Cybersecurity policy must evolve to address the inherent risks of data processing and movement, as current defensive measures often fail to protect sensitive information once it is accessed by authorized systems, with further coverage provided by cyberscoop.
While encryption remains a cornerstone of security, it leaves data vulnerable during processing and transit. When systems decrypt information for analysis or artificial intelligence models, the data becomes readable and susceptible to theft. To address this, experts propose vaultless, keyless pseudonymization. This method replaces sensitive values like Social Security numbers or addresses with realistic substitutes that maintain data structure for operational use without exposing actual identities. Unlike traditional tokenization, which relies on a central vault that acts as a single point of failure, this approach removes master keys and requires multi-party authorization to restore original values. Recent assessments by the Foundation for Defense of Democracies indicate that this technique preserves data utility while rendering stolen information useless to attackers. Policymakers, including the National Institute of Standards and Technology and the National Security Agency, are encouraged to evaluate this methodology to improve resilience against breaches. By shifting the focus from solely preventing unauthorized access to reducing the intrinsic value of exposed data, organizations can better mitigate the impact of inevitable security incidents.
Source: cyberscoop
