Confidential computing, what's the big secret?
The COVID-19 pandemic has amplified
how much of our lives we live online.
From ordering food for delivery,
to completing a banking transaction
to see a doctor,
our personal data is in many different locations online.
So the question consumers must ask:
who can access this data?
And more importantly, is it at risk of being compromised?
How can we as consumers trust the organizations
we communicate with for a secured,
frictionless experience?
Businesses have heard these questions
and are looking to the cloud to respond.
In fact, the COVID-19 pandemic has accelerated
digital transformation at 59 percent
of surveyed organizations.
And 76 percent of executives surveyed
say they plan to prioritize cybersecurity
over the next two years.
So businesses across all industries—
especially those that handle sensitive data
like government, financial and healthcare records—
must take extra care when considering
where to store and process their data.
Both for security purposes and privacy regulations.
So what's the solution?
Enter confidential computing.
Confidential computing refers to cloud computing
that isolates and protects sensitive data
and code during processing.
In 2018, IBM was the first cloud provider
to offer confidential computing capabilities
for use in production.
But before we get into what exactly that means,
here is why it matters.
According to a recent study
by IBM and the Poneman Institute,
the average cost of a data breach in the U.S.
is 8.64 million dollars
and takes 280 days to identify and contain.
Time is money when sensitive data is on the line.
The recovery from these breaches can be complicated
by the added risk to intellectual property
and damage to brand reputation.
But the hardest thing to recover is the trust
companies can lose from their customers.
With data getting more and more spread out
via hybrid cloud strategy—
much of it is floating at the edge with mobile devices,
smartphones,
smartwatches,
remote consultations with your physician
and 100 percent digital banking—
avoiding data breaches will only
get more complicated to manage.
Businesses across the board—from healthcare
to government to banking and telco—
are being challenged with finding the most innovative
and comprehensive ways to help assure security
across the life cycle of their customers' data,
while still making it practical for businesses to use.
IBM believes confidential computing is an answer
to assuring data privacy in the cloud.
Why?
Because when using confidential computing capabilities,
a company's data remains their data.
IBM as their cloud provider cannot access this data,
resulting in a private data environment.
With confidential computing in place,
a cloud provider simply cannot
provide access to third parties,
even if compelled to do so by external factors.
The term confidential computing
sounds like it's shrouded in secrecy,
but its key technologies
have been around for over a decade.
But to understand how it works,
we should first consider the three states of data:
data at rest,
data in-transit
and data in-use.
Data at rest and in-transit
can be protected using encryption.
Even if the data is intercepted by a hacker,
it can't be deciphered—and is therefore meaningless.
Data in use, however, is a different story.
Before it can be processed by an application,
data must be decrypted.
To put it simply—in order to use the data,
you have to see the data.
This leaves the data unencrypted in the memory
of whatever device it's stored on
and potentially exposed to malicious actors.
For this reason, some organizations have opted against
migrating their most sensitive applications to the cloud.
The lurking threat of data exposure
is just too great a risk.
This is precisely why IBM views confidential computing
as the future of protecting data
in hybrid cloud environments,
and the solution to this data in-use conundrum.
Let's break down why this is the case:
When using IBM's confidential computing capabilities
in the cloud,
sensitive data is isolated into
a protected enclave during processing.
The contents of this enclave—
the data being processed
and the techniques used to process it—
are only accessible to authorized code,
invisible to anything or anyone else,
including the operating system and cloud provider.
It means that your data is yours—
and IBM as the cloud provider cannot access it.
Think of it like an office in an office building.
The office is a private, secure location
where you can have a meeting.
There are a number of other offices in that building too,
but you can lock your door and have a private meeting
in your office and no one has access to your discussions—
even though you are in the same building.
The owners of the office building
and tenants in other offices
do not know what is going on in your office.
In this case of confidential computing,
the cloud is the office building,
and the enclave is the office.
This means that not even the cloud provider
can access this data,
and it unlocks computing scenarios
that were previously unthinkable.
First, it can give organizations the confidence
to move sensitive data and workloads
from an expensive,
inflexible on-premises IT infrastructure
to a modern and flexible public cloud platform.
Second, it helps address security and privacy concerns
when choosing cloud providers,
since the cloud provider cannot actually see any data.
And third, it facilitates greater collaboration and innovation.
Currently, businesses may avoid sharing proprietary data
with other organizations for fear of that data being exposed.
Confidential computing gives organizations the confidence
to share confidential data sets,
algorithms
and proprietary applications
to collaborate on research in the cloud—
all while preserving confidentiality.
Data protection, trust and security—
and therefore confidential computing—
are at the heart of IBM's hybrid cloud strategy.
Clients in financial services,
telco,
consumer healthcare
and automotive industries
are using advanced data protection capabilities
from IBM to help safeguard their data.
So it's clear that confidential computing
is critical not only to the future,
but it's critical now.
IBM believes its clients data should be theirs.
By investing in technologies like confidential computing,
IBM is helping clients build the trust they need
with their end customers
as their private information proliferates online.
It's all about delivering IT with integrity and trust.