1
00:00:00,090 --> 00:00:01,020
In this lesson,

2
00:00:01,020 --> 00:00:03,750
we're going to dive into the world of obfuscation.

3
00:00:03,750 --> 00:00:05,040
Now, obscuring information

4
00:00:05,040 --> 00:00:07,350
can sometimes be as crucial as encrypting it

5
00:00:07,350 --> 00:00:09,810
and this is where steganography, tokenization

6
00:00:09,810 --> 00:00:12,240
and data masking are going to come into play.

7
00:00:12,240 --> 00:00:13,410
Let's take a moment to unpack

8
00:00:13,410 --> 00:00:14,820
each of these techniques together

9
00:00:14,820 --> 00:00:16,050
so we can get a clear picture

10
00:00:16,050 --> 00:00:18,660
of the role within the world of data security.

11
00:00:18,660 --> 00:00:20,790
First, we have steganography.

12
00:00:20,790 --> 00:00:22,560
Now we often talk about steganography

13
00:00:22,560 --> 00:00:25,200
and we think about it as the art of hidden writing.

14
00:00:25,200 --> 00:00:27,450
Steganography is derived from the Greek words

15
00:00:27,450 --> 00:00:29,010
meaning covered writing.

16
00:00:29,010 --> 00:00:30,570
It's all about concealing a message

17
00:00:30,570 --> 00:00:31,740
within another message

18
00:00:31,740 --> 00:00:33,763
so that the very existence of that hidden message

19
00:00:33,763 --> 00:00:35,460
is unknown.

20
00:00:35,460 --> 00:00:36,990
Now, steganography is defined

21
00:00:36,990 --> 00:00:38,730
as the practice of hiding secret data

22
00:00:38,730 --> 00:00:41,580
within ordinary non-secret files or messages

23
00:00:41,580 --> 00:00:42,990
to avoid detection.

24
00:00:42,990 --> 00:00:44,040
Our primary goal here

25
00:00:44,040 --> 00:00:46,500
isn't to prevent unauthorized access to the data,

26
00:00:46,500 --> 00:00:48,330
but instead to prevent the suspicion

27
00:00:48,330 --> 00:00:51,360
that there is any hidden data inside of it at all.

28
00:00:51,360 --> 00:00:53,850
For example, if I post a digital picture of a cat

29
00:00:53,850 --> 00:00:55,470
to my social media profile,

30
00:00:55,470 --> 00:00:57,360
you may see it and just think that it's a picture

31
00:00:57,360 --> 00:00:58,770
of a cute little kitty.

32
00:00:58,770 --> 00:01:01,579
But in actuality, I could be using stenographic techniques

33
00:01:01,579 --> 00:01:03,600
where I'm actually embedding a hidden message

34
00:01:03,600 --> 00:01:05,489
within that cat picture.

35
00:01:05,489 --> 00:01:06,750
By subtly changing the colors

36
00:01:06,750 --> 00:01:08,790
of specific pixels inside of patterns,

37
00:01:08,790 --> 00:01:10,350
which are really going to be indistinguishable

38
00:01:10,350 --> 00:01:11,580
to your human eye,

39
00:01:11,580 --> 00:01:13,530
that image can carry additional payloads

40
00:01:13,530 --> 00:01:14,910
of hidden information.

41
00:01:14,910 --> 00:01:16,470
When the recipient knows where to look

42
00:01:16,470 --> 00:01:17,610
and has the right tools,

43
00:01:17,610 --> 00:01:19,500
they can actually extract this hidden message

44
00:01:19,500 --> 00:01:21,690
while adversaries will remain oblivious to the fact

45
00:01:21,690 --> 00:01:22,680
that there was a hidden message

46
00:01:22,680 --> 00:01:24,025
in the picture to begin with.

47
00:01:24,025 --> 00:01:27,090
Now, steganography is frequently used alongside encryption

48
00:01:27,090 --> 00:01:28,712
for an extra layer of security too.

49
00:01:28,712 --> 00:01:31,081
While encryption announces there's something worth hiding,

50
00:01:31,081 --> 00:01:34,050
steganography will hide it in plain sight

51
00:01:34,050 --> 00:01:36,120
making detection itself a pretty big challenge

52
00:01:36,120 --> 00:01:38,520
for us as cybersecurity professionals.

