Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

5/22/2020
12:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Former Salesforce Execs Launch Data Protection Startup

Cloud-based API service stores and manages sensitive consumer data with a zero-trust, database-as-a service approach.

A security startup that employs a zero-trust type of model described by one of its founders as a "need-to-know basis" for protecting personally identifiable information emerged from stealth mode this week with a $7.5 million seed funding round.

Skyflow — co-founded last year by former Salesforce vice president of platform Anshu Sharma and Prakash Khot, the former CTO of AthenaHealth and former senior vice president of engineering at Salesforce — has launched a cloud-based service that uses a group of secure application programming interfaces (APIs) that allow businesses to access and manage sensitive customer data such as Social Security numbers, credit card information, and healthcare data.

"What we keep seeing is people failing to protect the data, and the root cause of all of this is the obsession with compliance" only, says Sharma, co-founder and CEO of Skyflow. Existing approaches such as pure tokenization, hardware security modules, and various data encryption schemes require a team of experts to manage, he says. "You need an Ocean's 11."

Sharma says his company's approach was informed by technologies such as Apple's ApplePay that processes payment without storing credit card data in the cloud, as well as Twilio's secure APIs for telephony, for example. Skyflow's platform, he says, provides an end-to-end service that includes logging, access control, and data residency or storage, and polymorphic encryption.

The service stores the data in secure database "vaults" and ensures that when the data is shared among applications, only the necessary information is shared and it's anonymized and masked.

"Technically, we are like a database-as-a-service," he explains, with options for businesses to maintain their own encryption keys to the database instance, or Skyflow can manage them. "The net net is that it's a dedicated environment that has data layers controlled by them and code and management done by us."

Skyflow's encrypted database can handle Social Security numbers and credit card numbers, for example, using tokens that are homomorphically encrypted so that "internal applications never need access to the real data that's encrypted," he explains. This allows a third-party payment process, for example, to check a bank balance without needing or seeing whose account it was, he says.

A new study released this week from identity security firm Okta found a gradually growing interest in API security worldwide for businesses digitizing their operations with supply chains and other third parties. Some 21% of organizations say they plan to secure their APIs, with 40% in Europe and 30% in Australia and New Zealand, the study found.

With data breaches showing no signs of abating, data protection technology has been evolving, including beyond pure encryption and tokenization to more flexible and easier-to-manage approaches. "When organizations seek to protect their internal, sensitive data assets, an often-overlooked factor is the material impact it will have on their internal workers. Yes, you can block access to everything and call it a day, making it 'secure.' But how will that affect your data analysts? Or self-service analytics users?" says Paige Bartley, senior analyst at 451 Research, now part of SPG Global Market Intelligence. "Technologies that facilitate the secure use of sensitive assets let business users go about their jobs with minimum frustration and friction."

Bartley says approaches such as homomorphic encryption, for example, give businesses enough information from the data, without exposing the sensitive details. "If you frustrate the average workers within your organization, they will devise maladaptive work-arounds that undermine the security effort as a whole," she notes.

Startup ShardSecure, which launched last year, employs a data-shredding approach to securing sensitive data, for example. It automatically "shreds," mixes, and moves data such that it's unreadable if it lands in the wrong hands. Bob Lam, CEO and co-founder of ShardSecure, says his approach is focused on data security at the data layer.

451's Bartley notes that decentralized approaches to managing sensitive data can help protect it from attackers because "it is much easier to breach a single monolithic database than it is to crack dozens or even hundreds of decentralized repositories."

The trade-off, however, is that you may not have the full view of the data you once had. "A 'single pane of glass' view of data is typically easier to monitor for risk and security threats," she notes.

Big-Name Backers
"Anshu and Prakash recognized the power and potential of the cloud while we were all at Salesforce," Todd McKinnon, CEO of Okta, said in a statement. "Every business needs to be digital to compete, and trust has become so core to building a brand. Digital privacy along with identity and security will only become more important as organizations evolve and grow online."

Skyflow's seed round was led by Foundation Capital's Ashu Garg, and joined by former CEO of GE Jeff Immelt and former AthenaHealth CEO Jonathan Bush. The company has hired experts in encryption, databases, key management, cloud security, and tokenization from Microsoft, Salesforce, Oracle, PayPal, and Cohesity, it said.

Related Content:

 
 
 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register


Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
spin2020
100%
0%
spin2020,
User Rank: Author
6/11/2020 | 9:43:36 PM
Skyflow approach.
This is a great approach and I hope Skyflow guys will make it work.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing Writer,  9/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12505
PUBLISHED: 2020-09-30
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some special parameters without authentication. This issue affects: WAGO 750-852 version FW07 and prior versions. WAGO 750-880/xxx-xxx version FW07 and prior versions. WAGO 750-881 ve...
CVE-2020-12506
PUBLISHED: 2020-09-30
Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW03 allows an attacker to change the settings of the devices by sending specifically constructed requests without authentication This issue affects: WAGO 750-362 version FW03 and prior versions. WAGO 750-363 version ...
CVE-2020-4629
PUBLISHED: 2020-09-30
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message. This information could be used in further attacks against the system. IBM X-Force ID: 185370.
CVE-2019-17098
PUBLISHED: 2020-09-30
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior version...
CVE-2020-15731
PUBLISHED: 2020-09-30
An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448.