{"id":102,"date":"2020-03-20T03:27:18","date_gmt":"2020-03-20T03:27:18","guid":{"rendered":"http:\/\/localhost\/theratio\/?p=102"},"modified":"2022-09-09T19:19:30","modified_gmt":"2022-09-09T19:19:30","slug":"once-more-unto-the-data-breach","status":"publish","type":"post","link":"https:\/\/nsandrc.org\/?p=102","title":{"rendered":"Once more unto the (Data) breach"},"content":{"rendered":"

1 in 4 companies will experience a data breach in the next 12 months according to the Ponemon Institute\u2019s \u201cCost of Data Breach Study: Global Overview\u201d.\u00a0 The perception is that the vast majority of data breaches involve on-premises infrastructure. As such, many companies prefer to employ the cloud for storing their data; it makes sense in principle to outsource cyber security to a professional cloud provider. It is also lower cost. However, some of the largest and most costly breaches have been for cloud-based systems e.g. Apple iCloud, Dropbox, LinkedIn, Microsoft and Yahoo , each resulting in millions \u2013 and in some cases billions \u2013 of accounts being compromised.<\/p>\n

Cloud computing means organizations allowing access to business-critical applications and sensitive data over the Internet. Recent advances in deep learning have revolutionised image and speech processing, making exciting new applications possible. Many of these applications require the support of cloud computing infrastructure to centralise the necessary computing power required to process video and audio data. There are numerous emerging examples of this such as Amazon\u2019s personal assistant Alexa which employs cloud processing to support its voice recognition and dialogue management functionality. Whilst no breaches of this system have been reported, the implication is that unencrypted audio data\u00a0
must reside on the cloud, to enable it to be processed, and hence carries a substantial risk.<\/p>\n

Earlier this year, an open database containing links to more than 2 million voice messages recorded on cuddly toys was discovered . Personal pictures of celebrities were breached from Apple\u2019s iCloud offering. In the majority of cases, cloud providers typically urge their customers to use stronger passwords, and add notification systems that look for suspicious activity.<\/span><\/p>\n

Whilst personal photos of Jennifer Lawrence are seemingly of interest to hackers, the implications for leakage of audio data could be even more serious. Perhaps the largest unknown in this scenario, is what the future capabilities of deep learning will have on analysis of biometric signals like voice.<\/span><\/p>\n

Dr Rita Singh from Carnegie Mellon University and her colleagues pieced together a profile of a serial US Coastguard prank caller solely from recordings of his voice . This included a prediction of his height and weight, and also the size of room he was calling from, leading to his apprehension by the authorities. Dr Singh\u2019s team are using this research to identify a person\u2019s use of intoxicants or other substances, and also the onset of various medical conditions the speaker may not even be aware they possess.<\/p>\n

For instance, the biomarker for Parkinson\u2019s Disease can be detected in a person\u2019s voice long before any other symptoms arise. This raises the prospect of using voice recognition in the medical field to diagnose diseases with speech-related biomarkers.<\/p>\n

This recognition of the usefulness of voice biometrics is now utilised by some banks to \u201csecure\u201d accounts. Banking has embraced voice authentication in order to make the banking customer\u2019s experience frictionless. However, a recent BBC article detailed a voice biometric breach that occurred when a journalist gained access to his twin brother\u2019s HSBC bank account. Whilst this flaw was attributed to legacy voice biometric solutions, one should be cautious with relying on voice as the principle mode for authentication, for no other reason than it is not difficult to record someone\u2019s voice, and in the near future to use that recording to synthesise that voice to say anything.<\/p>\n

\n

\u201cThe perception is that the vast majority of data breaches involve on-premises infrastructure..\u201d<\/p>\n<\/blockquote>\n

\"\"<\/p>\n

Start-ups like Lyrebird are working on ways to replicate a voice using just a minute of recorded speech. In the very near future, any sample of your voice could be used to realistically impersonate you. The implication is that the future will feature a significant arms race between AI-equipped adversaries\u2019 intent on breaching cloud-based systems, and the intelligent algorithms designed to protect such systems. So, what is the answer? Well, first of all, organisations must understand the probability of being attacked, how it affects them, and even more importantly, which factors can reduce or increase the impact and cost of a data breach. One such way to mitigate the effects of a breach of audio or video data in particular is to encrypt it.<\/p>\n

For sensitive data, there is the option of using encryption for the secure storage of data in the cloud. However, while we have become increasingly good at encrypting data at rest, in order to process the data on the cloud we first need to decrypt it, which in turn excludes the possibility for using the cloud\u2019s resources to process sensitive data, unless it can be done in a secure way.<\/p>\n

Cryptography research has made some innovative strides with this issue in recent years.\u00a0 Searchable Encryption (SE) is a relatively new form of encryption that enables encrypted data to be searched with encrypted keywords.<\/p>\n

\"\"<\/p>\n

In this way, the idea is that the cloud can be used to store sensitive data that has been encrypted. An authenticated user can then search that data using search terms that are also encrypted, and the Searchable Encryption protocol residing on the cloud is able to compare the encrypted search terms and match it to the relevant encrypted data without ever understanding either what was being searched for, or what data it contains. It is no surprise that the seminal paper from Senny Kamara, the inventor of this revolutionary cryptosystem, is one of the most-cited security papers since 1981.<\/p>\n

Searchable Symmetric Encryption (SSE) is also the basis of the Intelligent Voice\u2019s encrypted search product CryptoSearch, with which large volumes of a users\u2019 encrypted speech transcripts and their corresponding encrypted audio can be outsourced to the cloud for storage. For review, the audio database and its associated encrypted transcripts can be searched, and once the pertinent audio file has been found it can be downloaded and decrypted behind the client\u2019s own firewall \u2013 without the need to download everything, decrypt it, find what you are looking for, re-encrypt and re-upload. At no point does the cloud server ever see the data or the search terms in the clear. In the event of a breach any data retrieved is encrypted and can only be decrypted with either prohibitively computationally costly brute force decryption, or the user\u2019s private encryption key.<\/p>\n

Ultimately it is advances such as Searchable Symmetric Encryption and Fully Homomorphic Encryption that will be the cloud defender\u2019s most valuable asset for safeguarding our data in the cyber security threat climate we can expect in the very near future.<\/p>\n

Intelligent Voice Limited (IV) is\u00a0a global leader in the development of proactive compliance and technology solutions for voice, video and other media.<\/em><\/p>\n

\"\"<\/p>\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

1 in 4 companies will experience a data breach in the next 12 months according to the Ponemon Institute\u2019s \u201cCost of Data Breach Study: Global Overview\u201d.<\/p>\n","protected":false},"author":1,"featured_media":5406,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"give_campaign_id":0,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[96],"tags":[],"class_list":["post-102","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-it"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/nsandrc.org\/index.php?rest_route=\/wp\/v2\/posts\/102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsandrc.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsandrc.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsandrc.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsandrc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=102"}],"version-history":[{"count":8,"href":"https:\/\/nsandrc.org\/index.php?rest_route=\/wp\/v2\/posts\/102\/revisions"}],"predecessor-version":[{"id":5405,"href":"https:\/\/nsandrc.org\/index.php?rest_route=\/wp\/v2\/posts\/102\/revisions\/5405"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsandrc.org\/index.php?rest_route=\/wp\/v2\/media\/5406"}],"wp:attachment":[{"href":"https:\/\/nsandrc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsandrc.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsandrc.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}