Главная
Study mode:
on
1
Intro
2
Things we won't talk about
3
Data security depends on a data flow
4
Data security 101
5
Encryption is an ultimate data security measure
6
A02:2021-Cryptographic Failures. Focused mostly on crypto usage and implementation.
7
A04:2021-Insecure Design. Focused on design, missing or wrong security controls.
8
Application-level encryption (ALE)
9
End-to-end encryption
10
Zero Trust / Zero Trust Architecture
11
Zero Knowledge Architecture (ZKA) - system where no one has access to unencrypted data, except the user (node, service, person). Also known as No Knowledge Systems
12
Other exciting crypto terms Privacy enhancing cryptography: SMPC, PSI, PIR, FHE, PAKE, OPAQUE.
13
Security controls to support crypto
14
Pros & Cons
15
Proxy-side field-level encryption Acra
16
Key hierarchy Database
17
ALE for NoCode platform
18
Crypto + supporting controls 1. Key management, separate key per customer (BYOK). 2. Full compartmentalization: customer's data is located in different DBs, encrypted by different key, each app uses …
19
ALE for fintech platform
Description:
Explore a comprehensive keynote on data security and cryptography as the ultimate security control. Delve into various encryption approaches, including end-to-end encryption for NoCode platforms, DRM-like protection for ML models, and encrypted message exchange for CRDT-based real-time syncing apps. Examine the supporting security controls necessary for effective cryptography implementation, such as API protection, anti-fraud systems, mobile device attestation, and authentication/authorization. Gain insights into how "strong cryptography" evolves into a "real-world security boundary around sensitive data" across different contexts. Learn about application-level encryption, Zero Trust Architecture, and Zero Knowledge Architecture. Discover privacy-enhancing cryptographic techniques like SMPC, PSI, FHE, and OPAQUE. Investigate practical implementations, including proxy-side field-level encryption, key hierarchies for databases, and cryptographic solutions for NoCode and fintech platforms. Understand the pros and cons of various approaches and the importance of full compartmentalization and transparency in data security. Read more

Data as a New Security Boundary - Cryptography and Supporting Controls

OWASP Foundation
Add to list
0:00 / 0:00