53
00:01:38,520 --> 00:01:39,900
Let me give you a quick demonstration

54
00:01:39,900 --> 00:01:42,060
of how scenography is used.

55
00:01:42,060 --> 00:01:43,740
If you've ever seen an old spy movie

56
00:01:43,740 --> 00:01:46,350
where one spy takes out a classified ad in the newspaper,

57
00:01:46,350 --> 00:01:47,730
and the first letter of each word

58
00:01:47,730 --> 00:01:50,790
makes up the secret message, something like, "Meet at six,"

59
00:01:50,790 --> 00:01:52,641
This is a version of steganography,

60
00:01:52,641 --> 00:01:55,710
note that data isn't going to be encrypted when you do this.

61
00:01:55,710 --> 00:01:58,230
It's just going to be hidden inside another message.

62
00:01:58,230 --> 00:01:59,331
And if you know what you're looking for,

63
00:01:59,331 --> 00:02:01,680
then it's really easy to see the message

64
00:02:01,680 --> 00:02:03,660
inside wherever it's being hidden.

65
00:02:03,660 --> 00:02:05,520
So in the case of my newspaper example,

66
00:02:05,520 --> 00:02:07,620
writing down the first letter of each word

67
00:02:07,620 --> 00:02:09,300
gives you the secret message.

68
00:02:09,300 --> 00:02:11,580
Now, basically, if anybody knows where to look,

69
00:02:11,580 --> 00:02:13,740
they can easily pull that data back out.

70
00:02:13,740 --> 00:02:15,450
So let's jump into the lab environment

71
00:02:15,450 --> 00:02:17,520
and see how easy it is to hide some data

72
00:02:17,520 --> 00:02:20,760
inside a standard photograph using a scenography tool,

73
00:02:20,760 --> 00:02:23,400
and then getting that back out on the other side.

74
00:02:23,400 --> 00:02:24,930
To conduct this demonstration,

75
00:02:24,930 --> 00:02:27,540
we're going to load a steganography program up

76
00:02:27,540 --> 00:02:29,070
inside our web browser.

77
00:02:29,070 --> 00:02:30,960
You can try this at home if you want to.

78
00:02:30,960 --> 00:02:33,330
All you have to do is go to this website

79
00:02:33,330 --> 00:02:34,809
as you see on the screen,

80
00:02:34,809 --> 00:02:39,720
stylesuxx.github.io/steganography/

81
00:02:39,720 --> 00:02:40,830
and hit enter.

82
00:02:40,830 --> 00:02:41,880
When you get to the screen,

83
00:02:41,880 --> 00:02:44,040
you're going to be asked to choose a file.

84
00:02:44,040 --> 00:02:46,200
So I'm going to go ahead and choose a file off my desktop

85
00:02:46,200 --> 00:02:49,920
which is my logo, DionTraining.png,

86
00:02:49,920 --> 00:02:50,910
and then you're going to type in

87
00:02:50,910 --> 00:02:52,800
whatever the message is you want to hide.

88
00:02:52,800 --> 00:02:57,800
This is a secret message for my students only.

89
00:02:59,700 --> 00:03:01,230
Steganography is fun.

90
00:03:01,230 --> 00:03:03,570
Okay, so we're going to go ahead and hit encode.

91
00:03:03,570 --> 00:03:04,403
And when you do that,

92
00:03:04,403 --> 00:03:05,760
you'll see what your binary representation

93
00:03:05,760 --> 00:03:07,997
of your message is, you'll see the original you had,

94
00:03:07,997 --> 00:03:10,650
you'll see the normalized version of it.

95
00:03:10,650 --> 00:03:12,840
And notice these logos all look the exact same

96
00:03:12,840 --> 00:03:15,120
and then you'll have the hidden message version.

97
00:03:15,120 --> 00:03:16,587
If you right click that and save it,

98
00:03:16,587 --> 00:03:18,360
you can go ahead and save it to your desktop

99
00:03:18,360 --> 00:03:20,560
And I'm going to do it as a DionTrainingMessage

100
00:03:21,751 --> 00:03:24,450
and you'll see it there on my desktop.

