Cloud Hosting

Dublin-based Evervault, a developer-focused security startup which sells encryption via API and is backed by a raft of big name investors including the likes of Sequoia, Kleiner Perkins and Index Ventures, is coming out of closed beta today announcing open access to its encryption engine.

The startup says some 3,000 developers are on its waitlist to kick the tyres of its encryption engine, which it calls E3.

Among dozens of companies in its closed preview are drone delivery firm Manna, fintech startup Okra and health tech company Vital. Evervault says its targeting its tools at developers at companies with a core business need to collect and process four types of data: identity & contact data; financial & transaction data; health & medical data; and intellectual property.

The first suite of products it offers on E3 are called Relay and Cages; the former providing a new way for developers to encrypt and decrypt data as it passes in and out of apps; the latter offering a secure method using trusted execution environments running on AWS to process encrypted data by isolating the code that processes plaintext data from the rest of the developer stack.

Evervault is the first company to get a product deployed on Amazon Web Services Nitro Enclaves, per founder Shane Curran.

Nitro Enclaves are basically environments where you can run code and prove that the code thats running in the data itself is the code that youre meant to be running, he tells TechCrunch.We were the first production deployment of a product on AWS Nitro Enclaves so in terms of the people actually taking that approach were the only ones.

It shouldnt be news to anyone to say that data breaches continue to be a serious problem online. And unfortunately its sloppy security practices by app makers or even a total lack of attention to securing user data thats frequently to blame when plaintext data leaks or is improperly accessed.

Evervaults fix for this unfortunate feature of the app ecosystem is to make it super simple for developers to bake in encryption via an API taking the strain of tasks like managing encryption keys. (Integrate Evervault in 5 minutes by changing a DNS record and including our SDK, is the developer-enticing pitch on its website.)

At the high level what were doing is were really focusing on getting companies from [a position of] not approaching security and privacy from any perspective at all up and running with encryption so that they can actually, at the very least, start to implement the controls, says Curran.

One of the biggest problems that companies have these days is they basically collect data and the data sort of gets sprawled across both their implementation and their test sets as well. The benefit of encryption is that you know exactly when data was accessed and how it was accessed. So it just gives people a platform to see whats happening with the data and start implementing those controls themselves.

With C-suite executives paying increasing mind to the need to properly secure data thanks to years of horrific data breach scandals (andbreach dj vu), and also because of updated data protection laws like Europes General Data Protection Regulation (GDPR) which has beefed up penalties for lax security and data misuse a growing number of startups are now pitching services that promise to deliver data privacy, touting tools they claim will protect data while still enabling developers to extract useful intel.

Evervaults website also deploys the term data privacy which it tells us it defines to mean that no unauthorized party has access to plaintext user/customer data; users/customers and authorized developers have full control over who has access to data (including when and for what purpose); and, plaintext data breaches are ended. (So encrypted data could, in theory, still leak but the point is the information would remain protected as a result of still being robustly encrypted.)

Among a number of techniques being commercialized by startups in this space is homomorphic encryption a process that allows for analysis of encrypted data without the need to decrypt the data.

Evervaults first offering doesnt go that far although its encryption manifesto notes that its keeping a close eye on the technique. And Curran confirms it is likely to incorporate the approach in time. But he says its first focus has been to get E3 up and running with an offering that can help a broad swathe of developers.

Fully homomorphic [encryption] is great. The biggest challenge if youre targeting software developers who are building normal services its very hard to build general purpose applications on top of it. So we take another approach which is basically using trusted execution environments. And we worked with the Amazon Web Services team on being their first production deployment of their new product called Nitro Enclaves, he tells TechCrunch.

The bigger focus for us is less about the underlying technology itself and its more about taking what the best security practices are for companies that are already investing heavily in this and just making them accessible to average developers who dont even know how encryption works, Curran continues. Thats where we get the biggest nuance of Evervault versus some of these others privacy and security companies we build for developers who dont normally think about security when theyre building things and try to build a great experience around that so its really just about bridging the gap between the start of art and bringing it to average developers.

Over time fully homomorphic encryption is probably a no-brainer for us but both in terms of performance and flexibility for your average developer to get up and running it didnt really make sense for us to build on it in its current form. But its something were looking into. Were really looking at whats coming out of academia and if we can fit it in there. But in the meantime its all this trusted execution environment, he adds.

Curran suggests Evervaults main competitor at this point is open-source encryption libraries so basically developers opting to do the encryption piece themselves. Hence its zeroing in on the service aspect of its offering; taking on encryption management tasks so developers dont have to, while also reducing their security risk by ensuring they dont have to touch data in the clear.

When were looking at those sort of developers whore already starting to think about doing it themselves the biggest differentiator with Evervault is, firstly the speed of integration, but more importantly its the management of encrypted data itself, Curran suggests. With Evervault we manage the keys but we dont store any data and our customers store encrypted data but they dont store keys. So it means that even if they want to encrypt something with Evervault they never have all the data themselves in plaintext whereas with open-source encryption theyll have to have it at some point before they do the encryption. So thats really the base competitor that we see.

