Welcome!

@CloudExpo Authors: Liz McMillan, Pat Romanski, Mehdi Daoudi, Elizabeth White, Rene Buest

Related Topics: @CloudExpo

@CloudExpo: Article

In Cloud We Trust?

Exclusive Q&A with Mike Gault, CEO of GuardTime

‘In God we trust,’ yet the currency of the Cloud is at odds with trust. Is it possible to trust applications that reside in a Cloud that seems so porous? Cloud Computing Journal's Jeremy Geelan sat down with GuardTime CEO Mike Gault, whose keyless signature technology is used to secure cloud hosting provider Joyent, whose customers include LinkedIn, Gilt, and Twitter.

Cloud Computing Journal: What is GuardTime all about? As one of the few folks in the Cloud space with an initmate knowledge of Estonia, having lived there for more than three years, I know that its origins lie there...

Gault: GuardTime was started in 2006, as you say, in Estonia. For those not familiar with Estonia, Jeremy, let's explain how unique it is in several aspects. First, it’s one of the most wired countries - the whole country’s IT infrastructure was built post-Internet. And so, everything is basically built using the Internet, including the banking systems. For example, 97% of transactions are done online and with this comes a very high knowledge of IT security by the general population.

The academics that invented the keyless signature technology were involved in the design of the infrastructure. They worked together with the local banks in Estonia. During this program, they realized that there was a fundamental problem that remained unsolved in IT security, which is trust. Why should I trust you with my data? Why should you have complete trust in your system administrator? The technology was built as an answer to these questions; as an alternative to the existing PKI technologies that are incapable of solving these specific problems.

Cloud Computing Journal: What happened to PKI (public key infrastructure)?

Gault: The U.S. has a long history in the 1990s and early 2000s with PKI as an IT security tool. It is very powerful for encryption and data privacy. It’s also very powerful for authentication but as a mechanism to prove the integrity and authenticity of data, it’s a horrible technology. It requires key management and trust authorities, both of which could be compromised and even a hint of a compromise would invalidate all historical records. In the end, it costs more to sign the data than it does to actually store the data. This is one of the reasons why PKI achieved very limited uptake in the U.S. for signing data.

Cloud Computing Journal: And then along comes Cloud computing around 2007.

Gault: Exactly. People realized that something fundamentally changed. It basically went from this data is inside my organization and I’m willing to trust my IT department to ‘this data is outside my organization and I can no longer trust the IT department or outsiders, the people that are now hosting my data.

Cloud Computing Journal: And where does GuardTime fit in?

Gault: GuardTime provides the infrastructure for delivering data signatures – the verification of which does not rely on cryptographic keys. That means that any data in the Cloud or outside the organization can now be signed, and the verification of the signature is based solely on mathematics. This means that you can give your data to your Cloud provider and to your clients, to your partners, or the data can be hosted inside the organization. And you have mathematical proof that the data has not been tampered with.

Cloud Computing Journal: So what’s the overhead on this? Do you see this being for specific types of data in communication?

Gault: The ultimate goal is for keyless signatures to be ubiquitous with data integrity. We have scenarios running up and down the stack from file system integration to system integration to application integration, all the way down to very specific application uses, such as non-repudiated e-mail.

We have, for example, a relationship with Joyent where we integrate into the Joyent Smart Data Center technology providing keyless signing services to their users. Application providers hosting applications on the Cloud stack will usually sign specific data items to ensure both data integrity and operating integrity. For e-mail systems, we have clients using the signatures to verify and validate both the sending party and the authenticity of the e-mail and all of its attachments.

Cloud Computing Journal: As you move data to the Cloud there are many different challenges. Applications have to be designed differently. Security gets pushed further and further away from perimeter-based approaches. How do you see security threats changing in the move to the Cloud?

Gault: Cloud computing is the best thing that has happened to information security in 50 years, because it’s forcing people to address the perimeter issue. Up until the existence of Cloud computing it was acceptable to trust the IT department internally. Now that the IT department is outsourced, all of a sudden people are asking the right questions about IT security. The focus must be on the data itself and not on the perimeter around the data. Cloud computing is forcing IT to ask similar security questions about activities inside the enterprise as well. Cyber defense and Cloud computing are actually closely related, because it becomes about who can you trust and what do you do if you can no longer trust the people inside your organization or institution.

Cloud Computing Journal: What are some questions people should ask a Cloud vendor as people weigh their choices between Joyent, Rackspace, or Amazon?

Gault: Most Cloud vendors will provide security by SLA (service level agreements). What these Cloud providers are saying is, “Please trust us. If anything goes wrong, then we’ll give you your money back.” That doesn’t really inspire much confidence. A much better way of providing security is via proof as in “if anything goes wrong we can provide your verifiable proof of what happened”. For cloud services the SLA is key and people should look closely at ones which require trust and ones which provide proof. Currently only Joyent can provide proof via SLA.

