Security
Security principles
Security is the product. These are the principles Black Vault Remote is being designed and built around, and the standard we intend to be held to.
-
Citadel authorization is mandatory
Every session, attended or unattended, has to be authorized by Citadel. We are building it so that there is no setting, mode or shortcut that skips it.
-
Fail closed
If a security check fails, or Citadel can't reach a decision, the request is refused. An error is never treated as permission.
-
Least privilege
Viewing a screen, controlling it, transferring files, using a terminal and elevating privileges are separate permissions. Granting one never quietly grants another, and access is scoped to the session that was authorized.
-
Cryptographic device identity
Each enrolled device holds its own cryptographic identity, created on the device. Access is tied to a specific, enrolled device rather than to a name, an address or a shared password.
-
Short-lived, session-scoped authorization
Permission to connect is issued for one session and expires. It can be renewed, narrowed or revoked as conditions change.
-
Audited sessions
Authorization decisions, sessions and administrative changes are designed to be recorded in a tamper-evident audit trail that administrators can review but not rewrite.
-
Evidence we can stand behind
Citadel separates what it has verified from what a device reports about itself and from what is unavailable. We won't present one as the other.
-
Established cryptography
We build on established, widely reviewed cryptographic standards and well-maintained libraries. We don't invent our own cryptography.
Where we are
Black Vault Remote is pre-launch. These are design principles we are building toward, not statements that every capability is available today.