Comments
yourfanat wrote: I am using another tool for Oracle developers - dbForge Studio for Oracle. This IDE has lots of usefull features, among them: oracle designer, code competion and formatter, query builder, debugger, profiler, erxport/import, reports and many others. The latest version supports Oracle 12C. More information here.
Cloud Expo on Google News
SYS-CON.TV
Cloud Expo & Virtualization 2009 East
PLATINUM SPONSORS:
IBM
Smarter Business Solutions Through Dynamic Infrastructure
IBM
Smarter Insights: How the CIO Becomes a Hero Again
Microsoft
Windows Azure
GOLD SPONSORS:
Appsense
Why VDI?
CA
Maximizing the Business Value of Virtualization in Enterprise and Cloud Computing Environments
ExactTarget
Messaging in the Cloud - Email, SMS and Voice
Freedom OSS
Stairway to the Cloud
Sun
Sun's Incubation Platform: Helping Startups Serve the Enterprise
POWER PANELS:
Cloud Computing & Enterprise IT: Cost & Operational Benefits
How and Why is a Flexible IT Infrastructure the Key To the Future?
Click For 2008 West
Event Webcasts
In Cloud We Trust?
Exclusive Q&A with Mike Gault, CEO of GuardTime

‘In God we trust,’ yet the currency of the Cloud is at odds with trust. Is it possible to trust applications that reside in a Cloud that seems so porous? Cloud Computing Journal's Jeremy Geelan sat down with GuardTime CEO Mike Gault, whose keyless signature technology is used to secure cloud hosting provider Joyent, whose customers include LinkedIn, Gilt, and Twitter.

Cloud Computing Journal: What is GuardTime all about? As one of the few folks in the Cloud space with an initmate knowledge of Estonia, having lived there for more than three years, I know that its origins lie there...

Gault: GuardTime was started in 2006, as you say, in Estonia. For those not familiar with Estonia, Jeremy, let's explain how unique it is in several aspects. First, it’s one of the most wired countries - the whole country’s IT infrastructure was built post-Internet. And so, everything is basically built using the Internet, including the banking systems. For example, 97% of transactions are done online and with this comes a very high knowledge of IT security by the general population.

The academics that invented the keyless signature technology were involved in the design of the infrastructure. They worked together with the local banks in Estonia. During this program, they realized that there was a fundamental problem that remained unsolved in IT security, which is trust. Why should I trust you with my data? Why should you have complete trust in your system administrator? The technology was built as an answer to these questions; as an alternative to the existing PKI technologies that are incapable of solving these specific problems.

Cloud Computing Journal: What happened to PKI (public key infrastructure)?

Gault: The U.S. has a long history in the 1990s and early 2000s with PKI as an IT security tool. It is very powerful for encryption and data privacy. It’s also very powerful for authentication but as a mechanism to prove the integrity and authenticity of data, it’s a horrible technology. It requires key management and trust authorities, both of which could be compromised and even a hint of a compromise would invalidate all historical records. In the end, it costs more to sign the data than it does to actually store the data. This is one of the reasons why PKI achieved very limited uptake in the U.S. for signing data.

Cloud Computing Journal: And then along comes Cloud computing around 2007.

Gault: Exactly. People realized that something fundamentally changed. It basically went from this data is inside my organization and I’m willing to trust my IT department to ‘this data is outside my organization and I can no longer trust the IT department or outsiders, the people that are now hosting my data.

Cloud Computing Journal: And where does GuardTime fit in?

Gault: GuardTime provides the infrastructure for delivering data signatures – the verification of which does not rely on cryptographic keys. That means that any data in the Cloud or outside the organization can now be signed, and the verification of the signature is based solely on mathematics. This means that you can give your data to your Cloud provider and to your clients, to your partners, or the data can be hosted inside the organization. And you have mathematical proof that the data has not been tampered with.

Cloud Computing Journal: So what’s the overhead on this? Do you see this being for specific types of data in communication?

Gault: The ultimate goal is for keyless signatures to be ubiquitous with data integrity. We have scenarios running up and down the stack from file system integration to system integration to application integration, all the way down to very specific application uses, such as non-repudiated e-mail.

We have, for example, a relationship with Joyent where we integrate into the Joyent Smart Data Center technology providing keyless signing services to their users. Application providers hosting applications on the Cloud stack will usually sign specific data items to ensure both data integrity and operating integrity. For e-mail systems, we have clients using the signatures to verify and validate both the sending party and the authenticity of the e-mail and all of its attachments.

Cloud Computing Journal: As you move data to the Cloud there are many different challenges. Applications have to be designed differently. Security gets pushed further and further away from perimeter-based approaches. How do you see security threats changing in the move to the Cloud?

Gault: Cloud computing is the best thing that has happened to information security in 50 years, because it’s forcing people to address the perimeter issue. Up until the existence of Cloud computing it was acceptable to trust the IT department internally. Now that the IT department is outsourced, all of a sudden people are asking the right questions about IT security. The focus must be on the data itself and not on the perimeter around the data. Cloud computing is forcing IT to ask similar security questions about activities inside the enterprise as well. Cyber defense and Cloud computing are actually closely related, because it becomes about who can you trust and what do you do if you can no longer trust the people inside your organization or institution.

