You're sharing sensitive biotech data with external partners. How do you safeguard its confidentiality?

Sharing sensitive biotech data and other sensitive information with external partners should be safeguarded. Its confidentiality can be protected by encryption, tokenization or potentially homomorphic encryption (HE) depending on different use cases. HE can be very slow and require very special development skills.

Homomorphic encryption, and other types of encryption are becoming more critical to think about seriously. While it has always been fashionable to talk about the death of this or that suite of techniques or ciphers, it is a very real threat. And one of the more frightening aspects is when an implementation of what is considered a sound set of techniques is compromised, the post mortems or scoping of how far the problem spread becomes exponentially more difficult. Future proofing techniques and ciphers, auditing, and layers of monitoring are absolutely critical to the threats we will be facing soon.

Be aware, when using protocols that employ cipher suite handshakes, of downgrade attacks. These are very real, often overlooked, and generally straightforward to mitigate. Second, depending on the cipher, follow standards for key custodians and key ceremonies. Again, these procedures may add a little pain, but an ounce of prevention as they say. And your keys are only as good as your IAM, key management, revocation procedures, auditing, and most crucially *actually inspecting the outputs from those controls*

Check with your IT department to ensure all ISO standards are met before you decide to pick a platform; meetings should take place before any decision is made.

Physical/IT security personnel need to work together to insure that checks are put in place that cover both internal/external breaches; HR needs to have a checklist of items to be turned over if the employee leaves or is fired.

This is a multifaceted issue. And several lenses must be used when evaluating this kind of situation. Regulatory, physical, patient data/PII, storage, transit, auditability, and accountability. Given the nature of this data, while it is quite broad, a first pass on how HIPAA guidelines, NIST controls, and ISO controls should be performed. Break down into strategies, tactics, and tasks, and verify you are following the spirit and letter of the regs. Eliminate single points of failure or single points of 'corruption', internalize the mantra Trust but Verify, recognize that most issues aren't malicious but accidents or myopia occurs all the time, and keep your human and technical actors/controls honest and transparent.