Ask any security guy what’s the hardest attack to prevent. It’s an attacker with a root password. Such attackers can virtually do whatever they want with your system. All your applications and data stand naked to such an attacker. They can steal whatever data or IP they want. All the security tools in the world cannot do anything about it. Fortanix changes this. Below is our interview with Ambuj Kumar, CEO and Co-founder of Fortanix:
Q: You’ve recently launched the first commercially available runtime encryption using Intel® SGX. What is significant about this?
A: For the first time ever, now customers have a solution that protects their most valuable assets from attackers who have broken into the network, have root passwords and physical access, and all the time in the world to mount their attack. Fortanix has created a new industry category – Runtime Encryption.
Just like encryption secures data at rest (think full-drive encryption) and data in motion (think SSL, padlocks in internet browsers), Runtime Encryption is a class of security solutions that keeps data encrypted during use. It offers a cryptographic certainty that data remains protected even when the infrastructure is compromised or untrusted.
Intel SGX is the fundamental ingredient to make Runtime Encryption possible with performance guarantees required by modern cloud applications. Intel SGX represents best of hardware based-security and is a manifestation of many years of work from many researchers at Intel. Fortanix is the first vendor to offer a commercially available solution based on Intel SGX.
Q: What is unique about Fortanix and how does it stand out from competition?
A: Most security tools offer detection or post-breach remediation and sadly they use probability models for these. Imagine you are looking for a new security system for your home. And the salesman tells you they alert you after your house has been broken into – but only if the burglars came in black vans during the day or if they wore yellow suits! But, they reassure you there’s nothing to worry about because they have a smart detection system that gets more reliable as your house gets robbed! After hearing such a sales pitch, you will no doubt look for another security system.
Sadly, that’s the state of affairs for current enterprise customers wanting to protect their data either on-premises or in the cloud. Most security solutions offer probabilistic post-breach notification. Fortanix is the first and only company to offer deterministic security. This means customers know their data remains protected from threats all the time, every time. It does not matter which zero-day bug was exploited, or how an intruder broke into the network, or how the root password was compromised. Runtime Encryption keeps data secure.
Runtime Encryption is a new category that allows customers to know that no matter what happens, their data remains cryptographically protected. No amount of zero-day compromises, operating system level hacks, infrastructure compromises, and even government subpoenas can compromise your data.
Security researchers have tried to crack the code of runtime security with multiple ways, including software-only solutions that turned out to be too weak, to homomorphic encryption that turned out to be unusable. Runtime Encryption uses a hardware foundation to provide deterministic security needed for the most sensitive applications at the performance demanded by modern Internet-scale applications. Fortanix invented the Runtime Encryption category and currently offers key management and database security products in this category.
Q: Why has encryption not been applied to data-in-use in the past and why do you think your solution will perform better?
A: Keeping data encrypted during use has been a complicated technical problem. Programs are written to use decrypted data. So, traditionally data is decrypted when applications run. The decrypted data then becomes a sitting duck for network intruders and malicious insiders. So, what’s required is a means to keep the data encrypted even when applications are processing it. Cryptographers have traditionally tried to meet this need by using two techniques – homomorphic encryption and multi-party compute. Both approaches have significant shortcomings.
Homomorphic encryption essentially fights the laws of physics and remains very much a research discussion topic. It’s applicable to only a handful of primitive programs and there too it causes slowdowns by thousands of times.
Multi-party compute fails to secure organizations in any meaningful way. It simply spreads the compute over multiple servers in the hope that attackers will be able to breach only one of the two servers. But, just like a lock picker can open multiple locks on your front door, attackers who break into one server deploy the same techniques to break into the other server or just move laterally. So, most organizations don’t gain anything by using multi-party compute based solutions.
Fortanix created Runtime Encryption technology to keep applications encrypted even when they run. Fortanix provides real-time encryption of all memory and software stack with negligible performance penalty, even in a multi-tenant cloud environment. All the keys and security needed to manage Runtime Encryption are kept secure in Intel SGX hardware. Runtime Encryption protects applications from all types of software attacks originated by OS, network intruders, privileged users, etc. And users benefit from the cryptographic certainty Runtime Encryption offers while meeting their performance requirements.
Q: Can you tell us more about your Self-Defending Key Management Service (SDKMS)?
A: Self-Defending Key Management Service (SDKMS) is the world’s first solution to provide hardware security module (HSM)-grade security with software-like flexibility. Built from the ground up for modern cloud-scale applications, SDKMS provides RESTful APIs alongside traditional interfaces, native server-side clustering, centralized management, a tamper-proof audit log, and more. Users can secure keys, both on-premises and in the cloud, without needing a specialized HSM talent force or unreliable and costly professional services. The solution also offers centralized tamper-proof logging and zero-touch server-side clustering and built-in high availability and disaster recovery.
SDKMS leverages Intel SGX to ensure that no cloud provider, service provider, or even Fortanix has access to any keys or data. This ensures keys remain protected even with malicious insiders, compromised cloud providers, or government compulsion.
Q: There has been lots of press about the side-channel vulnerability inside Intel SGX. How do you address this?
A: The side-channel vulnerability is a property of the application, and not the platform. A vulnerable application may be compromised whether it runs inside Intel SGX or outside.
Fortanix team members have contributed to dozens of national and international patents for preventing side-channel vulnerabilities. We have evaluated and advised various organizations on best practices to make applications secure from side-channel.
If application developers understand security vulnerabilities including side-channel vulnerabilities and are careful, they can develop secure applications. Security requires a bottom-up approach and cannot be an after-thought.
Q: Who is your ideal customer for SDKMS and why?
A: Our ideal customers are organizations with sensitive data which are migrating to the cloud. They want a no-compromise key management solution. They are frustrated with traditional hardware security modules’ (HSMs) inability to scale, cluster, or support modern developers with RESTful APIs. They are tired of keeping HSMs in silos and deploying a specialized talent force just to maintain them. They feel nickel-and-dimed with HSM vendors every time they require new features or connectors.
SDKMS now offers a solution that’s available both on-prem and in cloud. Businesses use SDKMS to secure their cloud and traditional applications, including PKI system and IoT applications, while drastically reducing integration complexities and expenses. They are delighted by the transparent flat pricing structure, massive scalability and central management.
Q: What are your plans for the next 12 months?
A: Organizations have been so frustrated with traditional security solutions for so long that they cannot even imagine a world where security products work as advertised. Our goal over the next year is to inform organizations of new choices, new possibilities, and a new world where they can prevent data breaches, where there is a cryptographic certainty that their data cannot be misused.Activate Social Media: