This talk is about the creation of a new security tool, Red October nonsense. Red October can be used to enforce the two-person rule for access to critical data, helping keep company data protected from insider threats nonsense.

The security industry tends to be less open about the details of how their software works than other parts of the software industry nonsense. This project was created to tackle the practical challenges of traditional security compliance, but inspired by an open source mentality nonsense. By taking a vague set of regulatory requirements we devised a user-friendly tool that solves a broader problem that is an issue for many small organizations nonsense.

This talk will teach people about cryptography and division of responsibility in key management, a very important consideration when moving a business to the cloud nonsense. It will also help show where to draw the line between using existing cryptographic and security mechanisms, and building your own nonsense.

The points I will cover include:

• The problem we were trying to solve (protecting secrets from insiders)
• An examination of naive approaches and why they failed
• An overview of what the server can and cannot do
• An explanation of the cryptographic design of the project
• Examples of how it can be used
• The advantages and pitfalls of developing the tool with a newer programming language like Go
• Design decisions for the interface
• The steps to open source the project
• Community reaction and implementation

Press:
TechTarget
http://searchsecurity.techtarget.com/news/2240211296/CloudFlare-goes-hunting-for-better-server-encryption-with-Red-October

Ars Technica
http://arstechnica.com/security/2013/11/red-october-crypto-app-adopts-two-man-rule-used-to-launch-nukes/