In recent weeks, we have seen eye-watering amounts of personal data exposed by criminal actors, in an attempt to either extort organizations for ransom payments or sell the information for financial gain.
In the UK, three major airports suffered data breaches that exposed information relating to nearly nine million people. In the fintech sector, Revolut mistakenly disclosed a wealth of customer data to scammers impersonating government officials.
While in North America, hackers reportedly offered scans of nearly 153 million US and Canadian driving licenses for sale on the dark web.
These incidents highlight the risks and vulnerabilities organizations face when they accumulate and retain large volumes of valuable personal data.
Beyond the obvious need for greater internet security and protection against AI related attacks or synthetic identities, it raises one other fundamental question: do companies really need to collect and retain so much personal data?
More data, more risk
Identity checks can typically involve companies collecting names, dates of birth, addresses, document scans and facial images. That data is then stored, and may be copied across different suppliers and systems in the hope that existing security protocols stay robust.
As a result, organizations may unintentionally be creating honeypots. If breached, this data could be used to facilitate a variety of illicit activities such as fraud, impersonation and social engineering. The more information an organization collects, the more places it is creating data exposure risks.
Data accumulation thus significantly increases a company’s security risk. As data’s value increases, breaches are becoming more lucrative for attackers and more catastrophic for businesses. As AI tools continue to become commoditized and easier to use, breaches may become even more frequent unless we find new ways to verify legitimate information without a person’s entire underlying dataset being at risk.
Verification doesn’t require lots of data
Many of the free online services we use everyday are at risk from disruption because they fundamentally ask for too much data. These services do not need to know 10+ pieces of personal information about an individual - yet, because this is still collected, the internet’s overall business model is vulnerable.
Authentication primitives that preserve privacy can offer a way forward, helping to protect the future of the internet. They enable people to access free content and services without revealing unnecessary personal details. For example, an age-gated service may only need proof that someone is above a minimum age requirement, or a government service may only need confirmation of residency.
All of these core aspects can be verified without needing to access and store someone’s full dataset. The only necessity is asking the right questions at the right time – in a way that ensures what needs to be verified is in fact legitimate.
Data minimization can therefore become a security control and risk mitigation tool. The less information a service collects and retains, the smaller the attack surface for illicit actors. By asking only for the information needed at a particular moment, organizations can attest what matters without creating an unnecessary, high-risk store of personal data.
Prove the fact: keep the details private
Modern zero-knowledge cryptography can help address this challenge. It enables individuals to optionally store digital credentials via information from physical, chip-enabled ID cards or government digital identities like mobile driver’s licenses through an app, without making it accessible to third parties.
An individual can then use their digital ID to prove things like age, nationality and unique document ownership without revealing their identity or giving that data to a third party. Zero-knowledge cryptography can verify these claims while keeping the original information private.
When proof generation takes place on the individual’s device, sensitive information can remain local while the receiving service gets the proof it needs. Holding less reusable identity data can limit what an attacker obtains if that service is breached.
Preserving privacy: why this matters
Beyond the security benefits outlined, reducing data retention will also become essential as AI makes it harder for us to distinguish what’s real, and what data to trust. At the same time, advances in computing power could mean that private data encrypted well today could be harvested and decrypted easily in a post-quantum future.
Zero-knowledge proofs are not the finished article, but this should form a key part of a broader shift to cryptographic systems that is going to be fundamental to how we verify real information it can trust, and prepares companies for threats that were barely conceivable a decade ago.
In a world where both personal data is becoming more valuable, harder to trust and secure, holding less will become one of the most essential security measures.
We've reviewed, rated and ranked the best Identity Theft Protection software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
via Hosting & Support
Comments
Post a Comment