In this lesson,
we're going to dive into the world of obfuscation.
Now, obscuring information
can sometimes be as crucial as encrypting it
and this is where steganography, tokenization
and data masking are going to come into play.
Let's take a moment to unpack
each of these techniques together
so we can get a clear picture
of the role within the world of data security.
First, we have steganography.
Now we often talk about steganography
and we think about it as the art of hidden writing.
Steganography is derived from the Greek words
meaning covered writing.
It's all about concealing a message
within another message
so that the very existence of that hidden message
is unknown.
Now, steganography is defined
as the practice of hiding secret data
within ordinary non-secret files or messages
to avoid detection.
Our primary goal here
isn't to prevent unauthorized access to the data,
but instead to prevent the suspicion
that there is any hidden data inside of it at all.
For example, if I post a digital picture of a cat
to my social media profile,
you may see it and just think that it's a picture
of a cute little kitty.
But in actuality, I could be using stenographic techniques
where I'm actually embedding a hidden message
within that cat picture.
By subtly changing the colors
of specific pixels inside of patterns,
which are really going to be indistinguishable
to your human eye,
that image can carry additional payloads
of hidden information.
When the recipient knows where to look
and has the right tools,
they can actually extract this hidden message
while adversaries will remain oblivious to the fact
that there was a hidden message
in the picture to begin with.
Now, steganography is frequently used alongside encryption
for an extra layer of security too.
While encryption announces there's something worth hiding,
steganography will hide it in plain sight
making detection itself a pretty big challenge
for us as cybersecurity professionals.
Let me give you a quick demonstration
of how scenography is used.
If you've ever seen an old spy movie
where one spy takes out a classified ad in the newspaper,
and the first letter of each word
makes up the secret message, something like, "Meet at six,"
This is a version of steganography,
note that data isn't going to be encrypted when you do this.
It's just going to be hidden inside another message.
And if you know what you're looking for,
then it's really easy to see the message
inside wherever it's being hidden.
So in the case of my newspaper example,
writing down the first letter of each word
gives you the secret message.
Now, basically, if anybody knows where to look,
they can easily pull that data back out.
So let's jump into the lab environment
and see how easy it is to hide some data
inside a standard photograph using a scenography tool,
and then getting that back out on the other side.
To conduct this demonstration,
we're going to load a steganography program up
inside our web browser.
You can try this at home if you want to.
All you have to do is go to this website
as you see on the screen,
stylesuxx.github.io/steganography/
and hit enter.
When you get to the screen,
you're going to be asked to choose a file.
So I'm going to go ahead and choose a file off my desktop
which is my logo, DionTraining.png,
and then you're going to type in
whatever the message is you want to hide.
This is a secret message for my students only.
Steganography is fun.
Okay, so we're going to go ahead and hit encode.
And when you do that,
you'll see what your binary representation
of your message is, you'll see the original you had,
you'll see the normalized version of it.
And notice these logos all look the exact same
and then you'll have the hidden message version.
If you right click that and save it,
you can go ahead and save it to your desktop
And I'm going to do it as a DionTrainingMessage
and you'll see it there on my desktop.
Now, if I look at these two files side by side,
we'll have the Dion Training one up here
and the hidden-message one right here.
They look identical in every way, don't they?
And so if we go ahead and close these,
we can actually look at the file size of them.
And so here we have the one on the left here.
Or excuse me, the one on the left is DionTraining.png,
which is the original
and you can see the file size or the dimensions of it
are the exact same as the new one.
We haven't changed that at all.
But we did change the file size
and we went from 74 kilobits down to 57 kilobits.
Why, if we put more information, did the file size shrink?
Well, it's because the way they re encoded it
to make sure the images looked exactly right
in the compression they used.
Sometimes the file size will get bigger as well
but it is very infrequent
that you'll see the same file size.
So this may be one way
that we know the file has been changed.
