The Future of Information Security is Zero Trust

Share on facebook
Share on twitter
Share on linkedin
Share on email

By Nathaniel Nelson (Guest)

The Problem of Trust in Information Security

Trust may be the single most dangerous word in information security.

It has been in the room during just about every data breach in history. When a secretary opens an email attachment, or a link, because it came from a friend or colleague; or when company subscribes to a service that guarantees security. Trust was what Target had for Fazio Mechanical Services, what Nortel had for Huawei, and what the NSA had in Edward Snowden.

Perhaps more than anyone, RSA Security was in the business of trust. They had a sterling reputation in the cybersecurity community, which they used to sell premier product: the “SecurID” authentication token, a trust-generating machine.

It was quite a simple thing: a little key fob device with a screen that displayed six-digit codes. The codes were pseudo-randomly generated, every sixty seconds, to provide two-factor authentication for users. Essentially, with SecurID, organizations could assume that only the right people were accessing their sensitive systems. For years, this was a correct assumption.

Then, in March 2011, an employee at RSA Security noticed strange activity happening over his company’s network.

It wasn’t surprising that hackers had targeted RSA – the company’s client list included some of the largest organizations in the world. Entities within the U.S. government used SecurID, as did their military contractors, and Walmart, and everyone else, too. RSA was the key into all these organizations. Literally, they had everyone’s keys: like one big, great doorman to the richest tenants in cyberspace.

The problem, in retrospect, is that all those keys were kept in a single lockbox. More specifically, a server: a single, highly guarded server nicknamed “the seed warehouse” because it held all the seed values (keys) associated with every SecurID token in the world.

From Wired Magazine:

If someone could steal the seed values stored in that warehouse, they could potentially clone those SecurID tokens and silently break the two-factor authentication they offered, allowing hackers to instantly bypass that security system anywhere in the world, accessing anything from bank accounts to national security secrets.

The exact details of what got stolen and who got hurt by it are disputed to this day. But, really, none of that is the point here. The reason RSA’s breach is still newsworthy today is not because of what happened back then, but how it reflects upon what’s happening today. Because even today we’re still falling into the very same traps.

Take SolarWinds, the target of the most severe data breach of the past decade. SolarWinds, like RSA, was attacked by a nation-state actor. Like RSA, they were targeted not because they themselves were so valuable, but because they were implicitly trusted by so many valuable clients. RSA had keys to everybody’s systems, SolarWinds managed everybody’s networks.

So how do we stop these kinds of attacks? How do we make sure that, in 2031, we’re not telling the same old story all over again?

The Solution to Trust in Information Security

The solution is “zero trust,” a popular, growing philosophy in cybersecurity that seeks to eliminate trust from network environments. It may sound simple, but it’s not. It requires authentication and constant verification of every entity that accesses an organization’s systems. That applies to every RSA, every SolarWinds, but also internal personnel, even down to low-level employees. In zero trust, Colin from Marketing and Mike from Engineering are threats.

Fortunately, you won’t have to stand over Mike’s shoulder while he’s working or follow Colin home to make sure he’s not a spy. There are network segmentation and access management tools to keep the wrong people out of the wrong places. Artificial intelligence algorithms can instantly and efficiently enforce zero trust rules, or catch unpermitted activity over even very large, active networks. And emerging technologies are providing even more novel paths to zero trust in information security.

Quantropi’s innovative approach to data security is one of these new technologies. Powered by quantum mechanics expressed as linear algebra, Quantropi delivers the three unique capabilities every complete cryptographic solution should have — Trust, Uncertainty, and Entropy (we call it TrUE Quantum Secure Solutions). Trust between any two parties is established through our implementation of Quantum-secure asymmetric encryption … Uncertainty provided by our Quantum Entropy Expansion and Propagation (QEEP™) symmetric encryption technology so that no matter what, an attacker can never access your data … and Entropy, strong keys and strong random numbers that unlock and enable secure communications and data.

Interested in finding out more about how Quantropi is rising to the cybersecurity challenge and how our solutions can protect your business-critical data? If so, why not sign up to receive occasional news and updates.

(Image via Wikimedia Commons).

Share on facebook
Share on twitter
Share on linkedin
Share on email

Talk To Us

Patricio Mariaca

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vestibulum quis mauris justo. Vestibulum vel nulla vel tortor dignissim auctor. Donec porta semper lacus, id mollis metus pretium at. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Nam malesuada ullamcorper metus, eget facilisis tortor posuere sed.

