Decentralized Cybersecurity Management – Michael Loewy, Tide Foundation

This is texturong TV. Hey guys. Thanks for the throw.

We're here with Mike lowey's co-founder of the tide Foundation, which is putting forward a decentralized approach to managing cybersecurity. And I'm going to let him explain how that is and what that is in a second, but it seems to me right now that everything is getting decentralized. So why would security be any different Mike welcome the shop?

Thanks very much. Mike. Appreciate you having meal.

All right, so walk us through this decentralized approach. I know there's something called prism and that's about it. So, how does this work?

And why do we need it? I guess the the why why do we need it is is because the current security Paradigm is is clearly not working very well. every day in the news we read of another breach another breach of huge amount of sensitive consumer information infrastructure being compromised and obviously, you know kind of a broader geopolitical context cyber warfare is now is now something that that leaks out of kind of a military context into into government Enterprise all the way down to consumer.

and it's not through lack of trying 300 billion dollars was spent in 2012 on cyber security and there's like an exploding amount of Damages like 7 trillion dollars was the associated damages and that that figures only skyrocketing. So if no amount of money is is actually solving the problem. That means our existing technology our existing Solutions aren't Working and the reality is that 16 year old can Bridge some of the biggest most well resourced most protective companies in the world not with fancy technology.

But by buying access credentials or compromising access credentials from Super users from employees that effectively hold the case of the Kingdom. So whenever there's a situation where you've got this one central point of failure. that can compromise an entire system and and that central point of failure is basically relying on the need to trust someone then we'll always be vulnerable.

And so that The the approach to decentralize kind of that Authority or that decentralized that that vulnerability is is why? Is why we've taken a new approach. So if we can remove that that's those Central points of failure, then we can create a more resilient digital ecosystem.

Well, everybody is saying that all we need to do is shift to this zero trust model based on identity and that will solve all our problems, but I suspect you have something to say about that. well I thought philosophically I'm completely aligned with that. They the whole approach to not trusting to requiring constant verification makes a lot of sense the problem with that is that if you follow that system follow that chain down to the the ultimate Authority where is where is the thing that that finally makes the decision of yes, I trust you, or I don't trust you.

that thing is is the vulnerability that I was speaking of so whenever You have to rely on something that where a whole bunch of human beings or a whole bunch of software vendors and supply chain effective. We have God like access to that that piece of software that that makes that decision. Then there's nothing zero about the trust you 100% have to trust your identity and access management system, whatever system.

Is that kind of final guardian of authority? And and so what we need to do is make sure that we we take the concept of zero trust and introduce technologies that allow us to remove that the need for complete trust in that core system because if that core system is compromised today then then it's game over. So, how do we go about achieving that because to your point?

There's always going to be some sort of Masters super user who is at the bottom of the authentication process. Is there some other way to think about how we manage identity. So if there's one thing that the the decentralizational blockchain or Bitcoin World introduced to the world that that I think is really interesting.

It's that If you look at if you think you think of the Bitcoin Network as a SAS platform, it's probably the most secure most resilient SAS platform that exists because you don't need to trust it. You're trusting in the mathematics the platform itself. actually has no Authority the authority to do something with your digital asset was pushed to to the extreme outside of the platform itself in the hands of the owners or the users So so once you've asked the system to do something.

You know exactly what it's going to do and you don't need to trust the system. if we take that as a concept and apply that to performing sensitive operations in a typical platform, like authenticating your user or encrypting or decrypting or for providing authorization for something and we do that in a way that you don't need to trust the platform. It's not happening on one single server or behind, you know one single company's brand on a piece of software that you've got no visibility to then then we can we can actually create a new way of Performing these operations in a way that you don't need to trust them.

And that's now possible by taking those the concept of decentralization and applying that in a way that you performing the sensitive operations, but where you're not reliant on any one individual one server or one brand to actually perform that operation. So in much the same passion that blockchain works in my slicing up some subset pieces of identity and distributing them and then if we all collectively agree. That I am me then will allow our particular process to go forward is that yeah in layman's terms kind of how it works.

Yeah, so yeah, absolutely. So if we think about let's say your identity in the system in the form of a cryptographic key. So like on the Bitcoin Network, you're Authority comes from the fact that you are the only one holding that key.

So you bring your Authority or your identity to the system to to actually enable it. And if you if you kind of think about that in the context of let's say your identity that might sit encrypted inside of your telcos database or your bank's database if you're able to kind of bring that Authority so that it becomes available. When you've given the authority when it should be available as opposed to sitting there in the context where the it admin basically has carb lunch access if they wanted it.

then then we're basically making sure that that information is only access when and how it should be with with the full Authority and visibility of of those that kind of own that piece of data. So In much the same way we historically played around with decentralized storage and we sliced up the data and then you pulled it together to make sure it was Secure and nobody could access it. We're in theory if I understand this slicing up the identity in a similar fashion, so that no one person can or no one system can be compromised to put the identity together.

Yeah, correct. So instead of instead of Distributing and breaking up Paces of data, so they've got let's say it's a huge file. For example, you need to then pile at an access and pull it from a whole bunch of different service in order to use it that information can actually sit encrypted in in the same down by sits today.

