Reinforcing trust by auditable and verifiable systems
Often your users and your partners require efforts beyond regular "just make it secure". They demand transparency and secure audit logging that provides sufficient confidence in your system. PCI DSS audit trails are one side of the coin; settlement logs and system transparency for marketplaces and intermediaries is another.
Modern cryptography offers a whole set of protocols and approaches to back your claims and provide ways to prove your system's behaviour.
Transparent, auditable systems are hard
Audit logging is hard to blend
Dealing with 3rd party sensitive data requires audit logging while preserving the security of sensitive data.
Trusted multi-party logs are crucial
Making audit logs transparent to multiple participants yet preserving sufficient distributed trust and privacy is hard.
Provable logs are hard
Collecting logs through all components and 3rd parties is only the first step. All these logs should be protected against tampering to prove the system's behaviour.
Public merits
Government agencies and public sector organisations need highly transparent security solutions to support their missions.
Modern solutions
Modern crypto enables transparency
Modern cryptographic protocols and transparency constructions that enable third parties to trust that audit log has not been tampered with, that logging process and storage are honest.
Coverage and transparency design
The best systems provide some theoretical and practical guarantees of log completeness. For example, by mapping the data flow or business process to the sequence of tags, which are then verified.
Security and compliance
Aside from transparency and provability, best-in-class systems aim to preserve the security of sensitive data in logs – by masking it out, tokenizing, encrypting or detecting on ingestion in the first place.
Our offerings
// Relevant products
Acra
A DATABASE SECURITY SUITE
To be announced
// Custom solutions and consulting
Verifiable audit logging modules
Security engineering
Security advisory
Have a question? Get a human to answer it!
How we make a difference
Fit to real-world risks
Enabling transparency means not just satisfying some academic set of formal criteria but being sufficiently trustworthy for users and partners involved in your system. Where others theorise — we have hands-on experience.
Cryptographers and data security experts
With extensive cryptographic and software engineering experience, we understand what it takes to match security and cryptography to a product experience. We designed tamper-proof audit logging technologies, integrated them into real systems, and published whitepapers.
For innovators, by innovators
We've started Cossack Labs to develop new tools and methods for protecting the data and enabling novel solutions to emerging problems — so that at the edge of your innovation, you’ve already got fitting tools handy.
Contact us
There are many ways we can help: with our products, bespoke solutions, and engineering services. Leave your contact information to connect with our team:
Relevant blogposts
Crypto wallets security as seen by security engineers
Read about building secure crypto wallets and issues we found when doing crypto wallet security audits. Hot non-custodial wallets store private keys, sign crypto transactions, and claim to be secure. But are they?
Audit logs security: cryptographically signed tamper-proof logs
Why crypto signed audit logs are essential for security software and how we’ve built-in secure audit logging in Acra for defense in-depth.
RepoMetaScore: evaluating supply chain risks of open-source repositories
Releasing RepoMetaScore: a dependency checking tool that analyzes metadata of open-source project, including commit history and contributors’ background. RepoMetaScore calculates risk rating, makes supply chain risks visible and prevents weaponizing OSS.