Eric Chan

Eric Chan a.k.a. EEPMON is a Crypto / Digital Artist with 15 years in the industry – and Quantropi’s Creative Emissary. His hybrid fractal/digital creations have been seen in fashion, comics to museums and has exhibited worldwide. EEPMON’s collaborations include Canada Goose, MARVEL, Snoopy, Microsoft Xbox, Canada Science & Technology Museum and was a TEDx performing artist. In 2018 he represented Canada on its first Creative Industries Trade Mission led by Canada’s Minister of Heritage and serves on the Canadian Museums Association‘s Board of Directors. At the same time, he is currently completing his Master of Information Technology – Digital Media at Carleton University. 

Christopher McKenzie

With his extensive experience in software development and strong analytical skills, Chris can handle the entire end-to-end software development life cycle. Prior to Quantropi, he served as Director of Product Development at Sphyrna Security, Inc., where he managed the delivery of security compliance automation and data diode appliance products, and as Commercial Software Development Manager at Cord3, Inc., where he managed the development of an advanced data access policy management product. Chris graduated from Computer Science at Algonquin College and the Ottawa School of Arts in 1998. Read less

Dafu Lou

Dafu is Quantropi’s Director of engineering. Prior to Quantropi, he served as a technical leader at Irdeto, a world-leading provider of digital platform security software, where he was responsible for white-box cryptography, cloaked CA secure core, and iOS/android application protection services, among others. Prior to Irdeto, Dafu served as a senior software engineer at SecureNex Systems, where he led the implementation of an SSL-VPN solution and ECC-based secure data storage & PKI. He earned his Ph.D. in electrical engineering from the University of Ottawa in 2009. Dafu is also a part-time professor, teaching VLSI, Cryptography and other subjects at uOttawa.

Pauline Arnold

As James Nguyen’s EA, Pauline Arnold brings more than 40 years of experience in complementary customer service and administrative roles. Prior to Quantropi, she served 20 years as Branch Manager and an assistant in investments, and over 20 years at Metropolitan Life Canada in various aspects of the insurance sector – assisting clients, management and colleagues to complete tasks, solve problems, address questions and achieve goals. She also worked part-time for Royal Lepage Performance for 5+ years as a receptionist & admin, and for 5 years was chair of the TKFG’s charity golf tournament.

Bond Vo

Bond Vo is the Business Analyst of Quantropi. Along with Quantropi, Bond has been dynamic in accordance with a fast and evolving startup environment and is responsible in a wide range of areas including market research, funding, and more involved in the controller roles to oversee day to day accounting operation as well as build financing models and budget to achieve company’s ultimate goals/objectives. Bond has applied best practices consistently and successfully supports equity, debt, and non-dilutive funding for Quantropi since joint the team. He earned a Bachelor of Commerce concentrated in Finance from Carleton University. Outside of his professional career, Bond also participated in volunteer for the Vietnamese Immigration Student Association (VISA) to help and support students as well as newcomers in Canada.

Tina Wang

Tina develops websites and participates in a range of different projects, using new frameworks for front-end UI, along with Vuejs, Angula, Beego, Ruby on Rails, and Electron. She developed Quantropi’s desktop CipherSpace application by integrating Electron, Webassembly and Go, to ensure a good user experience, as well as perfect operating system compatibility. She is also part of the dynamic and efficient QKD-NODE project team. Tina is always looking for new ways to increase her knowledge, improve her technological proficiency and enhance her strong execution and implementation skills. Prior to Quantropi, Tina served as a full-stack web developer at Sunny Future, where she maintained a WordPress home site and managed the release of new content for the company.

Nick Kuang

As VP Corporate Services, Nick plans, directs and coordinates a wide range of activities aimed at achieving Quantropi’s vision of the Quantum Internet. He has a keen interest in transformative technologies and the possibilities they offer for bettering our everyday lives. A pharmacist by training, Nick nurtures teams with a focus on integrity and collaborative effort, coupled with strong attention to detail. With prior experience in a successful biotech start-up developing point-of-care test kits, he enjoys the fast pace and challenge of the start-up environment.

