves challenges.

Having formed in 2015, PreVeil has been developing the technology and now has productized the concept. Solutions for file sharing and email security will be available by the end of the year for Windows, Mac, Android and iPhone. Its enterprise security solution will also released within a month. Services will be free for individual users, and the business model is to charge enterprises. Currently, PreVeil has about 30 enterprise trials on the go, but no formal customers yet.

Show me the money
Popa reckons that a big driver of enterprise interest is being driven by media coverage of attacks, and is starting some thinking about new solutions rather than necessarily beefing existing systems.

Apparently, some enterprise budget is being moved from perimeter defense towards newer technologies, and some companies are even able to justify additional security spending. There are also worries out there that companies which don't keep up with encryption may become soft targets for hackers.

Another pressure point is consumer expectation. There may be more realistic views on the street about weak data security from consumer brands, and Popa speculates that the next generation of encryption will power competitive differentiators for consumers willing to pay for stronger security-as-a-service.

Enterprise teams adopting new encryption technologies could face a knowledge gap and steep learning curves. "The good thing is that the high-level concepts are actually easy to grasp. There are no more single key-holder approvals, and now firms can get encryption through a group of people," said Popa. "It's definitely a big step to take, and there are those who are still thinking about it."

The past and the future
PreVeil is notable by the presence of chairman and founder Sanjeev Verma. Apart from the practicality of ensuring financing (the firm was initially privately funded) for the idea, Verma has a track record of success that includes being the founder of Airvana, the giant of CDMA in the early Noughties.

As a business partner, Popa liked him because he also had good technical knowledge and bridged the gap between her academic expertise through enabling the packaging of a new service. "We had been friends for a long time, and he was interested in potentially commercializing my research. There were a few other organizations who approached me, but I basically said 'no' to all of them," said Popa.

There are some roadmap items coming up that indicate an extension of PreVeil's ambitions as well as a fledgling move to apply encryption everywhere, well, everywhere. "We're looking at adding chat functionality, and looking to integrate with the blockchain, so that cryptographic identities are really secured by the blockchain."

How does the new technology work?

There's an explainer video here. And yes, the time-honored characters of Bob, Alice and Chris all star in the clip.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20934
PUBLISHED: 2020-11-28
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
CVE-2020-29368
PUBLISHED: 2020-11-28
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVE-2020-29369
PUBLISHED: 2020-11-28
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
CVE-2020-29370
PUBLISHED: 2020-11-28
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.
CVE-2020-29371
PUBLISHED: 2020-11-28
An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.