The internet has existed for nearly 40 years, and while that seems like a long time, we’re still in the infancy of the digital epoch. As we’ve discovered recently, many of the laws, regulations, and even internal company policies guiding our experiences in the online world were created before the internet became the ubiquitous force it is today. And as technology advances at an even faster pace over the next decade, we’ll likely experience even more growing pains.

One of the most contentious issues facing organizations today is determining what’s more critical: protecting end-user privacy or ensuring digital security?

Today, we’re delving head-first into this challenge and examining whether (and how) it’s possible to achieve both.

Photo by Matt Mech on Unsplash

The Great Privacy vs. Security Debate

As people have grown more comfortable engaging in digital spaces (and recognized the folly of trusting certain platforms with their data), consumers are becoming increasingly more interested in protecting their information online. Meanwhile, we also expect the companies we entrust with our data to protect us from becoming victims of cybercrime.

In many ways, privacy and security are two sides of the same coin. The difference comes down to what data you’re protecting, who is protecting it, and who you’re protecting it from. For example, protecting users’ digital security generally means preventing unauthorized individuals (like hackers) from accessing users’ sensitive data (like credit card details or social security numbers). But to protect people, you also need to monitor them — which is where the privacy issue comes into play. Working to prevent breaches and attacks often means behaving a bit like “big brother.”

In other words, protecting users’ privacy means impeding security, and prioritizing digital security often means potentially exposing users’ personally identifiable information (PII). Unfortunately, this catch-22 leaves businesses in the uncomfortable position of choosing which to sacrifice. And, more often than not, companies choose security over privacy.

The truth is, organizations have a moral, ethical, and often legal obligation to protect their employees, clients, and/or end-users from a security and privacy standpoint. And given the hefty legal penalties associated with failing to protect either, prioritizing one over the other means you could still up in hot water no matter which you choose.

Photo by Kaleidico on Unsplash

Is it Possible to Achieve Both End-User Privacy and Digital Security?

As a tech decision-maker, it seems you only have two choices. On the one hand, you can invest in digital security solutions that allow you to protect users’ sensitive data from falling into the wrong hands but risk infringing on their privacy. For example, plain text monitoring and even encrypted monitoring exposes potentially private client details. On the other hand, you can protect their privacy by not monitoring activities, but risk their data being compromised in an attack or breach.

But there’s a third option that allows you to accomplish both. By using the hash algorithm SHA-512, a security awareness platform can take your end-users’ usernames, hash them (that is, create a one-way encryption), and then take only half of those hashes.

This way, when they scan the web (and dark web) for leaked and stolen credentials, they can hash that data in the same way. If there’s a match, they can alert you and provide you with the half-hash pairs — which you can then reverse. With the pairs of half-hashes and passwords, you can determine whose information has been compromised and ensure they reset their credentials.

Confused? The good news is, you don’t have to fully understand the science behind SHA-512 hashing — you just have to choose a platform that can help strengthen your security without compromising user privacy. Which leads us to overcoming the next challenge.

Photo by Mimi Thian on Unsplash

Choosing the Right Protection

Now you know you don’t have to sacrifice your end-users’ privacy in favor of security — which is a huge weight off your shoulders and an additional selling point for your product or service. But, not all threat intelligence providers are equal.

Here are a few things to consider as you weigh your options:

• Encryption type
  There are several different methods for encrypting data, and not all of those options can guarantee user’s privacy. Using “half hashes” via the SHA-512 algorithm is a one-way type of encryption that ensures the security provider won’t know anything about a user — all they’ll see is a cryptographic string.

• Recovery support
  In addition to alerting you that your users’ information has been compromised, you also need to choose a provider that offers support for post-event assistance, including advice for recovery.

• Employee education
  The best way to protect your organization is to ensure your entire workforce is skilled in mitigating and identifying potential risks. A threat intelligence provider that offers education will help further reduce your likelihood of becoming victimized in a breach or attack.

Strengthening your organization’s digital security is critical, but it shouldn’t come at the expense of your end users’ privacy — and now it doesn’t have to. By choosing a threat intelligence platform that uses half-hashing technology, you can have the best of both worlds.