Obviously there are some other projects out there like Tim Berners-Lees Solid project and so on. But its not clear that theres anybody else taking the developer-experience focused approach to encryption specifically. Obviously theres a bunch of API security companies but encryption through an API is something we havent really come across in the past with customers, he adds.

While Evervaults current approach sees app makers data hosted in dedicated trusted execution environments running on AWS, the information still exists there as plaintext for now. But as encryption continues to evolve its possible to envisage a future where apps arent just encrypted by default (Evervaults stated mission is to encrypt the web) but where user data, once ingested and encrypted, never needs to be decrypted as all processing can be carried out on ciphertext.

Homomorphic encryption has unsurprisingly been called the holy grail of security and privacy and startups like Duality are busy chasing it. But the reality on the ground, online and in app stores remains a whole lot more rudimentary. So Evervault sees plenty of value in getting on with trying to raise the encryption bar more generally.

Curran also points out that plenty of developers arent actually doing much processing of the data they gather arguing therefore that caging plaintext data inside a trusted execution environment can thus abstract away a large part of the risk related to these sort of data flows anyway. The reality is most developers who are building software these days arent necessarily processing data themselves, he suggests. Theyre actually just sort of collecting it from their users and then sharing it with third-party APIs.

If you look at a startup building something with Stripe the credit card flows through their systems but it always ends up being passed on somewhere else. I think thats generally the direction that most startups are going these days. So you can trust the execution depending on the security of the silicon in an Amazon data center kind of makes the most sense.

On the regulatory side, the data protection story is a little more nuanced than the typical security startup spin.

While Europes GDPR certainly bakes security requirements into law, the flagship data protection regime also provides citizens with a suite of access rights attached to their personal data a key element thats often overlooked in developer-first discussions of data privacy.

Evervault concedes that data access rights havent been front of mind yet, with the teams initial focus being squarely on encryption. But Curran tells us it plans over time to roll out products that will simplify access rights as well.

In the future, Evervault will provide the following functionality: Encrypted data tagging (to, for example, time-lock data usage); programmatic role-based access (to, for example, prevent an employee seeing data in plaintext in a UI); and, programmatic compliance (e.g. data localization), he further notes on that.

See original here:
Evervaults encryption as a service is now open access - TechCrunch

Image:Erick Reyes,Thales

Its hard to discuss digital fitness without examining the fundamentals that make it possible, and there's nothing more fundamental to digital success today than security.

But leaders face a conundrum: they need to deploy digital services quickly in response to changing market conditions and customer demands, in a way that doesnt open the door to cyber criminals.

Erick Reyes has worked with numerous organisations to keep their data safe. As the regional sales manager for Thales, Reyes does this by helping them adopt a new approach to data encryption that ensures their data is secure no matter where it is.

Why do you believe encryption is a fundamental part of an organisation's digital capability?

Encryption is one of the security tools that enables you to innovate with speed. It's like a high-performance car you wouldn't feel comfortable driving it fast safely it unless you knew that there's something you can leverage to stop you.

Organisations that we speak to today face previously unseen challenges brought on by disruptions in their markets and supply chains. Most of the time, these organisations have had to revisit and recalibrate some of their fundamental processes. More and more, to be successful means moving to the cloud, and all of a sudden you no longer have that safety net of a perimeter or a moat around where your crown jewels - your sensitive data - sits.

The way most organisations we speak to see that protection coming is through encryption. Being able to encrypt that data allows them to be more nimble in terms of innovation. But then the question is, how do I apply it without slowing my organisation down?

We've had encryption for decades though, so what's really changed to make it more important now?

Recently, we ran a data threat report that we compiled with 451 Research, which surveyed about 2,600 executives that highlighted an increase in adoption of cloud computing. But thats also introduced significant risks and security challenges. When organisations review what they're responsible for in the cloud shared security model, they find that they're ultimately responsible for the security of their data. But the challenge here is that their data resides outside their organisation's perimeter. So now they need to work out how to best protect this data, whilst ensuring that they maintain the performance needed by their organisation.

So how should an organisation go about embedding encryption into its innovation and development programs?

When we speak to organisations undertaking this security and digital journey, one of the key reasons why there is a lack of maturity with their data security approach is the complexity of managing legacy encryption technologies. Organisations typically employ five to 10 different management solutions. This is historical, as most technologies that they use include basic encryption mechanisms.

So what we're seeing with our discussions is a data security platform approach. Thales has a great tool called the CipherTrust Data Security Platform, which is allows organisations to reduce overhead, because you can manage all your encryption technologies from a single platform.

This ties into their existing infrastructure and in to native API calls. So this enables them to not only speed up, but to tie into the orchestration tools. And the developers are happy because suddenly security comes as they build. So the data security platform approach is fast evolving and provides organisations with a tool to enable their digital transformation with less complexity and without slowing down progress.

Can you give me an example of an organisation that's used encryption to accelerate its digital program?

