Modern data security solutions
The default state of sensitive data should always be "encrypted unless it is part of an active computation" (Ten Commandments of Software by the US Department of Defense). In 2022, enabling the “data at rest encryption” checkbox and using TLS are not enough to call it “a data security system”.
Modern data security layer allows to keep data encrypted but searchable, anonymized for BI teams, and available for authorized users. We have been building various data security solutions since 2014 to keep data highly usable, software products fast and efficient, and business flows uninterrupted.
Typical challenges with data security
Developers are not crypto engineers
For many developers, cryptography is terra incognita: trial and error approach leads to improper cryptographic choices, using low entropy secrets, storing keys poorly, or even home-brewing their own crypto.
Key management is hard
Key management flow is more than "how to generate keys and where to store them". It depends on tech stack, product UX, key rotation, revocation and incident response policies, regulations and compliance.
Compliance is vague
There is a growing gap between the general compliance demands — which cannot be implemented by a standardised checklist — and the practical implementation efforts. Crypto export regulations and compliance demands are quite far from the capabilities of modern crypto.
Attackers are not a myth
Cryptographic Failures is #2 of OWASP Top10 2021. Practical and exploited crypto-related bugs are everywhere: padding oracle, DROWN, CRIME, Lucky Thirteen, ROCA, and many more.
Modern data security solutions
Novel methods to make crypto more usable
Approaches like searchable encryption (encryption that allows searching for data without decrypting it), format preserving encryption, homomorphic computations, zero-knowledge proofs, PQC, and so on.
Anonymisation and tokenisation
Encryption, anonymisation, and tokenisation can work together for better flexibility and security of data processing. Privileged applications receive data in plaintext, while non-privileged ones receive pseudonyms.
Application level encryption
ALE with deep data-flow integration becomes a new standard. Client-side (like in MongoDB) or server-side (like in Acra) encryption allows to encrypt sensitive data fields before storing them in the database.
Our offerings
// Data security software
Acra
A DATABASE SECURITY SUITE
Themis
A CROSS PLATFORM CRYPTO LIBRARY
Hermes
END-TO-END SECURE DATA STORAGE
To be announced
// Custom design and implementation
Custom data security engines
Multi-layered protections
Searchable encryption
// Consulting
Auditing and reviewing
SSDLC
Product security strategy
Have a question? Get a human to answer it!
How we make a difference
Extensive experience and expertise
As a cryptographic R&D team, we're engaged in building custom data security controls in various contexts. We've gained extensive expertise in learning practical threat models and failure scenarios and mitigating them with sound security controls.
Security for unique cases
We build data security layers for complicated use cases: encrypted CRDT-based data collaboration, multi-device & multi-user synchronisation, DRM-like protections for TensorFlow ML models, UX-friendly security for apps that work on millions of devices.
Transparent to you, transparent to users
We build security measures to mitigate core threats of your product, without causing a headache of your developers, without delaying releases' schedule or ruining UX for your users.
Built to last
Our work is based on maintainability, backwards compatibility, and support. Your encrypted data will never be lost because of the outdated npm package.
For innovators, by innovators
We've started Cossack Labs to develop new tools and methods for protecting the data and enabling novel solutions to emerging problems — so that at the edge of your innovation, you’ve already got fitting tools handy.
Contact us
There are many ways we can help: with our products, bespoke solutions, and engineering services. Leave your contact information to connect with our team:
Relevant blogposts
Defense in depth security strategy based on data encryption
Defence in depth approach to building secure apps explained with the help of Acra encryption suite.
Acra 0.90.0: application level encryption and searchable encryption for any SQL and NoSQL databases
Acra Community Edition 0.90.0 – database security suite for SQL and NoSQL databases, which comes with application level encryption, searchable encryption, and encryption-as-a-service API available for any developer.
Audit logs security: cryptographically signed tamper-proof logs
Why crypto signed audit logs are essential for security software and how we’ve built-in secure audit logging in Acra for defense in-depth.