Cloud Computing Journal: How would you know that you got that mathematical proof?

Gault: Data is signed as it is stored in the cloud. That data could be application executables, logs or general data. The result of the signature process is a data signature which is stored either embedded inside the data item, with the data item or separately from the data item. To verify a signature you run a series of hash functions using the signature data and either check the result electronically or for the truly paranoid against a newspaper copy.

Cloud Computing Journal: Not every security threat can be solved through mathematical proof of data signing; there’s still application vulnerabilities and insider threats. What are some security questions you would ask?

Gault: Certainly confidentiality is a major question. Having the right tools in place to ensure that confidentiality is also being maintained is critical. So, some questions would be: What mechanism do you have to protect and securely deliver logs? What are you actually able to log? What activity are you recording within your Cloud? Can the integrity of those logs be proven regardless of when and where they are sent?

Cloud Computing Journal: Security logs are notorious for sitting around and not being accessed unless there’s a known problem. Now that we’re moving to the Cloud, are there better tools to make logs actionable in real-time rather than something that’s basically forensic?

Gault: The SIEM providers are looking at technologies to pull together information and leverage the Cloud resources as well. Users of the Cloud have to employ their own security measures based on their risk level and their regulatory requirements. What GuardTime provides is the ability to prove that those technologies have indeed worked as designed and planned.

It’s important that the technologies have been implemented properly when the logs are being created and that they’re being used properly to analyze and correlate the data into different sets of information. All those actions, including the policy definitions and admin changes associated with them, need to be signed. Because, one of the first things that an attacker will do after gaining access to a system, especially if they are an inside attacker, is to go into the logs and remove the entries that show how and where the access was gained and what has been done to modify the environment to leave the back door open. GuardTime can’t prevent those things from happening, but it can prove that those logs are, in fact, intact and haven’t been changed outside of the rules defined.

More Stories By Jeremy Geelan

Jeremy Geelan is Chairman & CEO of the 21st Century Internet Group, Inc. and an Executive Academy Member of the International Academy of Digital Arts & Sciences. Formerly he was President & COO at Cloud Expo, Inc. and Conference Chair of the worldwide Cloud Expo series. He appears regularly at conferences and trade shows, speaking to technology audiences across six continents. You can follow him on twitter: @jg21.

