Author: christopherskinner4136

Using distributed ledger and a unique rules engine we can enable ‘need to know’ security with no gap between policy and technology enforcement.

We recognize that some organizations have well developed ‘need to know’ policies when it comes to sensitive data, especially when dealing with national security, defense or law enforcement. We also know that despite these policies, data continues to fall into the hands of hostile actors.

Why?

The simple reason is that these adversaries have a strong ‘want to know’ and can leverage multiple ways to attack the gap between organizational policy and it’s real world enforcement. Poorly implemented compensating controls, human error, software vulnerabilities, defects, and persistent attacks are just a few.

That’s why we think the ability to close that gap is a game changer and will transform how we think about security.

If securing sensitive data is an area of concern for you I’d be happy to provide a personal briefing, send more intel on the topic (in either an unclassified or classified setting).

Using distributed ledger and a unique rules engine we can enable ‘need to know’ security with no gap between policy and the actual technology enforcement.

We recognize that all organizations have well developed ‘need to know’ policies when it comes to extremely sensitive data, especially when dealing with national security or law enforcement. We also know that despite these policies data continues to fall into the hands of hostile actors.

The primary reason is that these adversaries have multiple ways to attack the gap between organizational policy and its real-world enforcement. Poorly implemented compensating controls, human error, software vulnerabilities and insider threats are just a few examples.

That’s why we think the ability to close that gap is a game changer and will transform how we think about security.

If securing sensitive data is an area of concern for you I’d be happy to provide a briefing.

SpiderOak’s Authority Engine is a flexible technology that can be plugged into any environment where organizations need certainty over how data can be accessed.

Software & hardware defects, malware and compromised networks all lead to attackers gaining authority they shouldn’t have. System and network administrators are given authority they don’t need. SpiderOak’s authority engine removes the ability for attackers and administrators from attaining the authority they need to compromise your data.

Understand the problem that organizations face across the board is authority ( give it to the wrong people and you have a problem). The solution is to better manage authority. That has a higher value than all cybersecurity spending. It’s like finding a bug in design versus trying to fix it in production. We want organizations to realize that being held back operationally by security concerns is slowing the mission.

When policy can be executed by technology — few examples exist. SpiderOak technology allows organizations to match policy to technology.

1. Public keys are the basis for identity.
2. Distributed ledgers are the best way to define and maintain roles and permissions.
3. Once an actor has public keys and a clear set of roles/permissions, it is easy to distribute shared keys enabling secure communication and storage.

SpiderOak has developed technology that allows for the instant provisioning of cryptographically secure collaboration spaces for use in scenarios where certainty about who has access to that space is a mission requirement.

Cryptographic segmentation based on secure private blockchain technology, utilizing FIPS 140–2 encryption, is used to enforce strong assurances of confidentiality, integrity, immutability, and authority.

Authority — Who can do what with the data in question.

Identity — To be able to understand authority, you then need to have a grasp on identity. You can’t apply rules on authority if you don’t know to whom they’re being applied.

Confidentiality — The primary use of authority is to control access to data. If your system doesn’t handle keeping data confidential, all the rules in the world can’t help you.

Integrity — You need to make sure that rules in the system don’t get modified by malicious actors, or even the data itself getting corrupted or modified.

Availability — Data is going to be there when you need it.

A security model based on a Distributed approach, by it’s very nature, enforces better data security while also reducing the risk of security breaches and compromised data.

This is represented in the graphic here. The traditional, Centralized approach allows IT services and staff to manage all aspects of the access to your data when all they are truly responsible for is the Availability of the IT infrastructure — typically meaning the uptime of the server. A Distributed approach, however, enforces a separation of the IT activity from the cryptographic activity of keeping your data secure.

To improve our overall security posture, our end goal has to be to reduce the complexity of our security approach and to place trust only where it absolutely has to be placed. A Distributed approach provides the technical tools to properly secure and manage the Authority, Identity, and Integrity/Confidentiality layers of the model.

The job of infrastructure is to provide availability, additionally, authority is misassigned and should be removed to decrease attack surface.

Cryptography allows us to minimize trust to only the components which have a mission need for it.

1.Distributed ledgers are the best way for Organizations to define and maintain roles and permissions, a.k.a. Authority.

2.Public keys are the best basis for Identity.

3.Public keys paired with a clear set of roles & permissions enable instant provisioning of secure, cryptographically enforced compartments for data storage and communications.

SpiderOak has developed technology that allows for the instant provisioning of cryptographically secure collaboration spaces for use in scenarios where certainty about who has access to that space is a mission requirement.

Cryptographic segmentation based on secure private blockchain technology, utilizing FIPS 140–2 encryption, is used to enforce strong assurances of confidentiality, integrity, immutability, and authority.