Title: What I Learned at Gartner Summit 2019 Abstract: The Gartner Summit 2019 agenda featured five comprehensive programs to cover your security and risk management key priorities and challenges. Digital transformation continues to challenge the conventions of information risk and security management. It requires a coherent digital security program based on a clear vision and strategy. Businesses have been inundated with information on what recent privacy laws like GDPR and CCPA require, but many are still trying to figure out how to comply with them on a practical level. The new Verizon Data Breach Investigations Report (DBIR) provides perspectives on how Criminals simply shift their focus and adapt their tactics to locate and steal the data they find to be of most value. Gartner includes data ethics and privacy on their list of the top 10 strategic technology trends of 2019, placing it on the same level as AI-driven development, blockchain, and edge computing. Many companies are focusing on data privacy from the legal and security side, which are foundational, but are missing the focus on data. The cloud, SaaS applications, and user mobility are powerful enablers of digital transformation, but many IT organizations are grappling with legacy network and security architectures that haven't evolved in decades. In the era of Cloud 3.0, companies are re-imagining business processes from and for the cloud. With these new opportunities comes a new cybersecurity reality for IT leaders in a hybrid, multicloud world. At a minimum, cloud computing breaks into 3 primary layers: SaaS, PaaS and IaaS. This presentation will explain primary security controls. You’ll learn how to take a strategic approach to risk, improve business and data resilience, build digital trust and implement a new generation of continuously adaptive security strategies. Cloud security remains a top priority. This presentation summarizes the problems, recommended processes, and new product types to address key issues.

1. 1
What I Learned at Gartner
Summit 2019
Ulf Mattsson www.TokenEx.com

2. 2
Ulf Mattsson, BIO
+ Mr. Mattsson is currently the Head of Innovation at TokenEx, a cloud-based data security
company, was previously Chief Technology Officer at Atlantic BT Security Solutions, and
earlier Chief Technology Officer at Compliance Engineering. He was the Chief Technology
Officer and a technology founder of Protegrity.
+ Prior to Protegrity, he worked 20 years at IBM's Research and Development organization, in
the areas of Application and Database Security. He also worked at companies providing
Data Discovery Services, Cloud Application Security Brokers, Web Application Firewalls,
Managed Security Service, Security Operation Center, and Cybersecurity consulting.
+ Mr. Mattsson is an Inventor of 73 Awarded and Issued US Patents.
+ He delivered joint Application and Data Protection products and development teams at
IBM, Microsoft, Hewlett-Packard, Oracle, Teradata, and RSA Security (Dell). Mr. Mattsson is a
also advising companies in the area of AI, Machine Learning and Quantum Computing
technologies.
+ Mr. Mattsson also owns and manages the BrightTALK “Cybersecurity - The No Spin Zone”
and “The Blockchain Channel.”

3. 3
*: By 2023, 20% of organizations will be budgeting for quantum computing projects, compared to less than 1% in 2018, Gartner.
*

4. 4
Source: Gartner

5. 5
Source: Gartner

6. 6
Source: Gartner

7. 7
Source: Gartner

8. 8
Source: Gartner

9. 9
Source: Gartner

10. 10
Source: Gartner

11. 11
Source: Verizon 2019 Data Breach Investigations Report

12. 12
Source: Verizon 2019 Data
Breach Investigations Report

13. 13
Source: Verizon 2019 Data
Breach Investigations Report

14. 14
Source: Verizon 2019 Data Breach Investigations Report

15. 15
Data Security Context
Operating System
Security Controls
OS File System
Database
Application Framework
Application Source Code
Data
Security
Context
High
Low
Application
Data
Network
External Network
Internal Network
Application Server
15

16. 16
Cloud

17. 17

18. 18

19. 19

20. 20

21. 21

22. 22

23. 23

24. 24

25. 25
Cloud
Security

26. 26
Cloud Data Security
Operating System
Security Control
OS File System
Database
Application Framework
Application Source Code
Application
Data
Network
External Network
Internal Network
Application Server
26
Publi
c
Cloud
Public
Security
Cloud
Security
Separation

27. 27
Security Separation in Cloud
Internal Network
Administrator
Remote User
Internal User
Public Cloud Examples
Each
authorized
field is in
clear
Cloud
Gateway
Data Security for including encryption, tokenization or
masking of fields or files (at transit and rest)
Public Security
Cloud
Security
Separation

28. 28
Data Protection
and Privacy
Options

29. 29
Advanced PII/PI Discovery
Source: BigId
1. Find & Inventory All Personal Data At Scale.
2. Machine learning & identity intelligence technology.
3. Identify all PII across structured, unstructured, cloud & Big Data.
4. Inventory PII by data subject & residency for GDPR.
5. Measure data re-identifiability for pseudonymization.
6. Uncover dark or uncatalogued data.
7. Fix data quality, visualize PII data relationships.
8. Build & Measure Data Risk KPIs.
9. Measure risk by data sensitivity, location, access, consent etc.
10. Customize multiple risk models tailored to internal audiences.
11. Get actionable recommendations for security & privacy.
12. Bubble up risky data & activities for attention.
13. Assign investigation & remediation tasks.
14. Tag files with risk parameters for enhanced DLP, DAM, DRM.