More Stories By Mike Gault

Mike Gault is CEO of Guardtime, the developer of Keyless Signatures that algorithmically prove the time, origin and integrity of electronic data. He started his career conducting research in Japan on the computer simulation of quantum effect transistors. He then spent 10 years doing quantitative financial modeling and trading financial derivatives at Credit Suisse and Barclays Capital. Mike received a Ph.D. in Electronic Engineering from the University of Wales and an MBA from the Kellogg-HKUST Executive MBA Program.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
"We're a cybersecurity firm that specializes in engineering security solutions both at the software and hardware level. Security cannot be an after-the-fact afterthought, which is what it's become," stated Richard Blech, Chief Executive Officer at Secure Channels, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Enterprise architects are increasingly adopting multi-cloud strategies as they seek to utilize existing data center assets, leverage the advantages of cloud computing and avoid cloud vendor lock-in. This requires a globally aware traffic management strategy that can monitor infrastructure health across data centers and end-user experience globally, while responding to control changes and system specification at the speed of today’s DevOps teams. In his session at 20th Cloud Expo, Josh Gray, Chie...
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. Jack Norris reviews best practices to show how companies develop, deploy, and dynamically update these applications and how this data-first...
Intelligent Automation is now one of the key business imperatives for CIOs and CISOs impacting all areas of business today. In his session at 21st Cloud Expo, Brian Boeggeman, VP Alliances & Partnerships at Ayehu, will talk about how business value is created and delivered through intelligent automation to today’s enterprises. The open ecosystem platform approach toward Intelligent Automation that Ayehu delivers to the market is core to enabling the creation of the self-driving enterprise.
"We're here to tell the world about our cloud-scale infrastructure that we have at Juniper combined with the world-class security that we put into the cloud," explained Lisa Guess, VP of Systems Engineering at Juniper Networks, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
As more and more companies are making the shift from on-premises to public cloud, the standard approach to DevOps is evolving. From encryption, compliance and regulations like GDPR, security in the cloud has become a hot topic. Many DevOps-focused companies have hired dedicated staff to fulfill these requirements, often creating further siloes, complexity and cost. This session aims to highlight existing DevOps cultural approaches, tooling and how security can be wrapped in every facet of the bu...
Historically, some banking activities such as trading have been relying heavily on analytics and cutting edge algorithmic tools. The coming of age of powerful data analytics solutions combined with the development of intelligent algorithms have created new opportunities for financial institutions. In his session at 20th Cloud Expo, Sebastien Meunier, Head of Digital for North America at Chappuis Halder & Co., discussed how these tools can be leveraged to develop a lasting competitive advantage ...
Connecting to major cloud service providers is becoming central to doing business. But your cloud provider’s performance is only as good as your connectivity solution. Massive Networks will place you in the driver's seat by exposing how you can extend your LAN from any location to include any cloud platform through an advanced high-performance connection that is secure and dedicated to your business-critical data. In his session at 21st Cloud Expo, Paul Mako, CEO & CIO of Massive Networks, wil...
You know you need the cloud, but you’re hesitant to simply dump everything at Amazon since you know that not all workloads are suitable for cloud. You know that you want the kind of ease of use and scalability that you get with public cloud, but your applications are architected in a way that makes the public cloud a non-starter. You’re looking at private cloud solutions based on hyperconverged infrastructure, but you’re concerned with the limits inherent in those technologies.
The question before companies today is not whether to become intelligent, it’s a question of how and how fast. The key is to adopt and deploy an intelligent application strategy while simultaneously preparing to scale that intelligence. In her session at 21st Cloud Expo, Sangeeta Chakraborty, Chief Customer Officer at Ayasdi, will provide a tactical framework to become a truly intelligent enterprise, including how to identify the right applications for AI, how to build a Center of Excellence to ...
SYS-CON Events announced today that Massive Networks will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Massive Networks mission is simple. To help your business operate seamlessly with fast, reliable, and secure internet and network solutions. Improve your customer's experience with outstanding connections to your cloud.
DevOps is under attack because developers don’t want to mess with infrastructure. They will happily own their code into production, but want to use platforms instead of raw automation. That’s changing the landscape that we understand as DevOps with both architecture concepts (CloudNative) and process redefinition (SRE). Rob Hirschfeld’s recent work in Kubernetes operations has led to the conclusion that containers and related platforms have changed the way we should be thinking about DevOps and...
SYS-CON Events announced today that CAST Software will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CAST was founded more than 25 years ago to make the invisible visible. Built around the idea that even the best analytics on the market still leave blind spots for technical teams looking to deliver better software and prevent outages, CAST provides the software intelligence that matter ...
Everything run by electricity will eventually be connected to the Internet. Get ahead of the Internet of Things revolution and join Akvelon expert and IoT industry leader, Sergey Grebnov, in his session at @ThingsExpo, for an educational dive into the world of managing your home, workplace and all the devices they contain with the power of machine-based AI and intelligent Bot services for a completely streamlined experience.
Because IoT devices are deployed in mission-critical environments more than ever before, it’s increasingly imperative they be truly smart. IoT sensors simply stockpiling data isn’t useful. IoT must be artificially and naturally intelligent in order to provide more value In his session at @ThingsExpo, John Crupi, Vice President and Engineering System Architect at Greenwave Systems, will discuss how IoT artificial intelligence (AI) can be carried out via edge analytics and machine learning techn...
SYS-CON Events announced today that Datera, that offers a radically new data management architecture, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera is transforming the traditional datacenter model through modern cloud simplicity. The technology industry is at another major inflection point. The rise of mobile, the Internet of Things, data storage and Big...
As businesses adopt functionalities in cloud computing, it’s imperative that IT operations consistently ensure cloud systems work correctly – all of the time, and to their best capabilities. In his session at @BigDataExpo, Bernd Harzog, CEO and founder of OpsDataStore, presented an industry answer to the common question, “Are you running IT operations as efficiently and as cost effectively as you need to?” He then expounded on the industry issues he frequently came up against as an analyst, and ...
FinTechs use the cloud to operate at the speed and scale of digital financial activity, but are often hindered by the complexity of managing security and compliance in the cloud. In his session at 20th Cloud Expo, Sesh Murthy, co-founder and CTO of Cloud Raxak, showed how proactive and automated cloud security enables FinTechs to leverage the cloud to achieve their business goals. Through business-driven cloud security, FinTechs can speed time-to-market, diminish risk and costs, maintain continu...
SYS-CON Events announced today that CA Technologies has been named "Platinum Sponsor" of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business - from apparel to energy - is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
SYS-CON Events announced today that Pulzze Systems will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Pulzze Systems Inc, provides the software product "The Interactor" that uniquely simplifies building IoT, Web and Smart Enterprise Solutions. It is a Silicon Valley startup funded by US government agencies, NSF and DHS to bring innovative solutions to market.