The Black Unicorn Report for 2021

Example 1: A ransomware attacker compromises a privileged account – a typical tactic during Phase 1.
With traditional security systems: The company encrypts its sensitive data and has an identity and access
management system in place, but these protections aren’t effective enough. Once the attacker
gains control of an account with high-level access privileges, he can access the authorized user’s
decryption keys, decrypt the data, export it, copy it ad infinitum, and send it wherever he pleases.
With Keyavi: Even though the attacker has successfully tricked the security system into believing he is the
actual user via identity compromise, the built-in data protections will not allow him to decrypt and read it –
much less copy it, export it or send it to others.
Why? Because policies are embedded in the data – policies that extend beyond just identity. As soon as
the hacker tries to open sensitive data, it automatically asks itself, Where am I? Am I allowed to be
here? Why did I ever leave my owner’s office? And right away, this highly intelligent data realizes: This
is not a pre-authorized location. Therefore, I don’t care who he says he is, I won’t open in this location.
And that’s the end of it. No matter how many accounts the attacker hacks into or creates, no matter how
many spying tools he uses or legitimate-looking requests he issues to access sensitive information, the
data will refuse any access that is not authorized by company policies.
The data won’t just sit there silently, either, but will capture full forensics of the attacker and his location,
then send it to the data’s rightful owner.
Example 2: An attacker has already stolen a company’s data.
With traditional security systems: Even if the company pays a ransom to unlock its files, there’s no
guarantee it will ever get all copies of its data back. The attacker can return to make multiple extortion
attempts or sell the data to third parties at any time.
With Keyavi: If data is stolen during a ransomware attack, whoever owns that data can revoke access
anytime, anywhere at the mere touch of a button. This includes exfiltrated data that resides on an attacker’s
devices, websites or storage systems. The attacker, and anyone he sends it to, will never be able to see,
access or use the data again.
Example 3: An attacker posing as a software consultant tries to copy sensitive data onto a USB drive.
With traditional security systems: Once the attacker leaves the premises, the data goes with him, never to
return.
With Keyavi: Even if data has been copied onto a USB, the data’s built-in protections will never allow itself
to be opened on an unauthorized device for an unauthorized user at an unauthorized location.
These examples illustrate just a few of over 50 protective capabilities Keyavi can infuse into data. Policies
can prevent data from traveling to devices that don’t have specific anti-malware applications installed and
running. They can prevent print screen screenshots or data-sharing on Zoom. They can apply different
permissions, such as read-only or edit, to different users. Whoever owns the data can control and alter
these policies at will, even if their data has already left their possession.
Keyavi’s Silver Bullet
Unlike other security systems, self-protecting data strikes at the heart of ransomware’s business model: its
money-making machinery. If attackers can’t demand extortion payments or sell data to third parties, their
major sources of revenue dry up, and they remain stuck in Phase 1. While criminals may have broken into
the mansion, if they can’t take anything out, it does them little good.
67