30. 30
Positioning of some Encryption and Privacy Models
Source: INTERNATIONAL STANDARD ISO/IEC 20889
Privacy enhancing data de-identification terminology and classification of techniques
Data has the same
format, including
the length, as the
original data.
Server model Local model
Differential Privacy (DP)
Formal privacy measurement models (PMM)De-identification techniques (DT)
Cryptographic tools (CT)
Format Preserving
Encryption (FPE)
Homomorphic
Encryption (HE)
Two values
encrypted with
the same public
key can be
combined*
K-anonymity model
Responses to queries
are only able to be
obtained through a
software component
or “middleware”,
known as the
“curator**”
The entity
receiving the
data is looking
to reduce risk
Ensures that for each
identifier there is a
corresponding
equivalence class
containing at least K
records
*: Multi Party
Computation (MPC) **: Example Apple

31. 31
Positioning of some Encryption and Privacy Models
Source: INTERNATIONAL
STANDARD ISO/IEC 20889
Clear
123 897
Differential Privacy (DP)
Format Preserving
Encryption (FPE)
Homomorphic
Encryption (HE)
k-Anonymity Model
FPE
Enc
__
__
__
**: Example Apple
Clear_D1
Clear
Protected
Curator**
Filter
Clear
Cleanser
Filter
Cleanser
Filter
Clear
__
__
__
*: Multi Party
Computation (MPC)
Op
(Enc_D1,
Enc_D2)
HE Dec
HE Enc
HE Enc
Clear12
FPE
Dec
Clear
123 Protec
ted
DB
DB
Protected
Keys
Protected
Key
Clear_D2
Enc_D1
Enc_D2
“Untrusted
Party*”

32. 32
Positioning of some Homomorphic Encryption Models
Source: ISO/IEC, wikipedia
Homomorphic
Encryption (HE)
Models
Pre-FHE
First-Generation FHE
Second-Generation FHE
Third-Generation FHE
Different types/classes of HE can be used depending on the
use case for different PII data:
1. Types of Application operations required on data,
2. Performance,
3. Open source sw,
4. Industry Standards
Fully Homomorphic Encryption
Clear_D1
Op
(Enc_D1,
Enc_D2)
HE Dec
HE Enc
HE Enc
Clear_D12
Protected Key
Clear_D2
Enc_D1
Enc_D2
“Untrusted Party*”
“Trusted Party”
“Trusted Party”
“Trusted Party”
*: Multi Party Computation (MPC)

33. 33
Secure multi-party computation (MPC) and Homomorphic encryption

34. 34
Secure Multi-Party Computation (MPC)
Source: https://eprint.iacr.org/2018/450.pd

35. 35
Security Metrics from DevOps
# Vulnerabilities
Time

36. 36
Extract Real
Business Value
from Protected
Data

37. 37
Securing Big Data - Examples of Security Agents
Import de-identified
data
Export identifiable data
Export audit for
reporting
Data protection at
database,
application, file
Or in a
staging area
HDFS (Hadoop Distributed File System)
Pig (Data Flow) Hive (SQL) Sqoop
ETL Tools BI Reporting RDBMS
MapReduce
(Job Scheduling/Execution System)
OS File System
Big Data
Data Security Agents, including encryption, tokenization or
masking of fields or files (at transit and rest)
37
SecDevOps

38. 38
Generating Key Security Metrics
38
# Vulnerabilities
Time

39. 39
DGPR & CCPA

40. 40

41. 41

42. 42
Source: IBM
Encryption and
TokenizationDiscover
Data Assets
Security
by Design
GDPR Security Requirements – Encryption and Tokenization

43. 43
Data sources
Data
Warehouse
In Italy
Complete policy-
enforced de-
identification of
sensitive data across
all bank entities
Example of Cross Border Data-centric Security
• Protecting Personally Identifiable Information
(PII), including names, addresses, phone, email,
policy and account numbers
• Compliance with EU Cross Border Data
Protection Laws
• Utilizing Data Tokenization, and centralized
policy, key management, auditing, and
reporting

44. 44
Differential privacy,
Tokenization,
Homomorphic
encryption, and Privacy-
preserving computation

45. 45
On Premise tokenization
• Limited PCI DSS scope reduction - must still maintain a
CDE with PCI data
• Higher risk – sensitive data still resident in environment
• Associated personnel and hardware costs
Cloud-Based tokenization
• Significant reduction in PCI DSS scope
• Reduced risk – sensitive data removed from the
environment
• Platform-focused security
• Lower associated costs – cyber insurance, PCI audit,
maintenance
Total Cost and Risk of Tokenization in Cloud vs On-prem

46. 46
Quantum
Computing

47. 47
Quantum computers will be able to instantly break the encryption of sensitive
data protected by today's strongest security, warns the head of IBM Research.
This could happen in a little more than five years because of advances in quantum
computer technologies.
47Source: IBM and ZDNet
Security Concerns with Quantum Encryption

48. 48Source: Quantum Computing Inc

49. 49
Source: Gartner
Microsoft Predicts Five-year Wait for Quantum Computing in Azure

50. 50

51. 51

52. 52
Quantum Computing Breaking Algorithms
Source: ANSI X9
Source: ANSI X9

53. 53
Industry
Standards

54. 54
Emerging De Jure Standards for SSI
Verifiable Credentials
DID Auth
DKMS
(Decentralized Key
Management System)
DID
(Decentralized Identifier)
Source: Sovrin.org

55. 55
• Format-preserving encryption (FPE) is useful in situations where fixed-format data, such as
Primary account numbers Social Security numbers, must be protected.
• FPE will limit changes to existing communication protocols, database schemata or application
code.
55Source: Accredited Standards Committee ANSI X9
2018 ANSI X9 STANDARD FOR FORMAT PRESERVING ENCRYPTION

56. 56

57. 57

58. 58

59. 59
Thank You!
Ulf Mattsson, TokenEx
ullf@ulfmattsson.com
www.TokenEx.com
Webinar Title: New Enterprise Application and Data Security Challenges and Solutions
Webcast Live Date & Time: 10:00 am Apr 25 2019 United States - Los Angeles