Cybersecurity has traditionally invested heavily in keeping attackers out. Firewalls, identity controls, endpoint protection, phishing detection and employee awareness programmes all seek, in different ways, to stop an adversary before access is obtained.
Yet social engineering exposes a difficult weakness in that model. An attacker does not necessarily need to defeat the technology if a legitimate employee can be persuaded to provide the information, approve access or perform an action on the attacker’s behalf.
The problem is becoming more difficult as artificial intelligence makes deceptive communications increasingly convincing. Recent Digital Journal reporting has examined how AI can give criminals greater capacity to collect information about targets and create more personalised social-engineering attacks. Digital Journal has also reported that AI is enabling cyber threats to operate at greater scale, including phishing and other forms of malicious activity.
Against this backdrop, Karim Eldefrawy, PhD, Co-Founder and CTO of Confidencial, argues that organisations need to reconsider where their final defensive boundary lies. Rather than assuming every deceptive request can be recognised, security architecture should limit what happens when one succeeds. This means bringing protection closer to the information itself.
Employee education continues to play an important role in cybersecurity. Yet expecting everybody to identify every credible-looking approach places considerable weight on one control: human judgement. That becomes particularly problematic as impersonation improves. Recent examples of AI-enabled voice phishing have demonstrated the growing challenge of establishing whether apparently familiar communications can be trusted. Digital Journal has previously examined how synthetic voices are creating new problems for identity verification.
Eldefrawy tells Digital Journal that security consequently needs to be built around the possibility of human error: “Organizations should design their cybersecurity approach for the possibility that social engineering may succeed,” he explains.
“Employee training and awareness remains useful, but the confidentiality of sensitive information should not depend on every person recognizing every convincing request. A human mistake should encounter additional technical controls before it becomes a material data disclosure.” The distinction is important. Awareness training tries to reduce the probability that somebody makes a mistake. Data-centric protection seeks to limit the consequences when somebody nevertheless does.
Making possession different from permission
According to Eldefrawy, defence-in-depth needs to extend to the information being protected. “Encryption can protect sensitive sections within documents, while recipient-specific authorization governs who can decrypt them,” he says. “When a protected file is misdirected, copied, or stolen, possession of that file need not expose its protected contents.”
This introduces a valuable cybersecurity principle: possessing a document does not necessarily need to mean possessing all the information contained within it.
Traditional file security can become vulnerable when data leaves the environment in which the controls are being applied. A document can be downloaded, emailed, duplicated or otherwise transferred. A data-centric model instead seeks to make appropriate protection persist with the information.
This concept complements the broader move towards assuming that apparently legitimate access should not automatically be trusted. The https://www.cisa.gov/zero-trust-maturity-model, for example, describes zero trust through five pillars, including identity and data, with visibility, analytics, automation and orchestration cutting across them.
For particularly sensitive records, the implication is that organisations should think beyond deciding whether a person is entitled to open a file.
“Access to a document, authority to decrypt particular information, and permission to share it with someone else should be separately controlled,” Eldefrawy explains.
Encryption is not a magic shield
There is, however, an important limitation. Encryption only offers meaningful additional defence when the mechanisms controlling decryption are themselves adequately protected. “The critical requirement is that these controls remain effective under the compromise being considered,” Eldefrawy warns.
“If a stolen session also grants unrestricted decryption or permission to add recipients, encryption alone will not contain the attack.”
That qualification matters for security architecture. Adding encryption without considering what an attacker can do with a compromised legitimate account can simply move the weak point elsewhere.
Eldefrawy argues that organisations instead require “narrowly scoped access, additional checks for sensitive disclosures, and the ability to suspend future decryption when misuse is detected.”
In other words, defence-in-depth should not consist simply of accumulating security products. The layers have to retain some independence. If compromising one credential simultaneously defeats authentication, authorisation and data protection, the apparent depth of the defence may be greater than its practical resilience.
This has growing relevance because sophisticated attacks increasingly focus upon trusted identities and human behaviour. As Digital Journal reported during Cybersecurity Awareness Month, security specialists are increasingly emphasising resilience and the testing of defensive assumptions rather than relying on awareness programmes alone.
None of this eliminates phishing or social engineering. Nor can cryptography undo every disclosure that has already occurred. Instead, data-centric protection changes the objective. Once preventative controls have failed, the question becomes: how much useful information can the attacker actually obtain?
“This is what securing at the core contributes to defense-in-depth: reducing how much sensitive information an attacker can actually read and use after other outer defenses fail,” Eldefrawy says.
Protection, he adds, can remain with encrypted information beyond its original repository. There is nevertheless a fundamental boundary: “plaintext already disclosed cannot be cryptographically recalled.” That is perhaps the most useful way of viewing the development. Data security should not be presented as an alternative to identity protection, awareness training, endpoint security or monitoring. It supplies another layer beneath them.
The security perimeter, in effect, is becoming smaller. First the organisation was the protected boundary; subsequently the network, device and identity became important boundaries. The next logical step is the information itself.
As social engineering becomes harder to distinguish from legitimate communication, that shift offers organisations a different way of approaching cyber resilience. The goal is no longer simply to ensure that nobody ever makes a mistake. It is to design systems in which one convincing deception does not automatically expose everything the victim was trusted to see.