Sure, we're currently working with a financial institution, where we've gone on the journey to leverage the CipherTrust platform as the foundation of their digital transformation strategy. The question was, how do we help secure their data without slowing down their digital strategy?

The challenges in their environment that we found were around reliability and performance. There were multiple encryption tools, which were negatively impacting the end users, developers and old applications. They had insufficient security controls and the native encryption tools in the databases were inadequate to meet compliance requirements and didn't give them the non-repudiation that they needed.

So when we started talking about designing and deploying a solution, the customer chose the CipherTrust Data Security Platform to secure sensitive data across the enterprise. This allowed them to lower overhead and simplify management, as the platforms console allowed them to apply more granular policies to provide that non-repudiation control they needed.

So how should security professionals go about convincing their colleagues to take this approach?

The conversation typically starts with compliance. When you start there, you're able to look at what their business really wants. This approach can help meet compliance requirements and build trust with customers. So start talking about how this platform approach can actually assist to meet business goals and ensure that security is on that critical path to compliance.

So how do you know when you have the right capabilities in your organisation?

When you start seeing that security is no longer holding you back from the objectives of your digital project you might find that your organisation doesnt have the necessary encryption experts. However you can always ask us we'll be happy to point you to the right direction. Ultimately, when you start seeing digital transformation accelerating or working without security hampering it, then you know you've got the right skill sets in place.

View original post here:
Why encryption is the key to digital fitness, according to Thales - iTnews

FACEBOOK has revealed a staggering 400% rise in child abuse images detected on its app.

In the last three months, Facebook picked up more than 25million of these sick illegal images.

1

That's a five-fold rise from the previous quarter highlighting the huge scale of the problem.

It's likely linked to the fact that Facebook has rolled out more advanced scanning tech to unearth child sexual abuse content.

That means more illegal content isn't necessarily being posted but may simply being detected more thoroughly.

In any case, it's a clear sign that paedophiles are still trying to flood the site with horrific and abusive content.

Andy Burrows, Head of Child Safety Online Policy at the NSPCC said: "We welcome platforms investing in new technology to identify and remove child abuse content," Andy Burrows, head of child safety online at the NSPCC, told The Sun.

"But its very concerning that such a staggering amount of this material has been found in just three months.

"It shows just how much Facebook is used by offenders.

"Its unclear if this increase is partly due to Facebook fixing technical issues that over the previous six months cut in half how much child abuse content it took down, or more concerningly, if it has been sitting on the site for even longer.

"This report raises more questions than answers and underlines the urgent need for transparency to be underpinned by regulation that ensures platforms are making every effort possible to disrupt child sexual abuse.

"And with such an alarming amount of child abuse identified, Facebook must quickly ensure they have technology in place to be able to continue identifying abuse in end-to-end encrypted environments before they roll out the feature across their services."

It comes as Facebook faces increased scrutiny over ongoing plans to encrypt communications on the app.

Encryption is mainly a defence against hackers, scrambling messages in transit.

That means only senders and recipients of a text, photo or video can see it and no one else.

Facebook already uses encryption on WhatsApp, which means hackers but also law enforcement can't see what's being sent.

And the firm recently encrypted video calls on Facebook Messenger.

The company is working on encrypted texts on Messenger and Instagram DMs.

But child safety experts have repeatedly warned that encryption will make it harder to root out paedophiles on Facebook platforms.

"End-to-end encryption is already the leading security technology used by many services to keep people safe from hackers and criminals," a Facebook spokesperson said.

"Its full rollout on our messaging services is a long-term project and we are building strong safety measures into our plans.

"We have led the industry in developing new ways to prevent, detect and respond to abuse and will continue to do so."

We pay for your stories! Do you have a story for The Sun Online Tech & Science team? Email us at tech@the-sun.co.uk

Read the original post:
Staggering 400% rise in child sexual abuse images detected by Facebook as fears over encryption plans g... - The Sun

Part of WhatsApp's end-to-end encryption scheme is a requirement for users to set up the service with a phone as the "main" device for an account. The company announced in July that it was working on next-generation encryption that would enable a true multi-device connection without requiring a connection to a smartphone. As part of that, it sounds like WhatsApp is planning a fully native iPad app fro the first time.

AppleInsider noticed a few tweets this weekend from the WABetaInfo account, an unofficial source of details about upcoming WhatsApp features. The account says that as part of the upcoming multi-device beta, both the iPad and Android tablets would be able to be used as "linked devices" to a WhatsApp account for the first time. A follow-up tweet claims that it'll be a native app (rather than a web app) and that it'll work "independently" (as in it'll run if your smartphone is offline).

There's no word on when this app and integration will arrive; the WABetaInfo account says it's under development and will be released in a "future update." But if you already have the WhatsApp for iOS beta, you'll get access to the iPad version as well. On the one hand, plenty of people who've been using WhatsApp for years have likely gotten used to the app not being available on tablets but multi-device support seems like the perfect time to make WhatsApp work on more devices.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.

Follow this link:
WhatsApp could soon have an iPad app for the first time - Engadget