101
00:03:24,450 --> 00:03:27,699
Now, if I look at these two files side by side,

102
00:03:27,699 --> 00:03:30,870
we'll have the Dion Training one up here

103
00:03:30,870 --> 00:03:34,050
and the hidden-message one right here.

104
00:03:34,050 --> 00:03:36,810
They look identical in every way, don't they?

105
00:03:36,810 --> 00:03:39,060
And so if we go ahead and close these,

106
00:03:39,060 --> 00:03:41,850
we can actually look at the file size of them.

107
00:03:41,850 --> 00:03:46,557
And so here we have the one on the left here.

108
00:03:46,557 --> 00:03:49,560
Or excuse me, the one on the left is DionTraining.png,

109
00:03:49,560 --> 00:03:51,180
which is the original

110
00:03:51,180 --> 00:03:53,760
and you can see the file size or the dimensions of it

111
00:03:53,760 --> 00:03:55,890
are the exact same as the new one.

112
00:03:55,890 --> 00:03:57,450
We haven't changed that at all.

113
00:03:57,450 --> 00:03:59,970
But we did change the file size

114
00:03:59,970 --> 00:04:04,050
and we went from 74 kilobits down to 57 kilobits.

115
00:04:04,050 --> 00:04:07,050
Why, if we put more information, did the file size shrink?

116
00:04:07,050 --> 00:04:08,880
Well, it's because the way they re encoded it

117
00:04:08,880 --> 00:04:11,190
to make sure the images looked exactly right

118
00:04:11,190 --> 00:04:12,540
in the compression they used.

119
00:04:12,540 --> 00:04:14,760
Sometimes the file size will get bigger as well

120
00:04:14,760 --> 00:04:16,170
but it is very infrequent

121
00:04:16,170 --> 00:04:18,060
that you'll see the same file size.

122
00:04:18,060 --> 00:04:19,050
So this may be one way

123
00:04:19,050 --> 00:04:21,240
that we know the file has been changed.

124
00:04:21,240 --> 00:04:23,670
Now, if we want to see the actual message inside of it,

125
00:04:23,670 --> 00:04:25,380
let's go over here to Decode

126
00:04:25,380 --> 00:04:27,450
and let's go ahead and choose the original file,

127
00:04:27,450 --> 00:04:28,560
and if we hit decode,

128
00:04:28,560 --> 00:04:32,280
you'll see that there is no message inside that one.

129
00:04:32,280 --> 00:04:34,260
See, there was no hidden message, it came out garbage

130
00:04:34,260 --> 00:04:36,270
because there was no hidden message.

131
00:04:36,270 --> 00:04:40,350
But if I choose the one that we hid the message inside of,

132
00:04:40,350 --> 00:04:42,660
we hit Open and hit Decode,

133
00:04:42,660 --> 00:04:44,827
you'll see that our hidden message comes right back.

134
00:04:44,827 --> 00:04:46,770
"This is a secret message for my students only.

135
00:04:46,770 --> 00:04:48,360
Steganography is fun."

136
00:04:48,360 --> 00:04:50,220
And so if you want to play with this, you can.

137
00:04:50,220 --> 00:04:52,110
You can go through and do some of this

138
00:04:52,110 --> 00:04:52,943
and send it to your friends

139
00:04:52,943 --> 00:04:54,780
and have them send you messages back.

140
00:04:54,780 --> 00:04:57,390
But remember, the information isn't encrypted

141
00:04:57,390 --> 00:04:58,890
when you're doing this steganography.

142
00:04:58,890 --> 00:05:00,630
You're hiding it in plain sight.

143
00:05:00,630 --> 00:05:03,900
So if I actually decided to open up DionTrainingMessage.png,

144
00:05:03,900 --> 00:05:05,880
the one that has this hidden message in it

145
00:05:05,880 --> 00:05:07,620
inside of a hexinator,

146
00:05:07,620 --> 00:05:11,280
you could actually find that message hidden inside of it

147
00:05:11,280 --> 00:05:13,230
but it is not true encryption.

148
00:05:13,230 --> 00:05:15,210
Second, we have tokenization.

149
00:05:15,210 --> 00:05:17,520
Now, tokenization is a transformative technique

150
00:05:17,520 --> 00:05:18,660
in data protection

151
00:05:18,660 --> 00:05:20,820
that involves substituting sensitive data elements

152
00:05:20,820 --> 00:05:23,340
with nonsensitive equivalents called tokens

153
00:05:23,340 --> 00:05:25,110
which have no meaningful value.