It's actually the authority over that piece of data or the dancing that owns a piece of data that we're Distributing in a way that's you can't compromise The Authority so it actually doesn't matter where that encrypted piece of data sits because to unlock it you need to ask this this key this decentralized authority to unlock it for you and it'll only do that in a way that when it has permission to do so. All right. Well this all sounds like something that is easier said than done.

So what do we have to do to make it a reality? Well, they yeah as a concept it it makes sense the to enable that it required years of R&D on our end to effectively create some new mathematics new cryptography to enable it. So there's a there's a well known idiom in the in the cyber security industry that you don't roll your own photography for good reason.

If you if you get wrong you have either locked whatever is behind that cryptography forever or something that you think is locked is not in fact locked. So it's not something that you you take upon lightly. but the opportunities for doing things in a different way doing things in a decentralized way meant that creating new cryptography to enable that was it was an accessity and and once you kind of start going down that track it creates a whole bunch of new opportunities a whole bunch of different ways to have basically inbuilt trust in in our digital ecosystem so that the way that we we share identities the way that we authenticate the way that we transact with each other can be done in a way that once you figuratively turn your key on the end.

You don't need to trust anything in the middle in order to do that. So it required new mathematics new cryptography. It required that that cryptography to be validated by a number of universities and and it requires scrutiny.

So this is the kind of technology that can't exist in a black box. It needs it needs scrutiny. It needs to be open codes so that the security comes from the Integrity of the mathematics, not from obscurity Do I slipstream this into my existing it environment?

So we'll align the entirely new platforms that are optimized around this approach to Identity and we're gonna have to kind of build the entire stack over again. That's an awesome question. I think anything that requires us to build a stack again from scratch.

It's pretty much a nonstada the way that the internet has evolved. There's never been a scenario where we've just said. Okay.

Well, let's let's build a new internet. And in fact anytime that's been attempted. It's failed.

So we that for this technology to to actually proliferate it needed to be done in a way that the the End customer and the end users Had absolutely no change to the two years of experience and for the for the business who said like I want to adopt this technology, it's tickable box. So the way that we we embed the technology is actually through the platforms that companies already using so our technology is integrated into the password manager into the CRM into the platform vendor who then has a whole bunch of companies using it and a whole bunch of end users using it for the for the end users. They actually don't need to know that there's any difference.

So there's absolutely no change to the user experience. All this has to happen in a way that doesn't require end users to manage wallets or mnemonic phrases or cryptographic keys. So the way that the the authenticator and this this comes back to prison which you raise in your in your intro the way that the authentication works even even that has to be done in a way that can be done for a website with the username password in the same way that does today.

It's just that we have to make sure that there's no Central repository or Passwords that live inside of an organization's database and the way the authentication is is conducted is also not kind of beholden to a single system or a single brand or a black box that we have no visibility to that we know as administered by an army of people in a supply chain. Ultimately who's gonna drive this conversation and it's been historically an issue because you've had developers creating kind of Secrets within their applications and then you've had security people trying to figure out how to authorize access and yeah always feels to me a little bit like that proverbial jump all that lands in the middle and nobody catches. So what is the right approach here for how we should be thinking about how we should organize ourselves to address this issue which seems to be at the core of much of our fundamental insecurity?

The the reality is that there are some secrets in inside of the platforms that are just too sensitive to exist and certainly too sensitive to existing in anyone's hands. Like if you think about like a root certificate inside of an identity and access management system. It doesn't matter how many factors of authentication you're asking your users to use in order to Identify themselves to the platform if someone can access their Roots certificate.

They can do anything they want they can access any resource in the organization. Similarly, if you're talking about let's say a key that locks a billion dollars worth of institutional Bitcoin. Those kind of secrets are necessary because they perform Atomic actions.

But a too sensitive to to exist in a sense. so if if it's easy for platform developers, so those building the platforms that that need to use those Secrets but should never have access to the secret themselves. And we make it easy for those developers to be able to.

Generate a secret but in secret. So here's what this secret needs to do. Here's where he's who can and can't access the secret and that that is done in a verifiable way so that the developer can see how it works.

The end users can can verify that whether it should have should have let's say The ability to ask this this key or this secret to do something can verify how it works. But in a way that the developers don't need access to that that secret so they can't accidentally upload it on to GitHub. There's no one person that administers this this system so that they effectively have access to where those Secrets or the keys to the key vault as a as it exists today.

Even if you're using a key Vault to hold those Secrets someone still holds the key to the cable. So what we've done is remove the need to hold the key to the cable and if we make it easy for developers to to kind of spawn a secret and say Here's how you're gonna work. I don't want to have access to you.

Then we kind of cut cut off that that risk, but but also make it really easy so that it lives inside of the platform and he then don't need this this Patchwork of solutions to protect around, you know, another vulnerability or another vulnerability not just kind of patching around the the problem. We've kind of removed remove the problem. And folks well, as I think it was Ben Franklin once noted the only way that three can keep a secret is if two were dead that's not really gonna work for us.

So maybe we need to approach to how we keep secrets and manage identity Mike. Thanks for being on the show. No worries.

Thanks very much for having us on all right back to you guys in the studio.