February 2024 Summaries

The Payment Card Industry Data Security Standard (PCI DSS) is a critical framework designed to secure credit card information for companies that handle such data, though its implementation can be complex and costly, often requiring significant resources for compliance. While the standard is crucial for protecting payment data and maintaining customer trust, the compliance process involves various roles and can be expensive, with audits costing upwards of $65,000. Businesses can reduce the compliance burden by outsourcing card processing to third-party providers like Evervault, which can significantly minimize the scope of PCI DSS requirements by encrypting sensitive data before it enters the business environment. This strategy allows companies to focus on their core activities while reducing the risk of cardholder data breaches and compliance costs. Organizations must ensure third-party providers comply with PCI DSS requirements through due diligence and contractual agreements, considering both the benefits of enhanced security and cost savings, and the potential risks like dependency and reduced control over data. Compliance can be achieved through Self-Assessment Questionnaires or a Report on Compliance by a Qualified Security Assessor, depending on transaction volumes, with Evervault offering solutions to streamline the process and descope environments from many PCI DSS requirements.

Evervault has been using AWS Nitro Enclaves for nearly three years and encountered unexpected clock drift issues that were not documented, leading to significant time discrepancies over time, which affected operations relying on precise timing. Initially, the clock drift was unnoticed because the encryption engine within Enclaves handled non-time-sensitive tasks and was frequently patched. However, during beta testing, users began experiencing errors related to certificate validation and token issuance due to inaccurate enclave time. An investigation revealed that the clock drift was proportional to the load on the enclave and that the clock was not synchronized after startup. As an interim solution, Evervault periodically restarted enclaves and later implemented a method to sync enclave time with the hypervisor clock, reducing drift to microseconds. To achieve more accuracy, Evervault plans to employ Cloudflare NTS for time synchronization from a trusted NTP server.

Confidential computing has emerged as a significant advancement in cybersecurity, using secure enclaves or trusted execution environments (TEEs) to protect sensitive data through hardware-based cryptographic attestation and stringent network isolation. This approach addresses the limitations of traditional security measures by ensuring that real-time processing environments are tamper-free, verified by an external component known as a verifier. While homomorphic encryption remains impractical due to its slow processing speed, TEEs offer a feasible solution for secure data processing, albeit with some vulnerabilities like side-channel attacks and the need for robust verifier logic. The introduction of products like AWS Nitro Enclaves and Evervault's Secure Enclaves further enhances these capabilities by integrating with cloud services and simplifying the attestation process for developers. Despite challenges in implementation, TEEs represent a critical tool for businesses seeking to protect sensitive data against increasingly sophisticated threats, making non-adopters more susceptible to breaches.

Evervault initially used Amazon Cloudmap for service discovery to deploy apps into trusted execution environments, but faced issues with DNS update timing that caused downtime during Enclave deployments. These issues included premature and delayed traffic routing due to mismatched health checks. Attempts to resolve this with Cloudmap configurations were unsuccessful, leading Evervault to explore alternatives. They eventually migrated to Consul by Hashicorp, which provided a more reliable solution for service discovery without the need for a full service mesh. Consul's system involves a cluster of servers and agents that manage service registration, health checks, and routing more effectively. The adoption of Consul not only removed downtime but also enhanced control over internal routing and visibility into the status of each Enclave. Although integrating Consul required more initial effort, it proved beneficial due to its robust features, extensive documentation, and supportive community.

Evervault has introduced Enclaves, designed to facilitate the deployment of applications within a Confidential Computing environment, specifically using AWS Nitro Enclaves. This initiative addresses the initial limitations of Nitro Enclaves, which lack inherent networking capabilities, by enabling optional egress traffic to support a wider variety of applications, such as card payments and blockchain transactions. Initially, the development team experimented with DNS spoofing and SNI-based routing to manage egress networking but found these methods insufficient for scalability and flexibility, prompting a redesign. By leveraging iptables, Evervault refined the egress networking process, allowing traffic redirection without binding to multiple ports and removing the dependency on SNI, thus supporting a broader range of protocols. The new approach also involves caching DNS results to handle dynamic IP changes and implements domain and IP allowlisting to prevent potential supply chain attacks. Overall, these improvements have resulted in a more extensible, user-friendly system that does not confuse users with DNS spoofing or waste resources, while also supporting a wider range of use cases.