Multi-Party Authorisation for Cloud-Based Data Vaults
Businesses are looking to third-party cloud providers to reduce data storage costs, but need confidence that no external party can access sensitive data. At the same time, businesses need to mitigate risks posed by malicious insiders and phishing / whaling attacks.
We ensure that only authorised individuals can access data, requiring multi-party approvals supported by complete audit trail. We encrypt the data and divide the decryption key into fragments, which are divided among stakeholders. If a pre-agreed number of fragment holders approve an access request, the data is made available to the requester. Since it is cryptographically impossible for anyone internal or external to access the data without oversight, third-party clouds become a viable storage option for sensitive data.
“CIOs and CISOs need to stop obsessing over unsubstantiated cloud security worries, and instead apply their imagination and energy to developing new approaches to cloud control, allowing them to securely, compliantly and reliably leverage the benefits of this increasingly ubiquitous computing model.” Gartner, 'Clouds Are Secure: Are You Using Them Securely?’ 21 July 2016