Among federal organizations, the Department of Homeland Security (DHS) faces unique cybersecurity challenges. For starters, some of the information it manages is top-secret. What’s more, organized crime groups and adversarial nations actively target the department with the goal of stealing or otherwise compromising its data.
But an additional challenge is that DHS doesn’t operate with a single mandate. Rather, it orchestrates numerous interconnected agencies that handle everything from intelligence to law enforcement, transportation, customs, immigration and emergency response. Each organization involves different levels of data sensitivity, vulnerability, and risk. Yet all need to carefully guard the data they manage.
A highly effective way DHS can protect its information is through data encryption. Organizations can apply encryption to protect data while it’s at rest – for example, stored on a hard drive – and while it’s in motion, such as traveling across a network or over the internet. But until recently, there was no practical, cost-effective way to encrypt data in use – while it’s being queried or transacted on in computer memory.
Today, that limitation has been addressed through a capability called confidential computing. Confidential computing provides the “last mile” of data encryption and protection. And it promises to transform the way DHS agencies secure their data.
Innovative Technology for Secure Data Access
Confidential computing is enabled by an ingenious hardware technology in the CPU that sets aside a section of a computer’s memory as a secure enclave. Any application or data in the memory enclave is encrypted with a cipher key that’s unique to that CPU. The data remains encrypted even while users access it, for example, to conduct a query or perform analytics.
Importantly, the encrypted data can be decrypted only in that enclave on that CPU. Even if cyber criminals hacked the system to gain root access, they would be unable to read the data.
An attestation feature enables the data owner to assure to a third party that the data is in the enclave. A DHS agency that handles healthcare data, for instance, could attest to a healthcare provider that shared information will remain encrypted even while in use.
Servers with the latest generation of processor can house up to 1 TB of enclave memory. Organizations can place an entire transaction server, database, or application in the enclave, encrypting all the associated data.
Several public cloud providers offer a confidential-computing cloud service. Customers can choose virtual machines that encrypt data in use, with an attestation capability that confirms the security of the machines.
Tools included in the service enable organizations to move existing application code into a confidential-computing container, without the need to rewrite the code. And agencies that manage clouds in a classified, air-gapped environment can perform provisioning, updates, and attestation without an external internet connection.
Unique Value for DHS Agencies
Any public- or private-sector enterprise can benefit from confidential computing. It’s well-suited to government organizations in part because it addresses a key tenet of zero-trust security, which ties security to the data itself. By encrypting data in use, confidential computing protects information independent of the system or network it’s on and independent of who’s accessing it.
But confidential computing is especially promising for DHS agencies, which often have unique requirements for data in use. DHS interfaces with many government organizations and many private-sector companies. Confidential computing can allow DHS to share data bidirectionally without exposing it.
The technology enables multiparty analytics in cases where the data owner might want to share a portion of a dataset while protecting the rest from view. Let’s say DHS and a financial institution needed to share sensitive information. Placing the data on a typical server or sending it through email would involve unacceptable risk. But either party could place the data in an encrypted enclave to allow secure access.
As another example, let’s say DHS needed to permit an airline to query a specific aspect of the No-Fly List, without allowing the airline to see actual names on the list. Or let’s say an airline wanted to allow DHS to query a portion of flight data without allowing the organization to see the flight manifest. Confidential computing provides an effective solution.
In fact, DHS agencies have already conducted proofs of concept (POCs) using confidential computing, such as sharing intelligence about cyber vulnerabilities and exploits. Those POCs were successful and are still in use.
Use cases for encrypting data in use will abound. Regrettably, so will cyber threats against DHS. Fortunately, confidential computing completes the three-legged stool of protecting data at rest, data in motion and data in use. It’s a proven technology that gives DHS a powerful new tool to safeguard its sensitive data.
