> Markdown version of [/videos/574-this-machine-ends-data-breaches](https://www.wearedevelopers.com/videos/574-this-machine-ends-data-breaches). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# This Machine Ends Data Breaches

Your encrypted data is completely vulnerable the second it enters a CPU cache. Learn how Trusted Execution Environments cryptographically isolate active memory to definitively end runtime breaches.

- **Speakers:** Liz Moy
- **Event:** WeAreDevelopers LIVE
- **Published:** April 27, 2023
- **Duration:** 59:34
- **URL:** https://www.wearedevelopers.com/videos/574-this-machine-ends-data-breaches

## Summary

While data at rest and in transit are routinely encrypted, "data in use" within memory or CPU caches remains highly vulnerable to breaches. Confidential computing addresses this critical gap through Trusted Execution Environments (TEEs)—secure, hardware-isolated enclaves that prevent unauthorized access from host operating systems, external infrastructure, or even system administrators. By ensuring that decryption keys are only accessible to authorized application code, TEEs establish a robust layer of memory isolation. This hardened environment protects highly sensitive assets, such as personally identifiable information (PII), session keys, and proprietary machine learning algorithms, while they are being actively processed.

The technical foundation of this architecture relies heavily on attestation, a cryptographic verification process that acts like a rigorous background check for your hardware and software container. Because blind trust is insufficient in modern security, developers must use attestation to mathematically prove a system is untampered before feeding any encrypted data into the enclave. Major vendors have significantly democratized this workflow, evolving TEEs from highly specialized hardware challenges into accessible developer tools. Engineers can now lift and shift standard Docker containers directly into AWS Nitro Enclaves, run AI workloads on Nvidia Hopper architecture, or leverage abstraction services to handle complex key management and platform configuration registers (PCRs) seamlessly.

The practical applications of enclaves extend far beyond basic data masking, unlocking zero-trust multi-party collaboration where competing entities can train models on shared datasets without ever exposing the underlying raw data. Despite its immense potential to mitigate systemic data breaches, confidential computing requires strategic implementation. Teams must navigate performance tradeoffs, compute latency, cloud cost overheads, and hardware-level side-channel attack vulnerabilities. Ultimately, while TEEs are not a magic bullet against incorrect application logic, their integration into standard development lifecycles marks a fundamental evolution toward ubiquitous, cryptographically guaranteed runtime privacy.

**Keywords:** trusted execution environments, confidential computing, data in use encryption, cryptographic attestation, aws nitro enclaves, memory isolation security, trusted platform module, hardware enclave deployment, multi-party collaboration, secure machine learning inference, pii tokenization, hardware side-channel risks, intel sgx, encryption key management, zero-trust infrastructure

## Chapters

1. **The reality of continuous data breaches in modern tech** (00:03) — How relentless cyberattacks expose unencrypted enterprise records requiring hardware-level data isolation.
1. **Defining trusted execution environments and confidential computing** (02:42) — Utilizing embedded keys within restricted execution modules guarantees unauthorized entities cannot extract data.
1. **Protecting vulnerable data residing in system memory** (05:41) — Why memory isolation prevents vulnerability exploitations occurring while systems compute unencrypted active queries.
1. **Establishing trustworthiness through hardware verification protocols** (08:50) — How generating remote attestations formally guarantees computing environments remain unmodified before execution begins.
1. **Understanding the background check model for attestation** (13:45) — Relaying background verification evidence across authenticated providers eliminates blind trust models securing remote environments.
1. **Deep dive into AWS Nitro enclaves workflow** (17:51) — Unpacking containerized documentation pipelines decrypts data exclusively when distinct platform measurements correspond securely.
1. **Hardware architectures and developer tooling for enclaves** (21:01) — Evaluating diverse vendor architectures ensures abstracted application workloads deploy across agnostic container orchestrators securely.
1. **Practical use cases for confidential computing workloads** (28:52) — Why routing high-risk datasets through encapsulated environments unlocks distributed processing without jeopardizing regulatory workflows.
1. **Demonstrating secure medical imaging and lending pipelines** (33:58) — Triggering continuous verifications across encapsulated applications evaluates sensitive inputs securely without compromising transparent configurations.
1. **Navigating challenges and limitations in enclave adoption** (39:31) — How understanding side-channel vulnerabilities offsets misconfigured implementations protecting overall execution overhead across isolated resources.
1. **Blending trusted hardware with future security strategies** (43:43) — Merging differential privacy models alongside isolated environments fortifies development practices establishing reliable data isolation.
1. **Question and answer on security paradigms and developer workflows** (46:01) — Navigating automated code generation capabilities informs scalable cryptographic practices ensuring robust modern engineering architectures.

## Related Moments

- [Hardware-based trusted execution environments for confidential computing](https://www.wearedevelopers.com/videos/100129-building-securing-and-governing-ai-infrastructure-in-the-era-of-agentic-ai) (from "Building, securing and governing AI infrastructure in the Era of Agentic AI")
- [Securing data in use with confidential cloud computing](https://www.wearedevelopers.com/videos/100108-building-sovereign-ai-lessons-from-deploying-secure-rag-systems-using-confidential-computing) (from "Building Sovereign AI: Lessons from Deploying Secure RAG Systems using Confidential Computing")
- [Utilizing trusted execution environments for data protection](https://www.wearedevelopers.com/videos/100013-building-trust-through-private-and-verifiable-ai) (from "Building Trust Through Private and Verifiable AI")
- [Advancing confidential computing with open source multi-way collaboration](https://www.wearedevelopers.com/videos/1036-tiktok-s-privacy-innovation) (from "TikTok's Privacy Innovation")
- [Addressing availability, latency overheads, and hardware trust concerns](https://www.wearedevelopers.com/videos/100043-an-alternative-approach-to-digital-sovereignty-confidential-computing) (from "An alternative approach to digital sovereignty: Confidential Computing")
- [Creating trusted execution environments using specialized computing hardware](https://www.wearedevelopers.com/videos/100043-an-alternative-approach-to-digital-sovereignty-confidential-computing) (from "An alternative approach to digital sovereignty: Confidential Computing")

## Related Articles

- [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)

## Related Jobs

- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Staff Engineer, Security Engineering Partners](https://www.wearedevelopers.com/jobs/ext/1187268-staff-engineer-security-engineering-partners) at **Twilio**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Principal Software Engineer, Enterprise AI Platform](https://www.wearedevelopers.com/jobs/ext/1467292-principal-software-engineer-enterprise-ai-platform) at **GitHub**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Security Engineer](https://www.wearedevelopers.com/jobs/ext/1574416-security-engineer) at **Twilio**