@CloudExpo Authors: Pat Romanski, Elizabeth White, Yeshim Deniz, Liz McMillan, Gordon Haff

Related Topics: @CloudExpo

@CloudExpo: Article

In Cloud We Trust?

Exclusive Q&A with Mike Gault, CEO of GuardTime

‘In God we trust,’ yet the currency of the Cloud is at odds with trust. Is it possible to trust applications that reside in a Cloud that seems so porous? Cloud Computing Journal's Jeremy Geelan sat down with GuardTime CEO Mike Gault, whose keyless signature technology is used to secure cloud hosting provider Joyent, whose customers include LinkedIn, Gilt, and Twitter.

Cloud Computing Journal: What is GuardTime all about? As one of the few folks in the Cloud space with an initmate knowledge of Estonia, having lived there for more than three years, I know that its origins lie there...

Gault: GuardTime was started in 2006, as you say, in Estonia. For those not familiar with Estonia, Jeremy, let's explain how unique it is in several aspects. First, it’s one of the most wired countries - the whole country’s IT infrastructure was built post-Internet. And so, everything is basically built using the Internet, including the banking systems. For example, 97% of transactions are done online and with this comes a very high knowledge of IT security by the general population.

The academics that invented the keyless signature technology were involved in the design of the infrastructure. They worked together with the local banks in Estonia. During this program, they realized that there was a fundamental problem that remained unsolved in IT security, which is trust. Why should I trust you with my data? Why should you have complete trust in your system administrator? The technology was built as an answer to these questions; as an alternative to the existing PKI technologies that are incapable of solving these specific problems.

Cloud Computing Journal: What happened to PKI (public key infrastructure)?

Gault: The U.S. has a long history in the 1990s and early 2000s with PKI as an IT security tool. It is very powerful for encryption and data privacy. It’s also very powerful for authentication but as a mechanism to prove the integrity and authenticity of data, it’s a horrible technology. It requires key management and trust authorities, both of which could be compromised and even a hint of a compromise would invalidate all historical records. In the end, it costs more to sign the data than it does to actually store the data. This is one of the reasons why PKI achieved very limited uptake in the U.S. for signing data.

Cloud Computing Journal: And then along comes Cloud computing around 2007.

Gault: Exactly. People realized that something fundamentally changed. It basically went from this data is inside my organization and I’m willing to trust my IT department to ‘this data is outside my organization and I can no longer trust the IT department or outsiders, the people that are now hosting my data.

Cloud Computing Journal: And where does GuardTime fit in?

Gault: GuardTime provides the infrastructure for delivering data signatures – the verification of which does not rely on cryptographic keys. That means that any data in the Cloud or outside the organization can now be signed, and the verification of the signature is based solely on mathematics. This means that you can give your data to your Cloud provider and to your clients, to your partners, or the data can be hosted inside the organization. And you have mathematical proof that the data has not been tampered with.

Cloud Computing Journal: So what’s the overhead on this? Do you see this being for specific types of data in communication?

Gault: The ultimate goal is for keyless signatures to be ubiquitous with data integrity. We have scenarios running up and down the stack from file system integration to system integration to application integration, all the way down to very specific application uses, such as non-repudiated e-mail.

We have, for example, a relationship with Joyent where we integrate into the Joyent Smart Data Center technology providing keyless signing services to their users. Application providers hosting applications on the Cloud stack will usually sign specific data items to ensure both data integrity and operating integrity. For e-mail systems, we have clients using the signatures to verify and validate both the sending party and the authenticity of the e-mail and all of its attachments.

Cloud Computing Journal: As you move data to the Cloud there are many different challenges. Applications have to be designed differently. Security gets pushed further and further away from perimeter-based approaches. How do you see security threats changing in the move to the Cloud?

Gault: Cloud computing is the best thing that has happened to information security in 50 years, because it’s forcing people to address the perimeter issue. Up until the existence of Cloud computing it was acceptable to trust the IT department internally. Now that the IT department is outsourced, all of a sudden people are asking the right questions about IT security. The focus must be on the data itself and not on the perimeter around the data. Cloud computing is forcing IT to ask similar security questions about activities inside the enterprise as well. Cyber defense and Cloud computing are actually closely related, because it becomes about who can you trust and what do you do if you can no longer trust the people inside your organization or institution.

Cloud Computing Journal: What are some questions people should ask a Cloud vendor as people weigh their choices between Joyent, Rackspace, or Amazon?