154
00:05:25,110 --> 00:05:27,270
The real data is securely stored elsewhere

155
00:05:27,270 --> 00:05:29,460
and only specific systems can map the tokens

156
00:05:29,460 --> 00:05:31,350
back to the original values.

157
00:05:31,350 --> 00:05:33,330
For example, when you use your credit card

158
00:05:33,330 --> 00:05:34,380
at the local store,

159
00:05:34,380 --> 00:05:35,580
your merchant doesn't actually

160
00:05:35,580 --> 00:05:37,710
store your credit card details, but instead,

161
00:05:37,710 --> 00:05:40,680
they store a tokenized version of your credit card details.

162
00:05:40,680 --> 00:05:42,480
So using tokenization,

163
00:05:42,480 --> 00:05:45,000
once that credit card number is entered into the system,

164
00:05:45,000 --> 00:05:47,190
it's going to be replaced with a random string of characters

165
00:05:47,190 --> 00:05:48,630
called the token.

166
00:05:48,630 --> 00:05:51,480
This token can then be used for certain internal processes

167
00:05:51,480 --> 00:05:54,060
without exposing the actual credit card number.

168
00:05:54,060 --> 00:05:55,440
If a data breach occurs,

169
00:05:55,440 --> 00:05:57,750
hackers are only going to find that useless token,

170
00:05:57,750 --> 00:05:59,520
not the actual credit card numbers

171
00:05:59,520 --> 00:06:01,080
because those actual credit card numbers

172
00:06:01,080 --> 00:06:03,690
remain safe in a separately secured vault.

173
00:06:03,690 --> 00:06:05,070
This idea of tokenization

174
00:06:05,070 --> 00:06:06,930
is commonly used in payment systems

175
00:06:06,930 --> 00:06:08,520
to help reduce the scope of compliance

176
00:06:08,520 --> 00:06:11,430
with standards like PCI DSS, and they also offer us

177
00:06:11,430 --> 00:06:14,820
a balanced approach to data security and usability.

178
00:06:14,820 --> 00:06:16,620
Third, we have data masking.

179
00:06:16,620 --> 00:06:18,450
Data masking is used to protect our data

180
00:06:18,450 --> 00:06:20,160
by ensuring that it remains recognizable

181
00:06:20,160 --> 00:06:22,920
but does not actually include sensitive information.

182
00:06:22,920 --> 00:06:25,680
Data masking, also known as data obfuscation

183
00:06:25,680 --> 00:06:28,050
is the process of disguising original data

184
00:06:28,050 --> 00:06:29,460
to protect sensitive information

185
00:06:29,460 --> 00:06:32,820
while maintaining the data's authenticity and usability.

186
00:06:32,820 --> 00:06:34,740
For example, let's pretend that you're working

187
00:06:34,740 --> 00:06:36,270
for a software development company

188
00:06:36,270 --> 00:06:38,190
that wants to test out new features.

189
00:06:38,190 --> 00:06:40,380
Developers need realistic data to work with

190
00:06:40,380 --> 00:06:42,240
but using actual customer information

191
00:06:42,240 --> 00:06:44,760
in a testing environment can be pretty risky.

192
00:06:44,760 --> 00:06:47,190
So instead, they're going to use data masking

193
00:06:47,190 --> 00:06:49,170
to replace the company's real customer names

194
00:06:49,170 --> 00:06:51,540
with fictional but realistic-sounding ones

195
00:06:51,540 --> 00:06:54,630
or their customer addresses might be altered slightly

196
00:06:54,630 --> 00:06:56,640
so they don't point to real locations.

197
00:06:56,640 --> 00:06:58,770
This way, the data looks and feels right

198
00:06:58,770 --> 00:07:00,000
for testing purposes,

199
00:07:00,000 --> 00:07:03,300
but it doesn't actually expose any genuine information.

200
00:07:03,300 --> 00:07:05,580
By creating a sanitized version of their data sets,

201
00:07:05,580 --> 00:07:07,770
businesses are able to reduce the risk of a data breach

202
00:07:07,770 --> 00:07:09,630
in non-production environments.

