Cyber Defense eMagazine August Edition for 2021

— which include homomorphic encryption, secure multiparty computation, and trusted execution
environments, among others — allow businesses to responsibly monetize existing data assets by
respecting the privacy of both the customers using the monetization service and the data itself. It is critical
that data owners consider both of these components, the data and participants, or the risks associated
with monetization may outweigh the benefits.
At the core of any effective monetization strategy is the holistic security and governance of the data itself.
Some organizations are working to address this issue by adopting a data-centric approach to security,
focusing on the security of the data rather than just the networks, servers, and applications it resides on.
The goal of this holistic approach is to protect data wherever it is within an organization, whether at rest
on the file system, moving through the network, or while it’s actually being used or processed, as
represented in the Data Security Triad. If there is data of value at stake, it must be protected at all times.
While Data at Rest and Data in Transit are commonly protected using standard data and transport
encryption, the Data in Use segment is frequently overlooked by many organizations. Protecting data
while it's being used is especially of critical importance when it comes to leveraging data for monetization
purposes. PETs solutions are uniquely positioned to address these Data in Use vulnerabilities because
they can allow sensitive or regulated data to be securely processed and in a privacy-preserving manner
without the risk of exposure. With PETs, organizations can analyze, use, and provide access to data
assets in ways that may have previously been determined to be too risky, especially if that data is to be
shared with a third party.
PETs can also serve to protect the users of data monetization platforms by protecting their interests and
intents. For competitive reasons, organizations generally want to avoid revealing their specific interests
in a third-party dataset, even to the data owner. PETs allow these users to perform encrypted queries
and analysis, ensuring the content of their interaction with the data is never exposed beyond their walls.
For data owners, this expands the range of potential targets and ensures that users never introduce
sensitive or regulated content, such as those they may be included in the query itself, into their
environment.
Another significant barrier to monetizing existing data assets has been the need to combine or move data
assets to a central or even third-party location. There are a number of issues with such an approach, only
some of which involve data privacy. But homomorphic encryption, a pillar of the PETs category, can
overcome this challenge by enabling a decentralized framework for secure data sharing and
monetization. When designed to work as a proxy layer, the technology can also allow organizations to
integrate with existing data governance mechanisms such as access control measures and audit
systems. This ability to control and audit data usage and access is key to any monetization initiative.
There is no question that there are new revenue opportunities waiting to be unlocked by securely and
privately leveraging existing data assets in a privacy-preserving manner. However, while pursuing
technical answers to the question of "Can we?" organizations must also consider the foundational
question of "Should we?" before they embark. Data monetization is a cross-functional undertaking and it
Cyber Defense eMagazine – August 2021 Edition 72
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.