Gault: Most Cloud vendors will provide security by SLA (service level agreements). What these Cloud providers are saying is, “Please trust us. If anything goes wrong, then we’ll give you your money back.” That doesn’t really inspire much confidence. A much better way of providing security is via proof as in “if anything goes wrong we can provide your verifiable proof of what happened”. For cloud services the SLA is key and people should look closely at ones which require trust and ones which provide proof. Currently only Joyent can provide proof via SLA.

Cloud Computing Journal: How would you know that you got that mathematical proof?

Gault: Data is signed as it is stored in the cloud. That data could be application executables, logs or general data. The result of the signature process is a data signature which is stored either embedded inside the data item, with the data item or separately from the data item. To verify a signature you run a series of hash functions using the signature data and either check the result electronically or for the truly paranoid against a newspaper copy.

Cloud Computing Journal: Not every security threat can be solved through mathematical proof of data signing; there’s still application vulnerabilities and insider threats. What are some security questions you would ask?

Gault: Certainly confidentiality is a major question. Having the right tools in place to ensure that confidentiality is also being maintained is critical. So, some questions would be: What mechanism do you have to protect and securely deliver logs? What are you actually able to log? What activity are you recording within your Cloud? Can the integrity of those logs be proven regardless of when and where they are sent?

Cloud Computing Journal: Security logs are notorious for sitting around and not being accessed unless there’s a known problem. Now that we’re moving to the Cloud, are there better tools to make logs actionable in real-time rather than something that’s basically forensic?

Gault: The SIEM providers are looking at technologies to pull together information and leverage the Cloud resources as well. Users of the Cloud have to employ their own security measures based on their risk level and their regulatory requirements. What GuardTime provides is the ability to prove that those technologies have indeed worked as designed and planned.

It’s important that the technologies have been implemented properly when the logs are being created and that they’re being used properly to analyze and correlate the data into different sets of information. All those actions, including the policy definitions and admin changes associated with them, need to be signed. Because, one of the first things that an attacker will do after gaining access to a system, especially if they are an inside attacker, is to go into the logs and remove the entries that show how and where the access was gained and what has been done to modify the environment to leave the back door open. GuardTime can’t prevent those things from happening, but it can prove that those logs are, in fact, intact and haven’t been changed outside of the rules defined.

More Stories By Jeremy Geelan

Jeremy Geelan is Chairman & CEO of the 21st Century Internet Group, Inc. and an Executive Academy Member of the International Academy of Digital Arts & Sciences. Formerly he was President & COO at Cloud Expo, Inc. and Conference Chair of the worldwide Cloud Expo series. He appears regularly at conferences and trade shows, speaking to technology audiences across six continents. You can follow him on twitter: @jg21.

More Stories By Mike Gault

Mike Gault is CEO of Guardtime, the developer of Keyless Signatures that algorithmically prove the time, origin and integrity of electronic data. He started his career conducting research in Japan on the computer simulation of quantum effect transistors. He then spent 10 years doing quantitative financial modeling and trading financial derivatives at Credit Suisse and Barclays Capital. Mike received a Ph.D. in Electronic Engineering from the University of Wales and an MBA from the Kellogg-HKUST Executive MBA Program.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.

