How to Protect Your Data in the Cloud

So this morning, the speakers will be myself, Mike Small. I'm a fellow Analyst at KuppingerCole and Sharon K Clayman, who is a professional service manager at Cotex. So to start with just a little bit of background against, about company, that we are a research Analyst, an industry Analyst that focuses on the area of information, security technology and the digital association of business. Our services include research into products and into thought leadership around the areas of information security. We provide advisory services to customers on these areas, as well as running events.

And our major event in Europe is our European identity and cloud conference, which will be held yet again in Munich, during may and anyone who you, who are interested in that, I suggest you go and look at the company core website where you will find lots of details. We are also now hosting events in Asia Pacific and in Australia. So a little guideline for the webinar that all of the attendees, apart from the speakers like myself are centrally muted. You don't need to mute yourself. We will control this.

The webinar is being recorded and a recording will be available for anyone who missed it tomorrow. You can ask a question at any time using the questions and answers to, which is part of what you should see in the control screen in your webinar. And these questions will be put as appropriate either during the webinar or finally at the end. So this webinar runs two halves. I will start off by giving what is effectively an overview of the industry situation, what the requirements are and what the approaches are to actually realizing this kind of solution.

And in the second part, it will be Sharon Clayman who will provide details on the solution that is provided by covert. So to start off with, it's important to understand why people are using the cloud. And that's an interesting question because there's a lot of talk amongst the industry around the, the security risks and the compliance risks and the legal risks, which are related to using the cloud. But nevertheless, the attractiveness of the cloud comes from what Kuppinger call called the agile business connected to their associates, suppliers, partners, and customers.

And this is illustrated by a large oil company that did a lot of development. And it's a surprising thought that actually oil companies do a, a surprising amount of software development because being able to spot that oil deposit or to use the oil that they have actually extracted more efficiently is a major differentiator.

And so in, without the cloud, it was taking them weeks to set up a new software development project because of the lead time and the difficulties involved in acquiring and provisioning the systems that were needed to equip a new development project using the cloud and using an internal approval system, they were able to reduce this time from weeks to hours, and this was also able to be run across the world. So those kinds of benefits are the benefits that drive people to, to, to, to, to use the cloud.

And the imperative that comes from this agile connected business is the need not only to be flexible, but also to get closer to your customers, your partners, your suppliers, and your associates, and inherently that implies using the internet and using all of the devices and tools that are now available to everyone from the mobile phone, the tablet, the laptop, and all the other ways that people have of connecting it and effectively by, by making that connection, you also increase the needs for the flexibility of the services to deal with peak demands, to deal with the marketing of, of a new product, to deal with a new marketing initiative.

And all those reasons are the reasons why information is being put in places where it is more readily accessible and hence more likely to be compromised. So there are different kinds of customers who use the cloud and they have different perspectives on what the risks are. So there is no single view of risk and many of the new companies that have grown up the intermediaries that are providing a, a better service, the taxi companies, the companies that will, the websites that will take you to a better, a better and more efficient way of getting your takeaway.

For example, these were born on the cloud and for them, the risk is not that they will be insecure or compliant. It is that the business model will not work. And so for them, the whole imperative is to have something that is flexible, that would minimize their losses and would give them the shortest time to market.

However, the existing enterprises, the companies that are thinking of using the cloud, who are moving to the cloud, they definitely want security and compliance. That is top of their checklist of what they need. And their perspective on, on the cloud is rather a different one to those companies that are born on the cloud. And so it is important to understand what the needs of a customer are, rather than to say that there is a simple, single view of risk and what you should do about it.

So taking the examples of these, these companies, not only was there, the oil company that I talked about, but, and, and indeed, those of you that, that came to last year's European identity and cloud conference will have perhaps attended the two sessions by the world meteorological organization. They are the organization that are responsible for global warning, and they found that they got a 70% reduction and improved productivity efficiencies from using the cloud and the international Federation for the red cross, the CRE Rouge. They also were increasing productivity and reusing resources.

Now what characterizes these letter two cases is that they were getting these benefits through being able to share data across what is a worldwide organization by sharing data, they could avoid printing costs. They could avoid printing postage costs. They could avoid having to have a physical meetings and all the travel costs involved, and they could make much faster progress through shared documentation.