Now, if we want to see the actual message inside of it,
let's go over here to Decode
and let's go ahead and choose the original file,
and if we hit decode,
you'll see that there is no message inside that one.
See, there was no hidden message, it came out garbage
because there was no hidden message.
But if I choose the one that we hid the message inside of,
we hit Open and hit Decode,
you'll see that our hidden message comes right back.
"This is a secret message for my students only.
Steganography is fun."
And so if you want to play with this, you can.
You can go through and do some of this
and send it to your friends
and have them send you messages back.
But remember, the information isn't encrypted
when you're doing this steganography.
You're hiding it in plain sight.
So if I actually decided to open up DionTrainingMessage.png,
the one that has this hidden message in it
inside of a hexinator,
you could actually find that message hidden inside of it
but it is not true encryption.
Second, we have tokenization.
Now, tokenization is a transformative technique
in data protection
that involves substituting sensitive data elements
with nonsensitive equivalents called tokens
which have no meaningful value.
The real data is securely stored elsewhere
and only specific systems can map the tokens
back to the original values.
For example, when you use your credit card
at the local store,
your merchant doesn't actually
store your credit card details, but instead,
they store a tokenized version of your credit card details.
So using tokenization,
once that credit card number is entered into the system,
it's going to be replaced with a random string of characters
called the token.
This token can then be used for certain internal processes
without exposing the actual credit card number.
If a data breach occurs,
hackers are only going to find that useless token,
not the actual credit card numbers
because those actual credit card numbers
remain safe in a separately secured vault.
This idea of tokenization
is commonly used in payment systems
to help reduce the scope of compliance
with standards like PCI DSS, and they also offer us
a balanced approach to data security and usability.
Third, we have data masking.
Data masking is used to protect our data
by ensuring that it remains recognizable
but does not actually include sensitive information.
Data masking, also known as data obfuscation
is the process of disguising original data
to protect sensitive information
while maintaining the data's authenticity and usability.
For example, let's pretend that you're working
for a software development company
that wants to test out new features.
Developers need realistic data to work with
but using actual customer information
in a testing environment can be pretty risky.
So instead, they're going to use data masking
to replace the company's real customer names
with fictional but realistic-sounding ones
or their customer addresses might be altered slightly
so they don't point to real locations.
This way, the data looks and feels right
for testing purposes,
but it doesn't actually expose any genuine information.
By creating a sanitized version of their data sets,
businesses are able to reduce the risk of a data breach
in non-production environments.
Now, data masking is also really prevalent
in industries that handle vast amounts of personal data.
Another use of data masking
would involve hiding sensitive details
from your own company's employees.
For example, if you contact our student support team
to ask them about an exam voucher you purchased.
they can look up your name and your email to identify you
and then they may ask for the last four digits
of your credit card that you used to make that purchase.
This is because our systems are designed
so that the first 12 digits of the credit card
are going to be masked so our employees can't see it.
Instead, they can only read the last four digits
as a way to identify the payment method that you used
when you bought our products.
Similarly, many doctor's offices
will mask the first five digits
of your nine-digit social security number
here in the United States,
and they'll identify you using just the last four digits
of your social security number.
So remember, obfuscation techniques
like steganography, tokenization and data masking
are all invaluable tools in the data security toolkit.
Steganography is the practice of hiding secret data
within an ordinary non-secret file or message
to avoid detection and to ensure
the very existence of that message remains concealed.
Tokenization is going to involve
substituting sensitive data elements
with nonsensitive data equivalents called tokens
which have no intrinsic or exploitable meaning.
Data masking or data obfuscation
is the process of disguising original data
to protect sensitive information
while maintaining its authenticity and usability
for a specific purpose.
And these all operate under the principle
of hiding information,
either by embedding it within something else,
using steganography,
replacing it with tokens, with tokenization,
or altering it to protect the genuine data
using data masking.
By understanding and implementing these techniques,
organizations can ensure that they're one step ahead
in the ever-evolving game of data security
by using data obscurity
to shield their sensitive data from prying eyes.