@CloudExpo Stories
Business professionals no longer wonder if they'll migrate to the cloud; it's now a matter of when. The cloud environment has proved to be a major force in transitioning to an agile business model that enables quick decisions and fast implementation that solidify customer relationships. And when the cloud is combined with the power of cognitive computing, it drives innovation and transformation that achieves astounding competitive advantage.
Digital Transformation: Preparing Cloud & IoT Security for the Age of Artificial Intelligence. As automation and artificial intelligence (AI) power solution development and delivery, many businesses need to build backend cloud capabilities. Well-poised organizations, marketing smart devices with AI and BlockChain capabilities prepare to refine compliance and regulatory capabilities in 2018. Volumes of health, financial, technical and privacy data, along with tightening compliance requirements by...
"NetApp is known as a data management leader but we do a lot more than just data management on-prem with the data centers of our customers. We're also big in the hybrid cloud," explained Wes Talbert, Principal Architect at NetApp, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settlement products to hedge funds and investment banks. After, he co-founded a revenue cycle management company where he learned about Bitcoin and eventually Ethereal. Andrew's role at ConsenSys Enterprise is a mul...
Evan Kirstel is an internationally recognized thought leader and social media influencer in IoT (#1 in 2017), Cloud, Data Security (2016), Health Tech (#9 in 2017), Digital Health (#6 in 2016), B2B Marketing (#5 in 2015), AI, Smart Home, Digital (2017), IIoT (#1 in 2017) and Telecom/Wireless/5G. His connections are a "Who's Who" in these technologies, He is in the top 10 most mentioned/re-tweeted by CMOs and CIOs (2016) and have been recently named 5th most influential B2B marketeer in the US. H...
The best way to leverage your Cloud Expo presence as a sponsor and exhibitor is to plan your news announcements around our events. The press covering Cloud Expo and @ThingsExpo will have access to these releases and will amplify your news announcements. More than two dozen Cloud companies either set deals at our shows or have announced their mergers and acquisitions at Cloud Expo. Product announcements during our show provide your company with the most reach through our targeted audiences.
DevOpsSummit New York 2018, colocated with CloudEXPO | DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City. Digital Transformation (DX) is a major focus with the introduction of DXWorldEXPO within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of bus...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, @CloudEXPO and DXWorldEXPO are two of the most important technology events of the year. Since its launch over eight years ago, @CloudEXPO and DXWorldEXPO have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, we provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading...
DXWorldEXPO LLC announced today that "Miami Blockchain Event by FinTechEXPO" has announced that its Call for Papers is now open. The two-day event will present 20 top Blockchain experts. All speaking inquiries which covers the following information can be submitted by email to [email protected] Financial enterprises in New York City, London, Singapore, and other world financial capitals are embracing a new generation of smart, automated FinTech that eliminates many cumbersome, slow, and expe...
DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
As you move to the cloud, your network should be efficient, secure, and easy to manage. An enterprise adopting a hybrid or public cloud needs systems and tools that provide: Agility: ability to deliver applications and services faster, even in complex hybrid environments Easier manageability: enable reliable connectivity with complete oversight as the data center network evolves Greater efficiency: eliminate wasted effort while reducing errors and optimize asset utilization Security: implemen...
DXWorldEXPO | CloudEXPO are the world's most influential, independent events where Cloud Computing was coined and where technology buyers and vendors meet to experience and discuss the big picture of Digital Transformation and all of the strategies, tactics, and tools they need to realize their goals. Sponsors of DXWorldEXPO | CloudEXPO benefit from unmatched branding, profile building and lead generation opportunities.
@DevOpsSummit New York 2018, colocated with CloudEXPO | DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises - and delivering real results.
With tough new regulations coming to Europe on data privacy in May 2018, Calligo will explain why in reality the effect is global and transforms how you consider critical data. EU GDPR fundamentally rewrites the rules for cloud, Big Data and IoT. In his session at 21st Cloud Expo, Adam Ryan, Vice President and General Manager EMEA at Calligo, examined the regulations and provided insight on how it affects technology, challenges the established rules and will usher in new levels of diligence arou...
Dion Hinchcliffe is an internationally recognized digital expert, bestselling book author, frequent keynote speaker, analyst, futurist, and transformation expert based in Washington, DC. He is currently Chief Strategy Officer at the industry-leading digital strategy and online community solutions firm, 7Summits.
"We started a Master of Science in business analytics - that's the hot topic. We serve the business community around San Francisco so we educate the working professionals and this is where they all want to be," explained Judy Lee, Associate Professor and Department Chair at Golden Gate University, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
DXWorldEXPO LLC announced today that Dez Blanchfield joined the faculty of CloudEXPO's "10-Year Anniversary Event" which will take place on November 11-13, 2018 in New York City. Dez is a strategic leader in business and digital transformation with 25 years of experience in the IT and telecommunications industries developing strategies and implementing business initiatives. He has a breadth of expertise spanning technologies such as cloud computing, big data and analytics, cognitive computing, m...
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to ...
Cloud-enabled transformation has evolved from cost saving measure to business innovation strategy -- one that combines the cloud with cognitive capabilities to drive market disruption. Learn how you can achieve the insight and agility you need to gain a competitive advantage. Industry-acclaimed CTO and cloud expert, Shankar Kalyana presents. Only the most exceptional IBMers are appointed with the rare distinction of IBM Fellow, the highest technical honor in the company. Shankar has also receive...
There is a huge demand for responsive, real-time mobile and web experiences, but current architectural patterns do not easily accommodate applications that respond to events in real time. Common solutions using message queues or HTTP long-polling quickly lead to resiliency, scalability and development velocity challenges. In his session at 21st Cloud Expo, Ryland Degnan, a Senior Software Engineer on the Netflix Edge Platform team, will discuss how by leveraging a reactive stream-based protocol,...