Truth-not-Trust

Project Information

TNT

Grant agreement ID: 881092

DOI

10.3030/881092

Project closed

EC signature date 7 February 2020

Start date 1 March 2020

End date 31 August 2022

Funded under

• INDUSTRIAL LEADERSHIP - Innovation In SMEs

Total cost

€ 2 694 082,50

EU contribution

€ 1 885 857,00

Coordinated by

GUARDTIME OU
Estonia

Periodic Reporting for period 2 - TNT (Truth-not-Trust)

Reporting period: 2021-03-01 to 2022-08-31

Summary of the context and overall objectives of the project

Any action in any information system leaves a trail - a log recording of who did what and when. Whether it is a financial transfer or access to a medical record - it is crucial to maintain the integrity of the trials as well as the applications producing them. TrueTrail comprehensively solves the integrity problem for audit trails and provides heightened situational awareness of the state of underlying systems.

Truetrail enables organizations to streamline compliance reporting, handle disputes and maintain true situational awareness. It is built on KSI Blockchain - Guardtime’s patented mass-scale integrity attestation infrastructure which is an eIDAS qualified trust service for timestamping.

The new features and functionalities developed during the TNT project enable us to implement a highly scalable business model, significantly shorten the sales and implementation cycles, and target new customer segments. We are half-way through the project and have significantly improved our technical capabilities, built up commercialization readiness, and started with pilots. Based on further market research and customer feedback during the first project period, we have widened the scope of our value offering from audit trail authenticity assurance to continuous compliance attestation. By this, we are capable of solving a wider range of cybersecurity and auditability challenges for our targeted customers.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

WP1 – Verifiable log foundation development
By the completion of WP1, we have achieved technical flexibility of the overall solution. We have developed a loosely coupled, modular solution to adapt to customer requirements swiftly (in most cases by configuration or minor customization, compared to weeks to months of development previously required). We have also implemented a dynamic orchestration environment for running Truetrail components to support cloud-based and on-premise operational and scalability requirements.
Significant results of WP1 include unified KSI Signature+metadata format and support for main commonly used audit log types.

WP2 – Verification intelligence development
We have been working to assure that the verification is easy and automated by simplifying user experience while maintaining a high level of security. This means that besides the ability to make use of verification policies and schedules, the verification logic has to be made intelligent to make sure that the automated verification is able to discover incidents and anomalies at least as good as a human expert. Verification tools need to understand the contents of the events and respond based on expected behavior (alerting and reporting). The work under this work package will be continued in the second period of the project.
Significant results of WP2 so far include the definition and partial implementation of different verification scenarios and the continuous compliance assessment concept.

WP3 – Integration capabilities development
Work done under this work package involves improving user experience through visualization and easily customizable and configurable UI components. As an end result, we will provide our clients a clear view of the state of their verification processes and allow the signing and verification processes to be monitored both by human users and any external tool for further automatization. This work package is ongoing and most of the effort on enhancing user experience is yet to be done in the second period of the project.
Significant results of WP3 so far include the definition of the data model and interfaces for end-user tools and the initial implementation of our end-user dashboard.

WP4 –Piloting
We have started with the first pilot earlier than originally planned in the critical infrastructure sector. Our pilot customer is SMIT, the IT and development center for the Ministry of Interior in Estonia (www.smit.ee). They have an acute need for assuring the authenticity of audit trails of their services (~2500 in total) and we found a good fit with the TrueTrail product. The SMIT pilot has served as a valuable opportunity to combine the technical development in WP1-WP3 with customer’s real environment tests and specific requirements. This pilot has a bit more R&D nature in it than what is anticipated from further pilots but all the work done will have significant replicability and scalability potential. Two additional pilots are planned for the second period, concentrating on other business domains and streamlined integration.
The key validation point of the pilot is proof of scalability - assuring immutability of audit trails at such scale is not feasible with classical PKI-based technologies.

WP5 - Commercialization and dissemination
The work done under this work package is to ensure the commercial success of TrueTrail and, thereby, the growth expectations of the company. We have compiled and continuously updated a commercialization plan, implemented a process for lead generation and customer outreach, and building up the early pipeline for sales and piloting. We have participated in events, carried out tens of potential customer interviews and meetings, and published articles/blog-posts. The global pandemic situation has impacted our business development goals but by now we have adapted to the new situation and expect to ramp up the commercialization activities in the next period.
The significant results of WP5 so far include the launch of the Truetrail web-page, legal analysis of applicable regulatory requirements, reach-out to hundreds of potential customers, and tens of potential customer meetings.

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

TrueTrail brings three key differentiators: 1) massive scalability; 2) real-time awareness and 3) independent verification to help organizations to cope with the ever-increasing complexity, volume, and risks in digital environments and processes.

Continuous state monitoring of system states and comparison to regulation-specific baselines has the potential to change the paradigm of IT auditing. The current state of IT auditing is often based on “tick-boxing” - an IT auditor inspects the access control list and finds it to be consistent with the set policy. This attests that at this given moment the right roles have the right privileges. However - there is no proof of what has happened to the control list between the audits (often an annual practice).

With Truetrail, we are tackling such challenges by introducing the concept of continuous auditing with the technical ability to efficiently scale across billions of events per second. Truetrail monitors the state of all digital assets and immutably records any changes to them at source and immediately, thus creating a chain of the provenance of every node in the network, security control, database entry, etc for complete process integrity. When you add pre-defined baselines of expected asset states, it gives you the capability to detect any discrepancies (near) in real-time.

As a result, it allows you to independently verify, without the reliance of any trusted third parties and complex governance procedures, that you are compliant with the defined policies at any point in time and prove that there have been no discrepancies. So instead of an annual tick-box bureaucracy, you have automated compliance proof on a continuous basis with cryptographically provable evidence.

truetrail.png