Alex He

Alex is a product-oriented project manager who bridges the gaps between the company’s engineering and commercial teams. He has over ten years of experience in the analysis, design and development of enterprise-class applications, with a particular focus on creating optimal user experiences (UX). Ever passionate about cybersecurity solutions that can deliver solid security without unreasonably sacrificing customer convenience, Alex is the lead inventor of a registered patent on user interface security. He is committed to helping ensure that the Agile software engineering team at Quantropi delivers consistently high-quality, high crypto-agility cybersecurity solutions for next-generation communications.

Michael Redding

Before joining Quantropi, Mike was Managing Director and co-founder of Accenture Ventures, where he grew a global portfolio of strategic partnerships and 38 equity investments in emerging technology startups.

During his nearly 30 years with Accenture, he incubated and launched technology innovations for enterprises across multiple geographies and industries. Ever-passionate about bold ideas with game-changing results, he speaks frequently on the impact of emerging technology on large organizations.

With a bachelor’s degree in Electrical Engineering and Computer Science from Princeton, and a Master’s in Biomedical Engineering from Northwestern, Mike is a former member of the Board of Directors for the Accenture Foundation and Board Observer for startups Maana and Splice Machine.

Raj Narula, P.Eng.

Raj is a seasoned technology executive who has worked with companies as an advisor, business builder and active angel investor. Raj is a seasoned technology executive who has worked with companies as an advisor, business builder and active angel investor. He has held operational and advisory roles in Recognia (Trading Central ), Belair Networks ( Ericsson) , March Networks ( Infinova) , Sandvine ( Procera ), Neurolanguage ( ADEC) ,Bridgewater Systems (Amdocs), Vayyoo ( Cafex ) TenXc ( CCI ),1Mobility ( Qualys ) and others. He has been dividing his time between North America, EMEA, and the Asia Pacific region for over 20 years and speaks multiple languages. He grew up in Asia, Europe, South America and Canada. Raj is also the co-founder and Charter Member of the Ottawa chapter of TiE (the Indus Entrepreneur). Raj holds a B.Eng degree in Mechanical Engineering from the University of Ottawa, Canada.

Ken Dobell

Ken leads marketing strategy at Quantropi. In high demand as a consultant with 25 years’ experience in performance media and an award- winning creative background, he has completed successful transformations, (re)branding and product development mandates with KPMG, Keurig, Fidelity, Eddyfi, Coveo, and more, and provides digital advice to the CMA. Previously, Ken pivoted an offline advertising brokerage to a leading-edge, data-driven performance agency as President of DAC Digital, held a progression of international leadership roles with Monster.com, pioneered a range of multi-channel initiatives as VP Marketing with a global franchisor, and introduced a mobile-first programmatic media offering to Canada within WPP.

Cory Michalyshyn

Cory brings a breadth of experience to the Quantropi team, working fractionally with multiple SaaS technology companies as CFO, and as the CFO with Celtic House Venture Partners. Prior to these roles, Cory was CFO and COO at Solink, and played a lead role in the metrics-led pivot to a direct-sales SaaS model, followed by multiple VC-backed funding rounds and their recognition as one of the fastest growing start-ups in Canada. He qualified as a CPA while serving technology, VC & PE-fund clients at Deloitte, and earned his Bachelor of Commerce at Queen’s University.

Dr. Randy Kuang

Randy holds a doctorate in quantum physics. His research findings have been published in top international journals and named “Kuang’s semi-classical formalism” by NASA in 2012. With a career spanning IT, including with Nortel as senior network researcher & developer, he co-founded inBay Technologies in 2009, serving as CTO of the cybersecurity platform. As the first recipient of a patent for two-level authentication (2011), Randy is a prolific inventor, with 30+ U.S. patents in broad technology fields, such as WiMAX, optical networks, multi-factor identity authentication, transaction authorization, as well as concepts, technologies and industrial applications for quantum key distribution.

James Nguyen

Prior to leading Quantropi, James was Chief Investment Officer & VP Asia Operations for a group of private and public real estate, mining, energy storage, graphene technologies and manufacturing interests, where, in his responsibilities for strategy, banking and global expansions, he secured large-scale investments and partnerships for commercializing graphene applications across multiple industries. A graduate of Carleton in Economics, he previously achieved success managing a mid-market portfolio (professional services, public sector, Asian markets) at RBC for over a decade. James has been on the HKCBA board, held advisory positions with technology start-ups and gives back as volunteer, fundraiser and mentor.