As cited
Copy frozen at (site build).
regulatory
Encryption isn’t enough to protect data wherever it goes
Data protection policy has historically focused on encryption and access controls, but these safeguards do not prevent exposure when data is decrypted for processing, copied, or moved through cloud services, vendors, and partner systems. Vaultless, keyless pseudonymization offers an alternative approach by replacing sensitive values with realistic substitutes before data spreads, reducing the damage if stolen data is intercepted. The federal government should evaluate this methodology and update procurement regulations to require vendors to disclose how they handle raw data and token-to-source mappings.
Why it matters: Security practitioners and federal agencies need to recognize that encryption alone cannot protect data in use; adopting data masking techniques like vaultless pseudonymization can significantly limit the value of breached information to attackers.
- Source published
- First seen by Cybersecurity Tracker