Protecting sensitive data in DynamoDB with searchable encryption

🛠️ Try out the demo on GitHub.

As architects, data security is a non-negotiable attribute of our solution designs. The traditional go-to technique to protect data is to build layers of controls around sensitive data. But there is always a constraint: sensitive data must be stored in plaintext.

What if we could encrypt it and perform range, match, and unique queries without ever decrypting it? This would allow us to exceed the design principles of the Security Pillar and protect data in transit, at rest, and in-use.

In this talk you will learn

• Why traditional encryption doesn’t give you the security outcomes you think it does
• What searchable encryption is, and how it works in DynamoDB (and PostgreSQL)
• How to use unique keys for every value you encrypt, while keeping your workloads fast and reliable

Transcript

1. Protecting sensitive data in DynamoDB with searchable encryption Lindsay Holmwood Chief Product & Technology Officer, CipherStash
2. 👋 I’m Lindsay
3. 🙋 Who has been exposed in a data breach in the last 12 months?
4. Why do data breaches happen?
5. Source: IBM Cost of a Data Breach Report 2025
6. What protections do we use to control this risk?
7. Source: AWS Well-Architected security definition
8. What this looks like in practice: Build layers of controls around sensitive data
9. What this looks like in practice: Access controls for humans and machines Testing and training Detection and incident response Encryption
10. What does encryption look like?
11. 🛌 Encryption at rest Encrypt bytes on the disk Stops attackers pulling a drive out of a server
12. 🛌 Encryption at rest In AWS: Some guarantees that your data will be serialised to shared storage with a key you control
13. 🛌 Encryption at rest But: for data to be usable in compute, it must be decrypted
14. 🕳️ Encryption in transit
15. 🕳️ Encryption in transit Protected tunnel between systems Data is still transmitted in plaintext over the tunnel Stops Manipulator-In-The-Middle attacks and passive collection
16. 🕳️ Encryption in transit & 🛌 Encryption at rest: Both give some protections, but they have limitations
17. We don’t keep data encrypted all the time because we lose the ability to use it
18. How are you meant to query this?
19. There is another type of encryption: Encryption in use
20. 🏎️ Encryption in use Keep the data encrypted at all times Perform operations on that data Without revealing the contents of that data
21. 🏎️ Encryption in use Isn’t this just homomorphic encryption? No. There are searchable encryption schemes that are fast and usable today
22. 🏎️ Encryption in use Not just exact match (ciphertext == ciphertext)
23. 🏎️ Encryption in use Supported operations: Range Match Exact Ordering Limits
24. 🏎️ Encryption in use It’s possible to use those encryption schemes in existing databases.
25. How does searchable encryption work?
26. cipher key plaintext ciphertext How all encryption works
27. cipher ciphertext (value) ciphertext (index) cipher key How searchable encryption works plaintext
28. input encrypted terms How searchable encryption works return encrypted value search encrypted index Client-side encryption: database never sees plaintext
29. cipher ciphertext (value) ciphertext (index) cipher key How searchable encryption works plaintext Different search operations require different index types
30. Searchable encryption schemes: Order Revealing Encryption (range) Structured Encryption (exact) Encrypted Bloom Filters (match)
31. You can do this now with DynamoDB and PostgreSQL
32. Demo: Searchable encryption with DynamoDB
33. Parting thoughts
34. Why use searchable encryption? 3 reasons: You need it to unlock sales to bigger orgs You are being forced to by a regulator You believe it’s the right thing to do
35. Why use searchable encryption? Meet and exceed the standard set by the Well-Architected Security pillar
36. What questions do you have? Demo: /cipherstash/well-architected-syd lindsay@cipherstash.com