Difference between security and privacy

Privacy vs Security. It is easy to get the two terms confused – and in most conversations, we end up talking about them as if they were the same thing. Privacy and Security may have some things in common but are actually quite different concepts.  Security can best be thought of as a form of defense.  Privacy is more about control and the freedom to make decisions about what you want to reveal.

One common argument that a lot of privacy advocates encounter is that privacy matters only to people who are secretive or have something to hide.  In fact, Google’s then CEO Eric Schmidt infamously once said “if you have something that you don’t want anybody to know, then you shouldn’t be doing it in the first place”.

But this is a flawed argument because it confuses privacy with secrecy.  The basic need for privacy isn’t born out of a need to keep a secret, so much as the need to control what information we desire to share and with whom.  For example, when we go into a bathroom, we close the door for privacy – not for secrecy.

Read: Data Security and Privacy: What is the Difference?

Why does Privacy Matters

There are several reasons why privacy matters in the digital age where users and enterprises are increasingly storing data in the public cloud.   It is estimated that more than a third of people’s data is in cloud storage today.

What may seem like disconnected pieces of information from discrete parts of this data, can be pieced together to know things about businesses and individuals that they didn’t intend to share in the first place.

Secondly, what you may consider ok to share today, may not be something you consider ok to share down the road – but once data is in the cloud, the lack of control makes it virtually impossible to go back and change your mind.

Last, but not least, privacy policies that you “accept” when signing up with cloud storage vendors can change and are virtually impossible to keep track of.

Why Data Privacy Matters Even More for Businesses

Most discussions around data privacy center around the rights of individuals.  But with regulations like GDPR that have effectively shifted the accountability around privacy to businesses, the privacy of data has become a business / regulatory problem.

If one thinks about it a little, Data privacy can be a bigger problem for businesses than for individuals.  Most individuals at some level, are willing to trade some privacy for convenience.  Businesses have too much at stake to allow any breach in privacy of their data.  The resulting penalties can be enormous.

Let’s take a look at this in the context of the cloud.  An individual may be ‘ok’ having some private information made available to Google in return for flight reminders, weather updates, and traffic tips.  So, uploading a boarding pass into Google docs may not seem like a big deal.  But an enterprise may not be comfortable allowing flight information for a senior executive is accessible to anybody other than who needs to know.

Data Privacy Issues

When businesses use data management solutions like backup, data archiving, file collaboration, and file sharing solutions – the decision about where to house the data repository backing these applications becomes an important question.

While using services like Google Docs, OneDrive for Business or Dropbox may seem straightforward enough,  SaaS services such as these which utilize public cloud infrastructure, pose a bevy of challenges for a business’ security team.

Most SaaS vendors today offer to encrypt the data sitting in their data centers, but the encryption comes with some risks.

1. Most public cloud vendors own and control the encryption keys, or at the least retain the ability to decrypt data with keys the customer might actually control. This means that they are in a position to decrypt data at any time and gain access.
2. Public cloud vendors don’t usually go out of their way to access their customers’ confidential data, but the chances of a cloud provider gaining unwarranted access to critical customer data are far too likely for the comfort of most enterprise security teams.
3. Also, if asked by government bodies to turn over sensitive data, many public cloud vendors have no choice but to immediately comply and share data in decrypted form, because the laws of the land may require them to do so.

How Parablu Helps with Data Privacy

Parablu’s Private Storage Container, BluKrypt™ with its secure cloud gateway has been designed to protect enterprise data in the cloud. BluKrypt doesn’t merely encrypt data – it obfuscates it thoroughly. File names, folder names, etc. become undecipherable on the target storage when BluKrypt™ is in use. Files may also be chunked up into smaller components and encrypted separately.  All data processed by BluKrypt is encrypted both in-flight and at rest.  When in flight we use TLS 1.2 with strong ciphers.

Segregation of Duties

But more importantly, BluKrypt operates on an important principle in encryption called the Segregation of Duties (SoD). When done correctly, SoD is a risk and security measure that ensures no two parties can perform the same part of a critical process or function. By dividing responsibilities and limiting access to information and data on a strictly need-to-know basis, organizations can significantly reduce their risk.  Many organizations already successfully implement SoD in other areas of their business, such as in their finance teams.