Now, shared documentation, shared data has been one of the biggest benefits of the computer and the information revolution. When you could be sure that if you sold an airline seat, that you could sell it anywhere in the world and that you could only sell it once and revolutionize the airline industry. And the same is happening now on a much wider scale with this sharing of data. But when you share data, you also take a risk that it will be shared incorrectly or leaked. And so the problem is to do with the loss of compliance, the security of data and the leakage of that data.

Now, what are the risk areas? There are a number of different documents that sort of come out with these risk areas, but I've picked one which was written by ina and ina. Interesting because they have no ax to grind. They're not a vendor. They are publicly funded by the EU. And you can see in this, the kinds of things that are recognized as being risks, and this document is a very good document because it has actually done a very detailed analysis using the ISO 27,005 approach of looking at what the assets are and what the vulnerabilities are and what the threats are.

Now, there are a number of different kinds of different kinds of risk. These range from legal, through technical, to policy and organizational. Now in Germany, we were just having a discussion before this webcast started off that there are some lawyers who will say that it is not possible on the German law for a company to use the cloud and to be legally compliant.

However, the challenge is balancing that risk and deciding whether that risk is real versus the, the benefits that we talked about earlier on most organizations are aware of the technical issues to do with data leakage, but they haven't necessarily thought of the problems of becoming locked in that I, I, if you, if you use a particular kind of cloud service, then that cloud service may come with APIs that you are tempted to use that are proprietary, that the data that you give to that cloud service may no longer be yours.

And there are numerous cases that, that I know of where organizations have used cloud systems and then got wanted to get back what they thought was their data and found that the contract said it wasn't theirs and they had to pay extra for it. So, but the key thing that is common amongst all of this is the concerns about the data, the leakage of that data, the control of that data and the security of that data.

So in particular, the two things to do with data are the compliance issues of data protection and the onerous rules around data protection that are in place in your, in other parts of the world, as well as the issues to do with jurisdiction. Could the data be in a place where it could be legally accessed by the, the, the, the law enforcement or the government powers in that particular place? And from a technical perspective, there are the issues to do with the leakage or interception of data.

The question of whether the data is properly erased when it is deleted and whether or not insiders will abuse their privileges. And to give you an example of this, there is a, a story which is a true story reported through the information commissioner of a, a healthcare provider in the UK that was fined 325,000 pounds by the information commissioner's office. And what had happened is that they had physical discs, contained medical records.

They employed a third party to physically destroy those discs in order to ensure that the records did not leak the subcontractor actually employed a further subcontractor to do the work who then went and sold the discs on the internet. The, the company that bought them was a data recovery company. And they soon discovered what it was that they had bought and reported it now. So it wasn't the subcontractor, it wasn't the contractor that was fined. It was the data controller, which was the hospital.

And the point about this is that if you use a cloud service and that cloud service, then leaks that data, even if they leak it in a way, which is clearly, shall we say through maladministration, if not misuse, that it is you as the data controller that is likely to pay the penalty. So this means that if you are going to put data in the cloud, then you have a lot of responsibilities and the provider has responsibilities as well. And your responsibilities are to make sure you understand what you move to the cloud, that you are still responsible for the control of that data, and you are liable.

And that providers are only liable to implement the agreed level of security and their liability is limited to what is written in the contract. And most cloud contracts place very limited liability on the cloud service provider for anything that happens. So the solution is that you have to remain responsible. You can outsource the processing, but you can't outsource the responsibility. And this means you need to understand what your benefits should be to balance the risk against reward.

You need to understand and classify what it is that you are putting into the cloud and the risks that that implies. And then you need to manage those risks and managing risk is about reducing either or both the probability of the risk or the impact. And so there are three basic things you can do. You can avoid using the cloud. And this isn't really practical because you could be sure your employees are already using it. You could try and pick what data you are going to put in the cloud.

And that's actually for most organizations too difficult because you actually have a pot of data, which is all mixed up and to try and select out those bits that are particularly difficult or particularly important is, is usually not practical. And so the best thing you can try and do is to reduce the impact by controlling access to that data in some way or another, and of the ways that you can do it.

The, the biggest game in town is encryption, but encryption actually comes with a number of problems and not the least of these is the key management problem. That if, for example, your, your cloud service provider says, well, we do full disc encryption on everything that's held in our service. That's good, but it only protects you against a certain class of risk. So full disc encryption, where the provider holds the keys means that if the media is just lost, then that gives you an element of protection.

