Can Homomorphic Encryption Bring Down The Curtain On POS Malware?
VP and CISO for Star and Disney India, overseeing the company's cybersecurity strategy in India. Passionate Whitehat hacker. LinkedIN  getty  Payment card industry (PCI) compliance is one of the most exhaustive compliance frameworks available today. This framework contains 12 security domains and 300-plus controls to be deployed. Nearly all companies across the globe religiously follow the framework and are audited every year by a third party. In June 2020, Visa Payment Fraud Disruption (PFD) got hold of some malware samples from two North American merchants. They found that criminals targeted the merchant's point-of-sale (POS) terminal using malware scrapper malware. This variant belongs to TinyPOSm, and some matches were found with other malware families like RtPOS, MMon (also known as Kaptoxa) and pwnPOS. These all have one thing in common: They scrape POS terminal memory to collect credit cards' track-one and track-two payment account data. After so much improvement in encryption for data at rest, we still cannot solve the problem of encrypting data in memory  because all applications need data in clear text, and PCI applications are no different. Current encryption algorithms are not designed to encrypt data in memory without impacting performance. This would look like a magic bullet when it comes to RAM-scraper malware. Let's explore this encryption method and its applications in the real world. This is a type of encryption that allows data to remain encrypted while it's used. In standard encryption, we need to decrypt the ciphertext to process data at a destination, but in this case, this encryption can work on the same ciphertext and produce the same output as clear text. This new method can enable applications to work on ciphertext and can remove the dependency of decryption. This encryption, despite having been around for a long time, has not been ready for deployment until recently. Industries are now thinking about deploying homomorphic encryption to solve real problems. To recap, RAM-scraper malware takes advantage of data stored in clear text to support application processing. This encryption algorithm can enable payment applications to write encrypted data and use the same ciphertext to process data. This change will force malware writers to change up their approach when targeting POS terminals in the future. Homomorphic encryption was introduced around the same time as public-key algorithms. There are two current limitations facing this encryption type, though. The first one relates to supporting multiple users. For instance, many system users want to protect confidential data from hackers. To accomplish this, we can create a database for each user, but each database's size will make this infeasible. Apart from this, fully homomorphic encryption schemes require enormous computation power. To address these limitations, the industry is working to enable developers hoping to adopt this encryption type. Microsoft launched SEAL (Simple Encrypted Arithmetic Library), a collection of libraries that enables developers to work on encrypted data. Google also launched its open-source cryptographic tool. Their objective is to work on encrypted data and produce the same result as clear text. Multiple other technology companies are taking steps to make this technology available to all and soon will see some real-life deployments that solve RAM-scraper malware. Homomorphic encryption is a method that I believe holds a great deal of promise. It has enormous potential to transform the privacy landscape  all as part of the broader adoption of practices that safeguard confidential information. In the early adoption scenario, cloud providers can play an essential role when it comes to the onset of this encryption type, as they require an increased level of security. Some leading cloud providers like AWS have already partnered with many companies to provide these services to their customers. Cloud service providers should promote this kind of privacy-enhanced technique because their successful adoption could lead to heightened security in other use cases in the industry. Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives.