Problem Statement and Goals

The Agency Problem

Background

Companies used to manage their business data in silos, protecting business secrets and client data by defending the outer network perimeter. This practice had either low business continuity or high cost of ownership - sometimes both - and it couldn’t protect data from insider threats. Approaches to solve this problem, such as VDI, were and still are expensive, and their restrictiveness hindered the productivity of the entire organization.

Later, companies began leveraging cloud services to reduce the cost of ownership of their IT systems. This however increased operational risk exposure to a new emerging problem: in the event the cloud/network/certificate authority service is compromised, the company faces significant monetary and reputation damage, and yet they have little recourse as these vendors accept little to no liability.

Risks

This problem, called the Technology Agency Problem, represents a large, unmitigated operational risk for companies that manage highly sensitive operational data such as personally identifying information, financial data, health records, and trade secrets or IP.

Add to that the fact that employees access their company data through mobile phones and work remotely more than ever, and the diversity and complexity of technology vendors that are de facto inside companies' trusted partner circle has grown significantly.

Solution Requirements

Despite the breadth of industries impacted by this problem, there is a minimum set of requirements any solution must satisfy to be considered sound.

Must-Haves

Self-sovereign, data-centric security

A solution must guarantee data confidentiality and integrity. It must provide and be able to verify historical digital signatures. The security guarantee made by the solution should not depend on where the data is, or how it arrived; it should be agnostic. The solution must allow companies to protect their data without having to entrust security to an unaccountable third party.

Break-glass recovery

A solution must operate through, and recover from, degradations in cyber security. In the event of a partial breach of security, e.g. firewall breach or access to data on the cloud, a solution must be able to ensure that the stolen data itself is protected. Upon discovery of said breach, the solution must be able to guarantee protection for subsequently secured data. This is a concept known as forward secrecy.

Ease of integration

A solution must integrate and be interoperable with existing infrastructure and applications. It should interface with well-established technologies and prefer standards when communicating to external systems. It should be approachable by existing development teams and not require retraining, hiring or outsourcing to implement.

If possible, the solution should be able to target multiple CPU architectures and devices. This helps prevent fragmentation, where a business ends up using 2 or more products to achieve similar goals in different environments. This inevitably leads to extra costs, support headaches, and inconsistent end-user experience.

Stakeholders

Below is a table showing the mapping of requirements onto stakeholder roles who need or manage them.

Stakeholder	Role	Expectations
Solution creators	Keychain partners who build applications on Keychain Core. Deploy and support applications for end corporate and individual users	Need to be able to integrate Keychain Core into their environment of choice, including small Internet-connected devices.
Corporate Users	Corporate users distribute Keychain-powered applications to their users and/or clients. They manage application workflow administration.	Expect the solution to integrate into corporate network architectures, support compliance with security regulations such as ISO 27001. Need control over the choice of network, cloud services, architecture. Need to be able to change architecture without restriction by the partner-supplied application. Expect the solution to work globally over different networks regardless of the quality or security of the medium.
Individual end users	Use the partner-created applications for personal scenarios.	Expect the solution to work globally over different networks regardless of the quality or security of the medium. Expect the solution to work transparently on their existing personal devices.

Stakeholder

Role

Expectations

Solution creators

Keychain partners who build applications on Keychain Core. Deploy and support applications for end corporate and individual users

Need to be able to integrate Keychain Core into their environment of choice, including small Internet-connected devices.

Corporate Users

Corporate users distribute Keychain-powered applications to their users and/or clients. They manage application workflow administration.

Expect the solution to integrate into corporate network architectures, support compliance with security regulations such as ISO 27001.
Need control over the choice of network, cloud services, architecture.
Need to be able to change architecture without restriction by the partner-supplied application.
Expect the solution to work globally over different networks regardless of the quality or security of the medium.

Individual end users

Use the partner-created applications for personal scenarios.

Expect the solution to work globally over different networks regardless of the quality or security of the medium.
Expect the solution to work transparently on their existing personal devices.