But if however, the keys are available to the, to the people that manage the infrastructure, it doesn't protect you against internal misuse. So you really need to have some control as the customer over these keys. And the challenge is how do you do that in a way, which also gives expeditious access to the processing, which needs those keys. So there's a number of solutions. And one solution that some kind providers are suggesting is that they will sell you or rent you an HSM in the cloud. And that's good because that allows you to put your keys close to where it's being used.

But on the other hand, it only works for certain kinds of service and certain kinds of data. So if you are running your own database in infrastructure, as a service with your own software, then that's good because it allows you to put your keys where they are needed, but it doesn't in itself help with the data being transmitted.

You have to deal with that separately through things like TLS and other kinds of network encryption that you, there is also a class of product, which has emerged where you have some kind of appliance on premises, which encrypts data as it leaves to the premises and D encrypts it as it returns. Now, again, this is good because you got control of the data of the keys in your premises. But if you think about it, encrypted data, doesn't get processed in the way that you would expect it to be processed because it's encrypted.

So the application that's remote is faced with this UN understandable encrypted data. So for these solutions to work, you have to have some knowledge of the semantics of the data that you are sending out on premise so that you structure it in a way that when it leaves it can be decoded as it comes back, or it can be processed properly. And often this is done by simple transformation of the, the, the, the, the, the individual data values into, shall we say, hash values or something like this. So it does work and it works for some kinds of web applications, but it's not a general solution.

And it doesn't work for unstructured data, which is a major problem. Then we have homomorphic encryption and homomorphic encryption is an amazing mathematical feat, where there are some forms of encryption that the encrypted data will respond or can be processed using certain functions. And the result of that processing on the encrypted data, when it is decrypted will be the same as if it's been unencrypted. So if you take, for example, two encrypted numbers and add the encrypted values together, when you decrypted the result will be the correct sum of the two unencrypted numbers.

Now it turns out that if you want a wide range of functions to work, then it is very, very heavyweight to do that encryption. If however, you are prepared for there to only be a small number of functions such as greater than, or less than or equal to, then it can take less time, but it is not as good from a point of view of trackability. So once again, this is good for structured data. It is good for databases and things like that, but it is not a solution for unstructured data.

So the final solution, which is actually extremely good for the vast amount of unstructured documented data that people are holding on, things like SharePoint and so forth is based on public key systems. And what basically happens is that the documents are encrypted on the premises, that there is then a, a complicated system, which ensures that you are able not only to place the encrypted data in, in the cloud in a way that it is inaccessible to the general public or to anybody who comes across it or hacks into it.

But you can also control who can get access to it by careful management of keys using public key and private key combinations. And that is good for unstructured data, but is not really very much use if what you're trying to do is to build big databases and run applications. So in summary, what happens is that encrypting data is a key way to managing the data in the cloud, but only providing we can be sure that we kept control over the keys.

So in summary, the agile connected business needs to use the cloud for flexibility, and to get closer to its customers, that you, as the user, the customer of the cloud will be responsible for the date. If it is breached, encryption provides a way for protecting that data in the cloud, but you need to choose the right encryption approach approach for your need. The one that is appropriate, because there are many ways of doing it and the right way, depends upon your requirements, your view of risk and kind of data that you have.

So having introduced the subject in that general way, what I'm now going to do is to hand over to Sharon Clayman and he will then discuss solution to this problem. Okay. Hello everyone. Thank you very much. First of all, I'd like to thank Mike for the great presentation and cloud security overview. The topics covered are very relevant to the ever-changing landscape that we work in strive in business and operational wise. I'll introduce myself.

I'm Sharon Clayderman professional services manager at cos I'm going to present the COEX data-centric solution and perspective in how it addresses various risks in the cloud security landscape, specifically, how can help you solve and address security issues and various use cases that you deal with on a daily basis, We'll start off by detailing the following transition from on-prem solutions and stationary data to the gold rush. You can call the cloud in its wide span connectivity. As you can see here, the boundaries of the organization are fading.

