May 2023 Summaries

The text discusses the increasing security challenges associated with the growing reliance on APIs (Application Programming Interfaces) in the modern internet landscape. Despite the presence of user-facing security measures like two-factor authentication, the real vulnerability lies in the inadequately secured API access keys, which function as "super-passwords" and can lead to significant data breaches if compromised. The article highlights historical examples of API security failures, such as Justdial's breach and Venmo's public transactions issue, to emphasize the critical importance of robust API engineering and security practices. It also underscores the need for encrypting API keys, routinely cycling them, and employing secrets management software to mitigate the risks of data leaks. Additionally, it points out that while APIs facilitate essential integrations that enhance business operations, they also open multiple attack vectors, making it imperative for developers to prioritize security in their API implementations to protect sensitive information effectively.

Attestation is the process of verifying information about an application, particularly the code it runs, to ensure secure communication. This verification is crucial in Trusted Execution Environments (TEEs), which generate signed attestation documents (ADs) that users can inspect to confirm the code running within the TEE. Code attestation often involves comparing a hash of the code in the AD with an expected hash, though it can be challenging when dealing with large codebases. Public-key cryptography relies on attestation to secure communications, as it ensures that private keys remain confined within the TEE. Without attestation, vulnerabilities such as data leaks and key spoofing can occur. Although signing applications provides some security, it is not foolproof, especially when multiple users interact with the application. Current TEE technologies like Intel SGX, Nitro Enclaves, AMD SEV-SNP, and Intel TDX have varying levels of support and usability for code attestation. To achieve widespread adoption and enhance security, the process of code attestation needs to be simplified for both developers and end-users.

As businesses increasingly rely on technology, implementing a robust cybersecurity strategy, with encryption as a central component, is essential for protecting valuable data and ensuring compliance with global privacy regulations. Encryption not only safeguards data against breaches, which can be costly and damaging, but also helps companies meet stringent regulations like GDPR and HIPAA, thus avoiding hefty fines and legal repercussions. A commitment to encryption enhances customer trust and loyalty, as consumers are wary of businesses with inadequate security measures, and positions a company as an industry leader in data protection. By adopting encryption at the field level, businesses can future-proof themselves against evolving cyber threats, maintain a competitive edge, and potentially reduce the cost impact of breaches, all while fostering a reputation for reliability and security.

Shifting security left by integrating encryption early in the Software Development Life Cycle (SDLC) is crucial for proactive security and compliance, as emphasized by the concept of DevSecOps. By embedding security and compliance measures, such as encryption, from the outset, organizations can ensure a more robust, secure, and cost-effective design while mitigating the risks of data breaches and regulatory non-compliance. Encryption is often overlooked or added late in development, which can lead to vulnerabilities and compliance challenges, particularly with regulations like GDPR, HIPAA, and PCI-DSS that have specific requirements. Early implementation requires understanding data sensitivity, strong access controls, and secure key management, alongside education and training to foster a security-conscious culture among developers. Utilizing standardized APIs and cryptographic libraries can streamline this process, allowing organizations to build security as code and maintain compliance more effectively. The proactive approach of considering encryption from the beginning not only strengthens security but also simplifies meeting regulatory obligations and enhances the overall security posture of the organization.

Evervault has developed a unique engineer-to-engineer support structure to help developers navigate the complexities of integrating encryption into their applications. Initially inspired by Stripe's direct installation approach, Evervault shifted to using shared Slack channels for real-time, personalized support, especially after the COVID-19 pandemic disrupted in-person methods. This system allows them to address issues rapidly, enhance collaboration, and gather direct product feedback, ultimately improving the developer experience and accelerating the sales process. By employing a rotation system for engineers to focus on support tasks, Evervault ensures timely and effective responses, demonstrating that small companies can leverage personalized interactions to gain a competitive edge. This approach fosters trust and encourages open communication, differing from public forums like Discord, which serve more as community spaces. Evervault’s commitment to evolving its support model underscores the importance of strong developer relations and continuous improvement in product integration processes.

The Evervault Encryption Engine (E3) is a critical internal service responsible for encryption and decryption operations within the Evervault ecosystem, particularly for the Relay and Cages products. A performance issue arose when a new customer, named Acme, began using Response Encryption with Outbound Relay, leading to increased batch job traffic and subsequently triggering synthetic alarms due to latency spikes. In response, Evervault doubled the instances of Outbound Relay and E3 to manage the load, and conducted detailed load testing using a custom Artillery engine to effectively simulate and analyze traffic patterns. The investigation revealed that the latency was influenced by the use of the secp256k1 (k1) elliptic curve, which was less efficient compared to the secp256r1 (r1) curve, prompting a switch that resulted in a fivefold increase in encryption speed. Additional optimizations included increasing the number of vCPUs per instance, switching to compute-optimized Intel instances for better cost-efficiency, implementing dedicated networking threads to maintain service health, and utilizing per-request encryption keys to significantly enhance encryption speed. These changes collectively improved E3's performance, capacity, and cost-efficiency, while also highlighting potential future areas for optimization such as decryption key caching and hardware-optimized configurations.

Evervault has introduced several updates and new features aimed at enhancing user experience and security. A new Customers Page showcases how clients like Humaans and Ness use Evervault's encryption to meet compliance requirements swiftly. File encryption is now widely available, with demonstrations on encrypting files for upload to S3, and the blog has been redesigned for improved readability. Updates to the Cages feature include an egress allowlist for finer network control, the ability to lock deployments to specific signing certificates, and better synchronization during attestation periods with PCR validation. The platform now supports improved throughput for encrypt and decrypt operations via short-lived key sessions. Evervault has also launched Team Activity Logs for monitoring team actions, and introduced updates to the team experience, such as the Pro Plan for personal teams and the ability to create multiple free teams for better collaboration. Enhanced developer experience improvements have been implemented based on user feedback, and the platform continues to feature informative blog content.