Fortanix enhances information from software vulnerabilities with Runtime Encryption technology



Fortanix Inc., announced this week that its self-defending key management service (SDKMS), a cloud service secured with runtime encryption technology that protects organizations from software vulnerabilities that can allow hacker attacks similar to the recent Equifax data breach.

Secured with Intel SGX, Fortanix’s SDKMS is a key management solution that is secure from cloud providers and government subpoena; that is cloud agnostic, built to scale, and provides software flexibility with hardware security module (HSM) grade security.

SDKMS offers central management, tamper-proof logging, rich access control, and massive scalability. Organizations use SDKMS to secure their sensitive cloud and traditional applications, including digital payments, PKI systems, IoT applications, silicon manufacturing, and remote TLS terminations, while reducing integration complexities and expenses.

Fortanix’s Runtime Encryption protects applications and data during use and computation. Runtime Encryption allows general-purpose computation on encrypted data without exposing sensitive data to untrusted operating systems, root users, cloud providers, or malicious insiders.

Even with vulnerable software such as Apache Struts, hackers access only encrypted data which is undecipherable. Hackers will always be able to use vulnerable applications to connect to servers. But encryption during runtime ensures that even when this happens, private data remains encrypted and unusable to hackers.

Encryption secures data at rest as well as in transit with technology such as Transport Layer Security (TLS). As an example, when banks provide data to Equifax they use TLS, but once the data is used by Equifax, it’s decrypted and exposed. The exposed data provides an opportunity for hackers to try all possible vulnerabilities to find and steal the exposed data. In the case of Equifax, a vulnerability in the Apache Struts software provided the path for hackers to connect to the personal data, a breach which affected 143 million people.

“Runtime Encryption keeps data encrypted and secured when applications are using the data,” said Ambuj Kumar, Fortanix CEO and co-founder. “As we saw in the Equifax case, encryption would have protected the population’s sensitive data during runtime processing. An approach that combines encryption with best practices in developing secure applications can reach new heights in securing data.”

Last week, Fortanix announced its initial commercially available Runtime Encryption solution using Intel Software Guard Extensions (SGX) to best protect private data even during runtime. Organizations can leverage a Runtime Encryption environment where they can run their most sensitive applications with complete and deterministic privacy, as data remains encrypted and completely protected from cloud providers, system administrators, insiders, government subpoena, and network hackers.

In conjunction with this initial Intel SGX-enabled production software, Fortanix has also launched the Runtime Encryption Slack Channel, available online. The channel is a growing community of professionals who connect to discuss Intel SGX and Runtime Encryption.

The solution provides SGX-enabled production software delivers Runtime Encryption technology to protect applications and data during use. Runtime Encryption allows general-purpose computation on encrypted data without exposing sensitive data to untrusted operating systems, root users, cloud providers, or malicious insiders.

Leave a Reply

WWPI – Covering the best in IT since 1980