Cloud Computing Journal: What are some questions people should ask a Cloud vendor as people weigh their choices between Joyent, Rackspace, or Amazon?

Gault: Most Cloud vendors will provide security by SLA (service level agreements). What these Cloud providers are saying is, “Please trust us. If anything goes wrong, then we’ll give you your money back.” That doesn’t really inspire much confidence. A much better way of providing security is via proof as in “if anything goes wrong we can provide your verifiable proof of what happened”. For cloud services the SLA is key and people should look closely at ones which require trust and ones which provide proof. Currently only Joyent can provide proof via SLA.

Cloud Computing Journal: How would you know that you got that mathematical proof?

Gault: Data is signed as it is stored in the cloud. That data could be application executables, logs or general data. The result of the signature process is a data signature which is stored either embedded inside the data item, with the data item or separately from the data item. To verify a signature you run a series of hash functions using the signature data and either check the result electronically or for the truly paranoid against a newspaper copy.

Cloud Computing Journal: Not every security threat can be solved through mathematical proof of data signing; there’s still application vulnerabilities and insider threats. What are some security questions you would ask?

Gault: Certainly confidentiality is a major question. Having the right tools in place to ensure that confidentiality is also being maintained is critical. So, some questions would be: What mechanism do you have to protect and securely deliver logs? What are you actually able to log? What activity are you recording within your Cloud? Can the integrity of those logs be proven regardless of when and where they are sent?

Cloud Computing Journal: Security logs are notorious for sitting around and not being accessed unless there’s a known problem. Now that we’re moving to the Cloud, are there better tools to make logs actionable in real-time rather than something that’s basically forensic?

Gault: The SIEM providers are looking at technologies to pull together information and leverage the Cloud resources as well. Users of the Cloud have to employ their own security measures based on their risk level and their regulatory requirements. What GuardTime provides is the ability to prove that those technologies have indeed worked as designed and planned.

It’s important that the technologies have been implemented properly when the logs are being created and that they’re being used properly to analyze and correlate the data into different sets of information. All those actions, including the policy definitions and admin changes associated with them, need to be signed. Because, one of the first things that an attacker will do after gaining access to a system, especially if they are an inside attacker, is to go into the logs and remove the entries that show how and where the access was gained and what has been done to modify the environment to leave the back door open. GuardTime can’t prevent those things from happening, but it can prove that those logs are, in fact, intact and haven’t been changed outside of the rules defined.

About Jeremy Geelan
Jeremy Geelan is Chairman & CEO of the 21st Century Internet Group, Inc. and an Executive Academy Member of the International Academy of Digital Arts & Sciences. Formerly he was President & COO at Cloud Expo, Inc. and Conference Chair of the worldwide Cloud Expo series. He appears regularly at conferences and trade shows, speaking to technology audiences across six continents. You can follow him on twitter: @jg21.

About Mike Gault
Mike Gault is CEO of Guardtime, the developer of Keyless Signatures that algorithmically prove the time, origin and integrity of electronic data. He started his career conducting research in Japan on the computer simulation of quantum effect transistors. He then spent 10 years doing quantitative financial modeling and trading financial derivatives at Credit Suisse and Barclays Capital. Mike received a Ph.D. in Electronic Engineering from the University of Wales and an MBA from the Kellogg-HKUST Executive MBA Program.

In order to post a comment you need to be registered and logged in.

Register | Sign-in

Reader Feedback: Page 1 of 1

Latest Cloud Developer Stories
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even cod...
The past few years have brought a sea change in the way applications are architected, developed, and consumed—increasing both the complexity of testing and the business impact of software failures. How can software testing professionals keep pace with modern application delivery,...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices ...
Cloud Expo | DXWorld Expo have announced the conference tracks for Cloud Expo 2018. Cloud Expo will be held June 5-7, 2018, at the Javits Center in New York City, and November 6-8, 2018, at the Santa Clara Convention Center, Santa Clara, CA. Digital Transformation (DX) is a major...
"WineSOFT is a software company making proxy server software, which is widely used in the telecommunication industry or the content delivery networks or e-commerce," explained Jonathan Ahn, COO of WineSOFT, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 201...
Subscribe to the World's Most Powerful Newsletters
Subscribe to Our Rss Feeds & Get Your SYS-CON News Live!
Click to Add our RSS Feeds to the Service of Your Choice:
Google Reader or Homepage Add to My Yahoo! Subscribe with Bloglines Subscribe in NewsGator Online
myFeedster Add to My AOL Subscribe in Rojo Add 'Hugg' to Newsburst from CNET News.com Kinja Digest View Additional SYS-CON Feeds
Publish Your Article! Please send it to editorial(at)sys-con.com!

Advertise on this site! Contact advertising(at)sys-con.com! 201 802-3021



SYS-CON Featured Whitepapers
ADS BY GOOGLE