Dublin-based Evervault, a developer-focused security startup which sells encryption via API and is backed by a raft of big name investors including the likes of Sequoia, Kleiner Perkins and Index Ventures, is coming out of closed beta today announcing open access to its encryption engine.
The startup says some 3,000 developers are on its waitlist to kick the tyres of its encryption engine, which it calls E3.
Among dozens of companies in its closed preview are drone delivery firm Manna, fintech startup Okra and health tech company Vital. Evervault says its targeting its tools at developers at companies with a core business need to collect and process four types of data: identity & contact data; financial & transaction data; health & medical data; and intellectual property.
The first suite of products it offers on E3 are called Relay and Cages; the former providing a new way for developers to encrypt and decrypt data as it passes in and out of apps; the latter offering a secure method using trusted execution environments running on AWS to process encrypted data by isolating the code that processes plaintext data from the rest of the developer stack.
Evervault is the first company to get a product deployed on Amazon Web Services Nitro Enclaves, per founder Shane Curran.
Nitro Enclaves are basically environments where you can run code and prove that the code thats running in the data itself is the code that youre meant to be running, he tells TechCrunch.We were the first production deployment of a product on AWS Nitro Enclaves so in terms of the people actually taking that approach were the only ones.
It shouldnt be news to anyone to say that data breaches continue to be a serious problem online. And unfortunately its sloppy security practices by app makers or even a total lack of attention to securing user data thats frequently to blame when plaintext data leaks or is improperly accessed.
Evervaults fix for this unfortunate feature of the app ecosystem is to make it super simple for developers to bake in encryption via an API taking the strain of tasks like managing encryption keys. (Integrate Evervault in 5 minutes by changing a DNS record and including our SDK, is the developer-enticing pitch on its website.)
At the high level what were doing is were really focusing on getting companies from [a position of] not approaching security and privacy from any perspective at all up and running with encryption so that they can actually, at the very least, start to implement the controls, says Curran.
One of the biggest problems that companies have these days is they basically collect data and the data sort of gets sprawled across both their implementation and their test sets as well. The benefit of encryption is that you know exactly when data was accessed and how it was accessed. So it just gives people a platform to see whats happening with the data and start implementing those controls themselves.
With C-suite executives paying increasing mind to the need to properly secure data thanks to years of horrific data breach scandals (andbreach dj vu), and also because of updated data protection laws like Europes General Data Protection Regulation (GDPR) which has beefed up penalties for lax security and data misuse a growing number of startups are now pitching services that promise to deliver data privacy, touting tools they claim will protect data while still enabling developers to extract useful intel.
Evervaults website also deploys the term data privacy which it tells us it defines to mean that no unauthorized party has access to plaintext user/customer data; users/customers and authorized developers have full control over who has access to data (including when and for what purpose); and, plaintext data breaches are ended. (So encrypted data could, in theory, still leak but the point is the information would remain protected as a result of still being robustly encrypted.)
Among a number of techniques being commercialized by startups in this space is homomorphic encryption a process that allows for analysis of encrypted data without the need to decrypt the data.
Evervaults first offering doesnt go that far although its encryption manifesto notes that its keeping a close eye on the technique. And Curran confirms it is likely to incorporate the approach in time. But he says its first focus has been to get E3 up and running with an offering that can help a broad swathe of developers.
Fully homomorphic [encryption] is great. The biggest challenge if youre targeting software developers who are building normal services its very hard to build general purpose applications on top of it. So we take another approach which is basically using trusted execution environments. And we worked with the Amazon Web Services team on being their first production deployment of their new product called Nitro Enclaves, he tells TechCrunch.
The bigger focus for us is less about the underlying technology itself and its more about taking what the best security practices are for companies that are already investing heavily in this and just making them accessible to average developers who dont even know how encryption works, Curran continues. Thats where we get the biggest nuance of Evervault versus some of these others privacy and security companies we build for developers who dont normally think about security when theyre building things and try to build a great experience around that so its really just about bridging the gap between the start of art and bringing it to average developers.
Over time fully homomorphic encryption is probably a no-brainer for us but both in terms of performance and flexibility for your average developer to get up and running it didnt really make sense for us to build on it in its current form. But its something were looking into. Were really looking at whats coming out of academia and if we can fit it in there. But in the meantime its all this trusted execution environment, he adds.