You can see the, the evolution that organizations are following, evolving and moving systems and applications to the cloud, and thus creating a borderless organization with an undefined network perimeter. These are some of the security risks that were mentioned before, and we'd like to address these various risks in order for, to enable the organization to strive business wise and keep itself in motion. Even if in the cloud, even in this evolving procedure and processes that they're within.

Now, we're gonna talk about a few risks selected cloud risks that we want to deal with. Let's describe Ws that we want to deal with, and that can also be addressed in or mitigated by the VEIC solution.

One, we want to verify and be sure that files and data are protected in a seamless and transparent manner before they're uploaded into the cloud. This is the first thing. So we wanted achieve another issue. The cloud can be a black hole for a no man's land. Let's call it for, for an organization. And as an organization, we want to be in control of our data. We want visibility throughout, within the cloud, in the connectivity when, when our data resides there and et cetera.

Now, if we elaborate and continue on the first bullet, we'd like an end to end solution that enables protection and intelligence. We're not talking here only about encryption of data and protection of data, but we also want monitoring capabilities on. And for our data.

Now, let's say the, we could call the last one, keys, keys, keys. We want control over our keys and data, no matter where data may reside, we want sole control of the above. And we want deal with what we mentioned before.

The, the undefined boundaries that in some cases, our farthest stored in various locations worldwide, and we don't have the full control at times that we need in times when various local jurisdictions decide that the data needs to be disclosed or similar. So we'll see how our solution and our concepts address the, these problems and risks.

Now, this comic piece can sum up one of the biggest risks. Yeah, data encryption in the cloud, who has access when and what now let's consume the smart, safer concept. Focus on focuses on file level protection and intelligence at its core. The solution adds a smart wrapper envelope that persists with a file, no matter where it goes or, or where it resides the policy, which is embedded within the file, supports, compliance, and controls, access to the data itself.

For example, who, where, when, and which operations are allowed, questions that can be asked, can a user print the doc, is it enabled or disabled via the policy? Can he or sheet cutter copy contents from the file? These are questions. And these are features or capabilities that we give with our solution. And with the data set data-centric security concept that, that we bring with us.

Now, in addition, the solution provides auditing, logging and reporting capabilities, enabling an organization to understand what users are doing, What users are doing with, with files, when and where this of course helps when wanting to evaluate one security posture regarding data exposure. As you can see in the, in the third bullet, a unique capability that we call policy inheritance deals with the file content itself. We don't only encrypt the file, but we also control the data and the content within the file.

Meaning that if file X is protective copying content from this protected file to a different unprotected file will protect the new file, meaning the policy and the protection is inherited between files. This is a unique feature that we see relevant to the cloud environment and similar environments that we encounter in our customers and your sales course work within. And this picture can sum up, let's say our concept. We build castles around their assets, around their data, and especially this is a needed feature and capability in the cloud.

Now, the important part and the important piece of this presentation. And before we dive down into a few real world use cases, let's state a few typical scenarios that are relevant to the cloud environment in scope. And we wanna see what we can achieve with the proposed solution with the proposed concept.

So, for example, before we dive down to the specific use cases you could see here, one can protect confidential corporate data from trusted or malicious users anywhere. This is the scenario That we deal with and our customers deal with another scenario. Users and companies can protect data deployed to the cloud.

For example, Dropbox box Googled drive, and et cetera, you don't have to, then let's say Dropbox in box from your corporate policy, your corporate security policy, with the concept that we describe here, it could, you could still monitor and use these mediums of channels with the end to end protection, the true end to end protection that we, we apply to to the files. Another scenario is secure sharing of corporate data with external parties. This you could see here, and let's elaborate on this.

One of our customers and irrelevant to us, of course, there many other use cases and personnel and customers that you know of that need to send highly sensitive and regulated documents to board members, for example. So here, the objective is secure collaboration via the cloud with board members, internal and external and assumption of course, is that only authorizes personnel should have access to these documents. So using our solution and various mediums, it could be a web email. It could be Dropbox box, Google drive, and other shared directories and mediums.

The solution secured these highly sensitive and regulated documents and filed. And they were sent to the directors while creating fortified domains. When I say fortified domains, only the members that had the solution, our solution, which in technical terms, and we'll talk about later, we'll have in the Q and a is a client or an agent that that's installed. And we also have client clientless solution only they could open the, the documents that were sent to them from the central hub, from the, the secretary of the bank, for example.