203
00:07:09,630 --> 00:07:11,640
Now, data masking is also really prevalent

204
00:07:11,640 --> 00:07:14,550
in industries that handle vast amounts of personal data.

205
00:07:14,550 --> 00:07:16,020
Another use of data masking

206
00:07:16,020 --> 00:07:17,490
would involve hiding sensitive details

207
00:07:17,490 --> 00:07:19,410
from your own company's employees.

208
00:07:19,410 --> 00:07:22,110
For example, if you contact our student support team

209
00:07:22,110 --> 00:07:24,450
to ask them about an exam voucher you purchased.

210
00:07:24,450 --> 00:07:27,180
they can look up your name and your email to identify you

211
00:07:27,180 --> 00:07:29,340
and then they may ask for the last four digits

212
00:07:29,340 --> 00:07:31,710
of your credit card that you used to make that purchase.

213
00:07:31,710 --> 00:07:33,450
This is because our systems are designed

214
00:07:33,450 --> 00:07:35,460
so that the first 12 digits of the credit card

215
00:07:35,460 --> 00:07:38,070
are going to be masked so our employees can't see it.

216
00:07:38,070 --> 00:07:40,590
Instead, they can only read the last four digits

217
00:07:40,590 --> 00:07:42,720
as a way to identify the payment method that you used

218
00:07:42,720 --> 00:07:44,310
when you bought our products.

219
00:07:44,310 --> 00:07:46,350
Similarly, many doctor's offices

220
00:07:46,350 --> 00:07:47,700
will mask the first five digits

221
00:07:47,700 --> 00:07:49,470
of your nine-digit social security number

222
00:07:49,470 --> 00:07:50,640
here in the United States,

223
00:07:50,640 --> 00:07:53,280
and they'll identify you using just the last four digits

224
00:07:53,280 --> 00:07:54,990
of your social security number.

225
00:07:54,990 --> 00:07:57,060
So remember, obfuscation techniques

226
00:07:57,060 --> 00:07:59,880
like steganography, tokenization and data masking

227
00:07:59,880 --> 00:08:03,030
are all invaluable tools in the data security toolkit.

228
00:08:03,030 --> 00:08:05,700
Steganography is the practice of hiding secret data

229
00:08:05,700 --> 00:08:08,550
within an ordinary non-secret file or message

230
00:08:08,550 --> 00:08:10,410
to avoid detection and to ensure

231
00:08:10,410 --> 00:08:13,470
the very existence of that message remains concealed.

232
00:08:13,470 --> 00:08:15,030
Tokenization is going to involve

233
00:08:15,030 --> 00:08:16,710
substituting sensitive data elements

234
00:08:16,710 --> 00:08:19,620
with nonsensitive data equivalents called tokens

235
00:08:19,620 --> 00:08:22,260
which have no intrinsic or exploitable meaning.

236
00:08:22,260 --> 00:08:24,450
Data masking or data obfuscation

237
00:08:24,450 --> 00:08:26,520
is the process of disguising original data

238
00:08:26,520 --> 00:08:28,080
to protect sensitive information

239
00:08:28,080 --> 00:08:30,600
while maintaining its authenticity and usability

240
00:08:30,600 --> 00:08:32,309
for a specific purpose.

241
00:08:32,309 --> 00:08:34,080
And these all operate under the principle

242
00:08:34,080 --> 00:08:35,520
of hiding information,

243
00:08:35,520 --> 00:08:37,230
either by embedding it within something else,

244
00:08:37,230 --> 00:08:38,580
using steganography,

245
00:08:38,580 --> 00:08:40,860
replacing it with tokens, with tokenization,

246
00:08:40,860 --> 00:08:42,870
or altering it to protect the genuine data

247
00:08:42,870 --> 00:08:44,400
using data masking.

248
00:08:44,400 --> 00:08:46,247
By understanding and implementing these techniques,

249
00:08:46,247 --> 00:08:48,930
organizations can ensure that they're one step ahead

250
00:08:48,930 --> 00:08:51,270
in the ever-evolving game of data security

251
00:08:51,270 --> 00:08:52,560
by using data obscurity

252
00:08:52,560 --> 00:08:55,053
to shield their sensitive data from prying eyes.