Curran suggests Evervaults main competitor at this point is open-source encryption libraries so basically developers opting to do the encryption piece themselves. Hence its zeroing in on the service aspect of its offering; taking on encryption management tasks so developers dont have to, while also reducing their security risk by ensuring they dont have to touch data in the clear.
When were looking at those sort of developers whore already starting to think about doing it themselves the biggest differentiator with Evervault is, firstly the speed of integration, but more importantly its the management of encrypted data itself, Curran suggests. With Evervault we manage the keys but we dont store any data and our customers store encrypted data but they dont store keys. So it means that even if they want to encrypt something with Evervault they never have all the data themselves in plaintext whereas with open-source encryption theyll have to have it at some point before they do the encryption. So thats really the base competitor that we see.
Obviously there are some other projects out there like Tim Berners-Lees Solid project and so on. But its not clear that theres anybody else taking the developer-experience focused approach to encryption specifically. Obviously theres a bunch of API security companies but encryption through an API is something we havent really come across in the past with customers, he adds.
While Evervaults current approach sees app makers data hosted in dedicated trusted execution environments running on AWS, the information still exists there as plaintext for now. But as encryption continues to evolve its possible to envisage a future where apps arent just encrypted by default (Evervaults stated mission is to encrypt the web) but where user data, once ingested and encrypted, never needs to be decrypted as all processing can be carried out on ciphertext.
Homomorphic encryption has unsurprisingly been called the holy grail of security and privacy and startups like Duality are busy chasing it. But the reality on the ground, online and in app stores remains a whole lot more rudimentary. So Evervault sees plenty of value in getting on with trying to raise the encryption bar more generally.
Curran also points out that plenty of developers arent actually doing much processing of the data they gather arguing therefore that caging plaintext data inside a trusted execution environment can thus abstract away a large part of the risk related to these sort of data flows anyway. The reality is most developers who are building software these days arent necessarily processing data themselves, he suggests. Theyre actually just sort of collecting it from their users and then sharing it with third-party APIs.
If you look at a startup building something with Stripe the credit card flows through their systems but it always ends up being passed on somewhere else. I think thats generally the direction that most startups are going these days. So you can trust the execution depending on the security of the silicon in an Amazon data center kind of makes the most sense.
On the regulatory side, the data protection story is a little more nuanced than the typical security startup spin.
While Europes GDPR certainly bakes security requirements into law, the flagship data protection regime also provides citizens with a suite of access rights attached to their personal data a key element thats often overlooked in developer-first discussions of data privacy.
Evervault concedes that data access rights havent been front of mind yet, with the teams initial focus being squarely on encryption. But Curran tells us it plans over time to roll out products that will simplify access rights as well.
In the future, Evervault will provide the following functionality: Encrypted data tagging (to, for example, time-lock data usage); programmatic role-based access (to, for example, prevent an employee seeing data in plaintext in a UI); and, programmatic compliance (e.g. data localization), he further notes on that.
See original here:
Evervaults encryption as a service is now open access - TechCrunch
- WhatsApp rolls out encryption for chats backed up in the cloud - Mashable - October 17th, 2021
- WhatsApp now lets users encrypt their chat backups in the cloud - TechCrunch - October 17th, 2021
- Meet the Alliance for Encryption in Latin America and the Caribbean - EFF - October 17th, 2021
- Apples plan to scan images will allow governments into smartphones - The Guardian - October 17th, 2021
