What Are Privacy-Enhancing Technologies (PETs)?
Modern enterprises will have to work with customer data in one way or another. The COVID-19 pandemic proved that the only businesses that would survive the future were those willing to embrace technology. While technologies such as the Internet of Things, and artificial intelligence have undeniable benefits, they have also presented complications.
Managing your customers’ or site visitors’ data is a lot like having intimate access to their homes. If businesses fail to prioritize data privacy and security in the early building stages of their business, it may come back to haunt them at the most inconvenient moments. Hence, the growing importance of Privacy-Enhancing Technologies (PET).
This guide will explore what privacy-enhanced technologies are and how your company can benefit from their use.
What Are Privacy-Enhancing Technologies?
Privacy-enhancing technologies or PET are designed to prevent data leaks while balancing privacy with usability. Some PETs even prevent bad actors from identifying to whom the collected data belongs – if a leak were to occur, the data would be virtually useless to cybercriminals.
Other PETs avert costly data breaches through cryptographic protection during data processing. PET can also come in the form of remote auditing services that monitor and ensure that data is only being processed for the right purposes. This minimizes the chance of data leaks and breaches.
Your company may have all the necessary data and know everything there is to know about it, but building online and software-based services that are private by design is challenging. PET can help you launch privacy-honoring services that prevent disastrous data leaks.
Types of Privacy Enhancing Technologies
In truth, the term “privacy-enhancing technology” is a bit vague. It refers to any technology that represents the foundational elements of data protection. As such, any tool that minimizes personal data use while maximizing data security can fall under this umbrella. Types of PET include:
Data Masking
Traffic analysis is one of the biggest threats to data security and privacy. Bad actors should not be able to monitor your online footprint or communications. You can prevent this incursion utilizing a reputable VPN provider to encrypt your communications while you are connected to a public network. This is one of the most simple and yet effective strategies you can use to keep your online footprint hidden. A good VPN will conceal your browsing history, personal data, login information, and IP address so it’s much more difficult for you to be tracked while online.
Pseudonymization and obfuscation are other forms of data masking. This is where sensitive data is either distorted, masked, or replaced with fake data. Companies can go as far as utilizing machine learning algorithms to create synthetic data.
Businesses can also protect their customers by minimizing the amount of personal data they collect. This is known as data minimization.
Cryptography
Cryptographic tools are the oldest forms of PETs. For instance, we’ve seen how unique-per-field derived encryption can be effective for securing crypto assets via crypto wallets.
Homomorphic encryption is a good example of modern cryptographic methods used in data privacy. The process involves encoding data so that operations on the data can still be performed without decryption. It’s similar to how you can open a zip folder and make changes to the files within.
There are two main types (some sources cite three) of homomorphic encryption:
- Full homomorphic encryption (FHE)
- Partial homomorphic encryption (PHE)
Secure multi-party computation (SMPC) is another form of cryptography used in PET. In this method, parts of a chunk of data are encrypted by multiple parties, similar to how P2P swarm systems work.
Differential privacy in data cryptography is functionally similar to obfuscation. The data is obscured through a layer of statistical noise. This method is often used in statistics as it can hide data pertaining to individuals while still revealing data that allows you to identify group-related patterns.
Finally, zero-knowledge proof (ZKP) works similarly to homomorphic encryption, where data can be utilized without revealing it. ZKP allows you to validate the data (or use it for validation) without decryption.
How To Choose A PET?
There are a lot of impressive privacy-enhancing tools on the market. However, it’s important to identify how they would fit within your software stack and IT infrastructure. Consequently, you must recognize your services and business’s specific data privacy needs. You should:
- Identify the volume and type of data your business handles. Is the majority of it structured or unstructured?
- Identify the third-party services your data is shared with (if there are any). If your data is passed between third parties, then homomorphic encryption is your best option.
- Distinguish which parts of the data you need. For instance, do you need full access to the dataset or just the result/output? Can you negate sensitive data that can be used to identify individuals (personally identifiable information)?
- Identify what the data will be used for. Will it be used for statistics, market data, or training a machine learning model, as well as other similar uses?
- Assess your IT infrastructure and your network and computational capabilities. This will help you determine if a particular PET is compatible with your enterprise’s resources. Additionally, you can use this information to determine which parts of your IT infrastructure require upgrading.
- Make the necessary provisions in your budget, as PETs can be expensive – some more than others.
Conclusion
There are many different types of PETs, each designed to solve a specific business problem. While some are better at aggregated analytics, others are more suited for precise results. Likewise, some may be ideal for deriving insights from sensitive data, while others are best for data exploration.
Organizations from different industries are collecting and analyzing data of all modalities at an unprecedented rate. Thus, they must ensure that they securely collect data while analyzing it demonstrably. This is essential for your business’s public image and financial future. PETs should serve as a small part of a larger zero-trust solution. It’s important to avoid being myopic when considering cybersecurity and data privacy.
About the Author: Gary Stevens is an IT specialist who is a part-time Ethereum dev working on open source projects for both QTUM and Loopring. He’s also a part-time blogger at Privacy Australia, where he discusses online safety and privacy.
Editor’s Note: The opinions expressed in this guest author article are solely those of the contributor, and do not necessarily reflect those of Tripwire, Inc.