So we created an end to end encryption end audit trail for these documents via any medium or channel that was chosen. This is one example that a use case that that's been deployed and then used in a large bank, for example, a second use case. Our main goal is to protect financial financial data. Now we want the protection to be seamless and transparent as possible, meaning any file that contains key terms or patterns, regular expressions, et cetera, of stock data or investment portfolios or sensitive credit card data.

For example, we want document to protect itself automatically as we call self protecting files. Now these files can be protected before they're uploaded to draw box or box or to the cloud medium, or if they're created in this cloud environment. So the trigger of the protection are key terms that are, that are monitored, that we monitor. And based on if the trigger is enabled or disabled, the document is encrypted protected. And the audited trail starts taking an effect. The intelligence that, that we talked about, and this helps us protect files in any medium or any channel.

And also it helps us alert on abnormal usage and various anomalies. Who's opening. These files are the, are they opening it? Are they opening them in legit hours? Are they taking a file and copying it in an infinite number of times, this can be an anomaly and etcetera in additional use case. And I'll pinpoint the specific, the interesting piece of this. We wanna control health data, an organization shares health data with an external party.

Again, it could be, it could be within the organization, or as you see here with external parties, this is the external party, secure collaboration use case. The main objective here is one to keep a watching eye meaning to see if the document that was sent to the external party is being forwarded onwards to other parties. We could see this to monitor the external parties, usage of data. Are they printing documents? Are they copying the content from within the document?

For example, our solution gives all these capabilities and another feature that, that we want to employ and deploy within these cloud, or let's say semi cloud environment is also the ability to revoke access. So once, once we reach, let's say a specific date where like stated here business relationships change, we can revoke access to these files.

The a, the smart, the smart envelope that we talked about before is like a time bomb. It acts as a time bomb after this specific time and date, external parties won't have access to, to the data. And now I can elaborate later in the Q and a, on various other use cases regarding this revocation processes.

Now, Mike talked about keys and cryptography and various mechanisms, all the, all the techniques and the capabilities that we're talking about here, they're based on strong and sound, crypto building blocks, algorithms methods, everything here is considered, let's say hard. It's not only revocation via the application layer. If we're talking about the technical, the technicalities here last, the last use case, an interesting use case here, we have the, we call the deal room. MNA use case. We have various entities CGEN and there are a lot of various documents.

And the main objective or the challenge is to create this ethical wall between these various entities. So this is what we call fine grained, access and control to documents. One specific document will be protected with various policies. Each policy dictates for various users, what he'll be able to do, he or she will be able to do with the data, meaning there's one business document or a business contract that's intended for two, for two entities, two different entities, entity X has rights to do X, Y, Z. For example, entity Y has rights that are different from the first entity.

So with the built in policy, that's embedded within the file and travels with the file to wherever it may go, we could govern various security policies and restrict or monitor the usage of the files. And in such a deal room scenario, we have an exact audit trail of what the users, the various entities are doing with the files, how they interact, are they downloading them? Are they editing them if possible? And etcetera, this gives a lot of, let's say stronger security and also intelligence monitoring capabilities for the various functions of the organization.

If, if it's the CIO or CS O Now Mike mentioned keys. And the, the challenges from this perspective here, I'll just give a, a generic architecture of how we take care and how we protect our files and data with the covert solution.

Now, the key message to take from here is that to survive, let's say in the cloud to verify the no outside outsiders or SROs are looking at our data, we want true end to end encryption and protection, not only encryption, but also digital signatures. We want to verify the data with, we want, of course, the intelligence layer and the audit trail that we mentioned. And another important, important feature is the secure, secret or key sharing mechanisms. And this involves involved and includes also key management and the solution.

And in the concept that we're describing here, there's no, no one let's say user or the cloud provider, for sure. Doesn't hold a master key or the key to all of the assets of the organization in this specific example that you could see here, there are various layers. And the key hierarchy is let's say complex, meaning that each file each file is encrypted with a different key. And then each policy that we define per file, or a number of policies per file are also encrypted.

And of course, digitally signed with another key and each organization, if organization X and, and there's organization, Y and external ones, they also use unique keys, meaning keys are in shared, and there aren't any global keys and no one entity as in charge or stores, some kind of master key that has and gives access to the whole, let's say, assets that we're talking about, and this is relevant for local machines and also relevant to the cloud.