- WhatsApp to bring in encryption for backup chats after privacy fears - The Guardian - October 15th, 2021
- WhatsApp end-to-end encrypted backups are rolling out on both Android and iOS - GSMArena.com news - GSMArena.com - October 15th, 2021
- Encryption: Why security threats coast under the radar - Philstar.com - October 15th, 2021
- Encryption Management Solutions Market 2021 : Industry Analysis ,Size, Share, Revenue, Prominent Players, Developing Technologies, Tendencies and... - October 15th, 2021
- TLS Support Redis - October 12th, 2021
- Signal >> Documentation - October 12th, 2021
- Encryption Consulting announces their first-ever virtual conference - "Encryption Consulting Virtual conference 2021." - Tyler Morning... - October 12th, 2021
- [Update: Rolling out] WhatsApp adds end-to-end encryption for Android cloud backups - 9to5Google - October 12th, 2021
- Homomorphic Encryption Market New Coming Industry to Witness Great Growth Opportunities in Coming Years From 2021 to 2027: Microsoft (US), IBM... - October 12th, 2021
- SmartKargo Incorporates EDIfly Advanced Aviation Messaging At No Cost for Customers of its E-Commerce Logistics Solution - Yahoo Finance - October 12th, 2021
- No outages, no data leaks: The new WhatsApp killer built on the blockchain creates privacy-focused encrypted messenger - Cointelegraph - October 12th, 2021
- Mosyle's $ 16M Series A Drives Growth by Launching the Mosyle Business with the Market's First Encrypted DNS Filtering and Security Solution -... - October 6th, 2021
- Tips to Secure and Encrypt your WIFI Network Security - H2S Media - October 6th, 2021
- Data Encryption Standard (DES)? - All You Need to Know | Techfunnel - TechFunnel - October 4th, 2021
- XSOC CORP Recognized by CyberSecurity Breakthrough Awards Program for Overall Encryption Solution of the Year - Business Wire - October 4th, 2021
- Encryption: Why security threats coast under the radar - Express Computer - October 4th, 2021
- Hardware Encryption Devices Market 2021 Technology Development, Key Manufacturers, Forecast Based on Major Drivers and Trends Up to 2027 - Digital... - October 4th, 2021
- Container security without governance is neither secure nor governed - The Register - October 4th, 2021
- Sectigo Certificate Manager Wins 2021 CyberSecurity Breakthrough Award for Overall Encryption Solution Provider of the Year - PRNewswire - October 4th, 2021
- Customs and Border Protection Signs Major Contract With Amazon-Owned Encrypted Chat App Wickr - Gizmodo - October 4th, 2021
- Encryption cant be used as excuse to deny sharing details to law enforcement: Govt - The Financial Express - October 4th, 2021
- Facebook announces WhatsApp end-to-end encrypted (E2EE) backups - Techiexpert.com - TechiExpert.com - October 4th, 2021
- Bluefin Issues New Payment Security Brief on PCI-validated P2PE for Petroleum and Convenience Stores - PR Web - October 4th, 2021
- Get a lifetime of easy, automatic encryption for all of the files on your computer for just $30 - ZDNet - September 24th, 2021
- Tide encryption is ready to end the cyber breach pandemic - TechCrunch - September 24th, 2021
- The FBI has kept the presence of the encryption key secret from Casey for three weeks. - Cheraw Chronicle - September 24th, 2021
- Braves non-tracking, browser-based video conferencing tool is out of beta - TechCrunch - September 24th, 2021
- 5 ways to stay ahead of government-targeted ransomware - GCN.com - September 24th, 2021
- Encryption Software Market expectation surges with rising demand and changing trends by industry analysis through 2026 Stillwater Current -... - September 24th, 2021
- What Is a Hardware Security Module? HSMs Explained - Hashed Out by The SSL Store - September 24th, 2021
- Making the Most from WEP - Wi-FiPlanet.com - Wi-Fi Planet - September 24th, 2021
- Brave, the startup behind untracked browser-based video conferencing tool is out of beta - Security News - BollyInside - September 24th, 2021
- Hardware Encryption Devices Market Is Expected To Witness Healthy Growth At A CAGR Of More Than 40% - Herefordshire Live - Herefordshire Live - September 24th, 2021
- WhatsApp launches encryption in iCloud and Google Drive backups - InTallaght - September 24th, 2021
- WhatsApp boosts end-to-end encryption - BusinessTech - September 17th, 2021
- WhatsApp to offer encryption on cloud backups: Heres all you need to know - India Today - September 17th, 2021
- London's Top Cop Says 'Big Tech,' Encryption Are Letting The Terrorists Win - Techdirt - September 17th, 2021
