Reinforcing trust by auditable and verifiable systems
Often your users and your partners require efforts beyond regular "just make it secure". They demand transparency and secure audit logging that provides sufficient confidence in your system. PCI DSS audit trails are one side of the coin; settlement logs and system transparency for marketplaces and intermediaries is another.
Modern cryptography offers a whole set of protocols and approaches to back your claims and provide ways to prove your system's behaviour.
Transparent, auditable systems are hard
Audit logging is hard to blend
Dealing with 3rd party sensitive data requires audit logging while preserving the security of sensitive data.
Trusted multi-party logs are crucial
Making audit logs transparent to multiple participants yet preserving sufficient distributed trust and privacy is hard.
Provable logs are hard
Collecting logs through all components and 3rd parties is only the first step. All these logs should be protected against tampering to prove the system's behaviour.
Public merits
Government agencies and public sector organisations need highly transparent security solutions to support their missions.
Modern solutions
Modern crypto enables transparency
Modern cryptographic protocols and transparency constructions that enable third parties to trust that audit log has not been tampered with, that logging process and storage are honest.
Coverage and transparency design
The best systems provide some theoretical and practical guarantees of log completeness. For example, by mapping the data flow or business process to the sequence of tags, which are then verified.
Security and compliance
Aside from transparency and provability, best-in-class systems aim to preserve the security of sensitive data in logs – by masking it out, tokenizing, encrypting or detecting on ingestion in the first place.
Tools and services we offer
To be announced
There's a product that we're preparing to address provable audit logging – Please stay tuned for further announcements.
Read more
Acra
Acra offers a selective and searchable encryption which is easy-to-integrate in already-built infrastructures. It provides verifiable audit logging for all sensitive data operations: access, encryption-decryption, removal, key management, etc.
Read more
Verifiable audit logging modules
We design & build verifiable audit logging components that you can integrate into your software architecture. Different approaches are beneficial depending on your use case – a hash-connected chain of logs, Merkle-trees-based logs, etc.
Have a question? Get a human to answer it!
How we make a difference
Fit to real-world risks
Enabling transparency means not just satisfying some academic set of formal criteria but being sufficiently trustworthy for users and partners involved in your system. Where others theorise — we have hands-on experience.
Cryptographers and data security experts
With extensive cryptographic and software engineering experience, we understand what it takes to match security and cryptography to a product experience. We designed tamper-proof audit logging technologies, integrated them into real systems, and published whitepapers.
For innovators, by innovators
We've started Cossack Labs to develop new tools and methods for protecting the data and enabling novel solutions to emerging problems — so that at the edge of your innovation, you’ve already got fitting tools handy.
Contact us
There are many ways we can help: with our products, bespoke solutions, and engineering services. Leave your contact information to connect with our team:
Relevant stories and posts
Protecting telemetry data of power grids
Protecting data signals transmitted over the air between power distribution stations and central dispatch system.
Security logs: cryptographically signed audit logging for data protection
Why crypto signed audit logs are essential for security software and how we’ve built-in secure audit logging in Acra for defense in-depth.
Cloud security: gaps in a "shared responsibility" model
Security responsibility of cloud providers: where it ends, what are the gaps, and what steps your team should make to improve cloud security strategy.