The future of data security threats and protection in the enterprise

Equipped with four degrees from Massachusetts Institute of Technology, two research fellowships and a bevy of awards and merits, Raluca Ada Popa is carving out her well-earned place in cybersecurity. Popa is an assistant professor in the Department of Electrical Engineering and Computer Science at the University of California at Berkeley and co-founder of the college's RISELab, which focuses on building systems that provide real-time intelligence with secure and explainable decisions. Popa is also co-founder and CTO of PreVeil, a security startup providing enterprise end-to-end encryption for email and filing sharing.

In this Q&A, Popa discusses the future of data security and the challenges of ensuring adequate defense.

Editor's note: The following has been edited for clarity and brevity.

What are the biggest threats to enterprise data security right now?

Raluca Ada Popa: The biggest threats remain the classic threats: [issues with] authentication, weak passwords, and people opening attachments in spam. A lot of these threats could be addressed with good practices such as Two-factor authentication. One of the biggest threats comes from the fact that the administrator is a central point of attack. That administrator often times has access to many accounts and a lot of data within the company -- if someone steals their credentials, they can access so much data.

What do you see as threats to the future of data security?

Raluca Ada Popa

Popa: In the long term, we have to change how we think about identity. There's also the issue of malware -- phishing and getting spam emails with malware attached. These are long-term threats unless [we] rearchitect the way we do email. It's not enough to marry your email to your name. To rearchitect, you have to have a cryptographic identity -- either a digital signature or a public key. Email has to be married to a cryptographic key that cannot be spoofed or phished.

Another significant threat is that software is complex and will always have bugs and exploits and, in the long term, will likely persist, because software will only become more complex. But on the server side, if you have end-to-end encrypted data, you worry less about what the exploits can do, because then people can only steal encrypted data.

Any other cybersecurity threats on the horizon?

Popa: I would say side channel attacks such as Meltdown and Spectre. Your machine, your operating system, is supposed to isolate a good program from a bad program. What happens in a side channel attack is any process you run on your machine can get data from another process. Computers have this side channel -- an indirect link of information -- and these recent attacks show that a random program can get information from another program on your machine. The architecture is fundamentally flawed; the microarchitecture of the machine is problematic.

It's something very difficult to change because hardware changes very slowly and it is going to be a problem for a very long time. Patches are issued for side channel attacks like Spectre and Meltdown, but the patches are fixing little holes and not the problem -- an attacker could come up with a variation of Spectre or Meltdown that avoids the patch and causes significant trouble.

Make sure the data is always encrypted at the server -- where only the clients have the decryption key -- so even if the attacker breaks in, you're prepared.

What tactics do you see upcoming in the future of data security protection?

Popa: First, end-to-end encryption. With that, data is encrypted on the server and you don't have to worry so much about what the server runs. It avoids the worry about the server and many of the things that can go wrong with the server.

The other thing is decentralized security and decentralized ledgers. There are two examples of decentralized security. One is certificate transparency and the other is key transparency. With certificates and keys, you no longer have to trust the server because the certificates and keys are issued in a distributed way. Because it's decentralized, if any one of the servers gets attacked, the security still holds. You'd have to compromise many, many machines before the [whole] system gets compromised. That's a new trend came from the excitement of blockchain.

Why do the bad actors always seem to be one step ahead?

Popa: They tend to be one step ahead because they only need to find one vulnerability, whereas defense has to protect all vulnerabilities. Defense has to think of all possibilities, while when you attack you only have to find the weakest link. It's much harder to build a defense than an attack.

Do you think we're going to see things get worse or better? Are we going to witness a catastrophic cybersecurity incident?

Popa: We're making tremendous progress in cybersecurity with things like end-to-end encryption, decentralized ledgers and modern cryptography tools. I'd say more advanced cryptography is starting to play a role and can give us some guarantees, but that doesn't mean there won't be a catastrophic attack before all [those advances are implemented]. There might be some catastrophic cyberattack, but I don't think it will mean we won't be able to use all our computers. We'll be able to recover and use computing systems, but maybe after we'll use them differently -- not use them so carelessly.

The thesis for your Ph.D. at MIT focused on building practical systems that compute on encrypted data. Why is this an important concept for a building a strong data security strategy and protections?

Popa: Exploited attacks keep happening, and they will happen forever. People try to build walls around the data, but people break in. So, make sure the data is always encrypted at the server -- where only the clients have the decryption key -- so even if the attacker breaks in, you're prepared. You don't have to worry about attacks on the server like exploits, administrator attacks and side channel attacks.

Can you describe the work you're doing now with RISELab?

Popa: We're trying to push into doing more things with encrypted data. The vision is to have only encrypted data on the server but to do everything you do with normal data. For example, we'd like to do machine learning on encrypted data. Many companies do machine learning on data, but it's unencrypted. Now, we only keep encrypted data for simple things like email or file sharing, so the question is how to enable more complex system work with encrypted data.

Are encryption systems unbreakable?

Popa: That's the game in which the defenders have been ahead of the attackers. We can predict when some algorithm will be broken, so we can increase its power ahead of time. So, it's very rare that an attacker breaks standard approved algorithms, because we make sure they're unbreakable for a period of time. That's why encryption defenders are usually ahead of the attackers.

What has being a founder of PreVeil taught you about the challenges and future of data security in the enterprise?

Popa: I think one of the most challenging parts is that when you develop a new security solution you have to integrate it with all sorts of legacy software. Many enterprises use software they shouldn't use anymore -- it's not safe and it's a ton of work. So, integrating a new security solution with all sorts of legacy software becomes a difficult task. But to have a secure enterprise, [companies] have to change how they do things. People have to be open to changing their workflows a little bit for security.

What has surprised you?

Popa: In research, you don't think about how easy it is to use something; you just think about whether it technically solves a security problem or not. But in industry and the real word, it matters so much. A lot of challenges come with designing something that is useable.