- Zoom unveils new security features including end-to-end encryption for Zoom Phone, verified identities and... - ZDNet - September 15th, 2021
- Insights on the Hardware Encryption Global Market to 2026 - by Algorithm & Standard, Architecture, Product, Application and Region - PRNewswire - September 15th, 2021
- Light Start: WhatsApp rolls out backup encryption, LG is more attractive, Google goes dark and iPhones only laak gud vaabs Stuff - Stuff Magazines - September 15th, 2021
- Revenant REvil. WhatsApp offers encryption. Hortum spyware in Turkey. Update on the UN data breach. Healthcare breaches disclosed. - The CyberWire - September 15th, 2021
- How a glitch in the Matrix led to apps potentially exposing encrypted chats - The Register - September 15th, 2021
- Secure cloud storage: which are the most secure providers? - ITProPortal - September 15th, 2021
- WhatsApp is finally allowing users to encrypt chat backups uploaded to iCloud and Google Drive - Buzz.ie - September 15th, 2021
- WhatsApp is adding encrypted backups - The Verge - September 11th, 2021
- What Is Fully Homomorphic Encryption (FHE)? - CIO Insight - September 11th, 2021
- WhatsApp end-to-end encrypted messages arent that private after all - Ars Technica - September 11th, 2021
- UK government backs Apple, and wants to scan encrypted messages for CSAM - 9to5Mac - September 11th, 2021
- VPN and Email Encryption Provider, WiTopia, Inc., Is Now Raising Capital Via StartEngine - PRNewswire - September 11th, 2021
- Future in the cloud for encryption - Capacity Media - September 8th, 2021
- WhatsApps Claims Of End-To-End Encryption Might Be Entirely True - Ubergizmo - September 8th, 2021
- Debunking Wi-Fi Security Myths: Wi-Fi Encryption Is Weak - TechSpective - September 8th, 2021
- WhatsApp Flaw Casts Doubt on End-to-End Encryption - Security Boulevard - September 8th, 2021
- Bluefin Receives U.S. Patent on Systems for Vaultless Tokenization and Encryption - WFMZ Allentown - September 8th, 2021
- Priti Patel backs ad campaign that criticises Facebook's stance on end-to-end encryption - Graham Cluley Security News - September 8th, 2021
- EXCLUSIVE: What's in the new zero-trust strategy - Politico - September 8th, 2021
- 3 ways to protect yourself from cyberattacks in the midst of an IT security skill shortage - Help Net Security - September 8th, 2021
- Apple Has Betrayed Its Privacy Legacy and Will Undermine End-to-end Encryption Everywhere - Privacy News Online - September 8th, 2021
- IBM's first 7nm Power10 chip arrives in E1080 server system with a wealth of shiny features - The Register - September 8th, 2021
- The adoption of multi-cloud drives the need for better data protection and management of encryption keys an... - Security Boulevard - August 26th, 2021
- Cryptomator Vs. BoxCryptor: Which One Is The Best Encryption Software? - Analytics Insight - August 26th, 2021
- Why you should encrypt your data on your computer and how to do it - The Star Online - August 26th, 2021
- Video end-to-end encryption on Ring to be available worldwide - ITP.net - August 26th, 2021
- What is a Vocoder? How an audio encryption device used in WW2 became the sound of electro and modern pop - Mixdown - August 26th, 2021
- Privacera partners with StreamSets to strengthen data security for ETL processing in the cloud - Help Net Security - August 26th, 2021
- R400m cocaine-in-a-boat accused used encryption app to communicate - TimesLIVE - August 26th, 2021
- How to Encrypt Your Own Windows and Mac Devices (and Why You Need To) - Lifehacker - August 24th, 2021
- Why encryption is the key to digital fitness, according to Thales - iTnews - August 24th, 2021
- How to check each of your WhatsApp chats are ACTUALLY private right now and not being intercepted by h... - The Sun - August 24th, 2021
- WebCam: How Australia paved the way for Apple's encryption backflip - Crikey - August 24th, 2021
- Staggering 400% rise in child sexual abuse images detected by Facebook as fears over encryption plans g... - The Sun - August 24th, 2021
- Hardware-based Full Disk Encryption Market 2021 and Analysis to 2027 Micron Technology Inc, Seagate Technology PLC, Toshiba, Intel - The Market... - August 24th, 2021
- WhatsApp could soon have an iPad app for the first time - Engadget - August 24th, 2021
- Facebook is bringing end-to-end encryption to Messenger calls and Instagram DMs - TechCrunch - August 14th, 2021
- Apple opens the encryption Pandora's box - Axios - August 14th, 2021
- How to encrypt your computer (and why you should) - Mashable - August 14th, 2021