If we're talking about servers on Amazon servers on Microsoft Azure, if I have my own, let's say hybrid data center in cloud, it's relevant to both worlds to end point and workstations, and also to servers. And what we describe till now applies to these, to these worlds, to sum up how our concept, our data centric security concept looks and let's say feels and what the main attributes we have, the slide, like we said, that is we, we offer.

And the, the summary of this topic is data-centric security for the cloud, the main attributes to enforce and control data usage. As we said, we want an audit trail. We wanna monitor every file activity that users are interacting with.

Some, some may be legit, some may be violations. We will receive this.

Of course, there's an, we can elaborate on the reporting module. It can be stream streamed to similar stocks for further analysis and alerts. We have the alerts in violation reporting, as I said, and the stress, the point that we mentioned throughout, we can protect the data, our data inside and outside our company. And this is important. Cause we understand today that an organization may have some kind of border boundary, but today's really undefined because of the various channels that users are using cloud mobile, bring your own device, various applications.

Now our solutions have various integrations with various companies. You can, you could see the names of a few here integrations with DLP systems integrations, with SharePoint integration, with the cloud. We work locally on servers. You could also work as you see here through terminal services, Citrix, HP, we integrate with, I manage, for example, it's a software that let lets law firms manage clients and matters. These are a few integrations that are relevant for the enterprise for this cloud landscape that we're talking about, the distributed landscape.

Now this is, this is the summary of, of my talk. My last slide. I think we could go to the Q and a, and this could be also in the background. It shows the various building blocks that we deal with the protection layer, the sharing layer, the audit and detection layer, and also we want, and we give the CS C I O CIO, the ability to respond. It's not only enough to protect or encrypt people also need the tools. The organization needs the tools to respond to various threats, or let's say incidents that may be stress. They could also be false positives, but this is an important layer.

It's not enough only to protect and give a flood of logs. It's even more important to give the ability to respond in time. So thank you very much. Okay.

Thank, thank you very much. Sh Sharon, and thank you very much for that.

Very, very nice presentation. So what I I'm, I'm hoping will happen now is that the, the attendees will have any questions at the moment. I don't see any questions. And so what, what I would like to do is to perhaps ask Sharon a couple of questions myself, if you, in the audience have any questions that you would like to ask, then please, would you use the question and answer part of the screen to ask those and I'll try and get a response to them.

Now, I, I listened very carefully to what you said, Sharon. And one of the things that perhaps people would be interested in would be a little bit more data, a little bit more explanation on just how it is that you do this encryption. The reason why I ask this is that, that there are a number of concerns that people might have, for example, what happens if you lose your keys? And I remember with a system called Lotus notes, that there was a degree of encryption with that. And if you lost your master key, you lost all your data. So perhaps you, you would like to take us through that.

And if you want, we could put your screen back on to, to, to take us through that picture with all the keys. Is that what you would like?

Yeah, sure. No problem. Okay. So we have, we have two components in our system. One is the main management server. That's the main component. And the second component are the sensors or clients that are installed at the end points. Now we have one server main server, let's say for enterprise, the keys are unique for this enterprise. If this enterprise interacts with other companies and external users, new keys are generated on the slide via the system.

So the two main components are main server and agents that are installed at the endpoint endpoints could be local machines and endpoints could be server. If they have a nest storage or have, like I said, servers in the cloud, these sensors could also be installed in this environment. Now from a implementation, let's say perspective.

Yes, there is a master key. The master key belongs and is backed up and stored in a very, let's say secure way by the organization itself as the company, as a vendor. And we're a vendor, we don't have access to the key, the master key by the best security practices that we provide and we employ and deploy the master key is kept within the organization, backed up, let's say for, in a number of copies, and this is the it's, it's the sole secret of the system. But having the master key won't help you have access to the rest of the data and organization.

It won't, there's a full hierarchy of, of keys. Like it described that protect the files. So you can understand that some of the keys are embedded within the files.

Now, here, we're talking about the concept. We're not showing the product itself, but from a user perspective, the user sees only files. He sees his desktop, he sees his email for him. Everything is transparent. The policies are embedded in a smart way, are the surgeon within the file? So the keys are also sitting within the file now, like, like stated here, secure, secret, key sharing what we do. And we can elaborate in a different session or send out material to users that want the customers, potential customers, listeners, the secret and the keys are, are shared.

