Ride the Lightning

Cybersecurity and Future of Law Practice Blog
by Sharon D. Nelson Esq., President of Sensei Enterprises, Inc.

Boeing's "Shred and Scatter" Methodology Allows Public Cloud Usage

April 7, 2014

According to an ars technica post, Boeing has started rewriting applications to outsource its heaviest processing needs to Amazon Web Services and Microsoft Azure.

Boeing, which has more than 170,000 employees and $86 billion in annual revenue, moved a dozen or so applications to the cloud last year and expects to triple that number this year. In most cases, it is making wholesale switches from on-premises applications to the cloud, for example using software-as-a-service for human resources and travel services. However, there are some applications that have greater security requirements.

One is a market analysis tool that analyzes all flights around the world, estimating how many passengers choose each available flight in a market. Boeing uses this data to convince its airline customers to buy new planes. While public flight data isn’t sensitive, the airlines also share their confidential plans, which Boeing clearly has to protect. Boeing has its own algorithms to analyze this data, and the company wanted to take advantage of Microsoft Azure's cloud-based processing power that can be scaled up and down as needed.

To do this securely, Boeing uses the “shred and scatter” method, which splits the calculations up into many parts which cannot be pieced back together in any comprehensible way.

David Nelson, Boeing's chief strategist for cloud computing said that with the data “running inside our SQL Server databases, we would shred it and scatter it and send it out to all these Azure nodes, and they would do the individual processing." He likened this to a puzzle where all the pieces are scattered and flipped over to reveal only the gray side. If a hacker got into Boeing’s Azure network, they would only see the back side of a puzzle piece.

“If you pick up one piece of that puzzle, how much of the picture can you put back together? That’s kind of the technology and the idea around shred and scatter, and you have encryption all along the path,” he said. "Data is distributed so wide that even if 100 streams were intercepted it would be useless." After processing, the data is brought back in-house and the "puzzle" is pieced back together.

Fascinating stuff – and a great way to harness the power of cloud computing securely (good luck putting these puzzles together NSA!).