They're not split, let's say in a brutal way, take 1 28 bid or 2 56 bid and cut 'em in half. But with secure protocols, they're split between the files between the sensor and between the main management server. So in such a way, if you have access to specific keys, you don't have access to the pot of gold or to the assets themselves because they're split. And just at the end of the, let's say the opening of the, of the document or when the protocol is done, the key is complete. And then the data is decrypted.

So if an adversary wants, let's say to the crypt, he'll need to sit on a specific location, but also then our center I'm talking technically, sorry, if it's not relevant to everyone, our center has a watchdog that monitors these things and sees that there's no data tampering or even manage the middle, that, that sit and listen to this, of course, other communications within the protocol and within the local usage are also encrypted and digitally signed.

So this, this is, this is an overview of how we manage keys, the end end encryption that we provide, not giving access of keys to the cloud provider, the secure, secret, and key sharing. Yes. And of course, all these keys are rotated all of the time automatically by the system. Okay. So I use it doesn't have rotate a key of a specific file because you understand that the key has been used for two years or something, and he doesn't need to be worried that the key has leaked and then he need to rotate the system, rotates keys by itself.

And again, the system is on premise or in the cloud, but it's unique to the customer, to the deployment. No one else has access to the keys, just the customer. Okay.

So, so there are two, two kinds of dimensions that, that, that might come to this one is that many organizations have a statutory duty to keep documents for very long periods into the future. And so there is a question of how durable is the encryption system, or what would happen if you wanted to keep these documents for times that are measured in years. And the other thing is the other question is that if for some reason, the customer who had used this to encrypt all of their documents decided that they no longer needed your solution. How could they get their data back? Yes. Okay.

So all algorithms and use by us, if it's AEs 1 21, 1 28 or 2 56 bit, and also we use asymmetric encryption, it's a hybrid approach, of course, public encryption and symmetric encryption, all the algorithms and key sizes you can use are by best practices described and depicted by N and Anisa and various other organizations that have various benchmarks. This, this is one thing we use the, let's say industry acceptable and military grade algorithms and key sizes and procedures and secure co-development and things of that sort.

In addition, we also, as, as people that do understand cryptography and follow the various strength, strength, we use techniques, some, some of our listeners might be aware and know of techniques such as forward secrecy forward secrecy, meaning that if a key from the past has been stolen, you won't be able to drive new keys that have been rotated or have been generated. So we use various techniques that give the system durability for a number of years forward.

Of course, that if today we use hash algorithm Shawan and also chat two. Then in the future, the system will, let's say disable Shawan and use only chat two. And even the newer hash algorithms that exist today, shot three. There was a contest not long ago. And so we're up to stride and we, we follow the best practices in use today by Analyst you and other governing dictating bodies. And this is about the security so long term storage with our system, we follow the best practices and things that are acceptable in all industries and all sectors about your question.

I'll ask, I'll rephrase it. Yeah. Is the user locked in to our system? Meaning he's encrypted. The files is he locked into covers for life? The answer is no. The is no simple wise a no.

Again, all the algorithms are known algorithms that are, we didn't brew them here. They're not proprietary for us. They're known algorithms. They're open algorithms that people can audit and scrutinize and develop on them. For example, we use various packages and software libraries that are acceptable and known throughout. And also we have a module and the service that lets the organization by itself. Yeah. Remove the protection of the documents when needed. We call it a crawler, meaning that if you want to keep only area X or area Y of the organization protected, that's good.

If you want to remove the protection from all other files, we have this service, this module runs on a server within the organization. We don't even have control of it. And with this, an organization can remove the protection and bring things to status quo to what it was before. Okay. Thank you very much for those answers, Sharon. So we don't seem to have any further questions from the audience. What I would like to say is that if the, the people that have been attending this do have any questions, then they can always email me or email Cheryl.

And we'll endeavor to give you an answer to your questions. So in the absence of any further questions, I think it just remains for me to, to thank Sharon for his very nice presentation and to thank all the audience who attended this for attending and to hope that you all think about EIC in may next year. So thank you very much, everyone. And good morning to you all from, from England. Thank you all.