where data security and value of data meet in the cloud ulf mattsson
Post on 12-Jul-2015
100 Views
Preview:
TRANSCRIPT
Where Data Security and Value of Data Meet in the C loudWhere Data Security and Value of Data Meet in the C loud
Ulf MattssonCTO, Protegrity
Ulf.Mattsson@protegrity.com
Cloud Security Alliance (CSA)
PCI Security Standards Council
• Cloud & Virtualization SIGs
• Encryption Task Force
• Tokenization Task Force
Ulf Mattsson, Protegrity CTO
ANSI X9
• American National Standard for Financial Services
IFIP WG 11.3 Data and Application Security
• International Federation for Information Processing
ISACA (Information Systems Audit and Control Association)
ISSA (Information Systems Security Association)
2
The biggest challenge in this new paradigm• Cloud and an interconnected world
• Merging data security with data value and productivity
What’s required?• Seamless, boundless security framework – data flow
• Maximize data utility & Minimizing risk – finding the right balance
Value-preserving data-centric security methods
Agenda
Value-preserving data-centric security methods• How to keep track of your data and monitor data access outside the enterprise
• Best practices for protecting data and privacy in the perimeter-less enterprise.
What New Data Security Technologies are Available for Cloud?
How can Cloud Data Security work in Context to the Enterprise?
3
The Interconnected
4
World
Safe Integration - International Data Protection
Interconnection of Embedded Computing Devices
6
http://en.wikipedia.org/wiki/Internet_of_Things
They’re Tracking When You Turn Off the Lights
7
Source: Wall Street Journal
What is The
8
The New Currency?
Generated a 3.8% increase in the PayPal conversion rate, the proportion of online visitors who make a
Analytics Improving Customer Experience
9
Source: Forbes
rate, the proportion of online visitors who make a purchase.
Overall Average Order Value (AOV) rose 2.4% when the PayPal button was moved to the top of the page.
4.03% increase in overall revenue, a more than $600,000 increase over a nine-week period.
Is Cloud Secure?
10
Secure?
Sensitive Data in the Cloud
11
Of organizations currently (or plan to) transfer sensitive/confidential data to the cloud in the next
24 mo.
Lack of Cloud Confidence
12
Number of survey respondents that either agree or are unsure that the cloud services used by their organization are
NOT thoroughly vetted for security.
Chinese government cyberattack against iCloud
13
What Is Your No. 1 Issue Slowing Adoption of Public Cloud Computing?
14
Threat Vector Inheritance
15
What aboutResponsibilities
16
Responsibilities in Cloud?
Computing as a Service:
• Software as a Service (SaaS)
• Platform as a Service (PaaS)
• Infrastructure as a Service (IaaS)
What is Cloud Computing?
Delivered Internally or Externally to the Enterprise:
• Public
• Private
• Community
• Hybrid
17
Public Cloud
18
Source: Wired.com
19
What’s required?
• Seamless, boundless security framework
• Balance data utility & risk• Balance data utility & risk
20
Hybrid CloudFlexibility
21
Flexibility
Trust
Risk Adjusted Computation – Location Awareness
Corporate Network
Private Cloud
Private Cloud
H
Processing Cost
H
22
Elasticity
Out-sourcedIn-house
Public Cloud
L L
Interconnected Enterprise & Cloud
?
023
?
Can Cloud Computing
24
Cloud Computing be Secure?
Cloud Gateway
Security Gateway Deployment – Application Example
ClientSystem
Public Cloud
025
EnterpriseSecurity
AdministratorSecurity Officer
Out-sourced
Corporate Network
Security Gateway Deployment – Hybrid Cloud
ClientSystem
Public CloudCloud Gateway
Private Cloud
026
EnterpriseSecurity
AdministratorSecurity Officer
Out-sourced
Corporate Network Corporate Network
Security Gateway Deployment – Hybrid Cloud
ClientSystem
Private Cloud Public Cloud
CloudGateway
027
EnterpriseSecurity
AdministratorSecurity Officer
Gateway
Out-sourced
Where to put the Key to the Front Door?
28
to the Front Door?
Trust, Elasticity dimensions and system componentsTrust
Trusted Domain (Corporate)
ClientClientClientClientProtocolGateway
SecurityAgent
29
Elasticity
ApplicationApplicationApplicationApplication
ServerServerServerServer
Application Application Application Application
DatabaseDatabaseDatabaseDatabase
Untrusted Domain
(Public cloud)
Out-sourcedIn-house
Trust, Elasticity dimensions and system componentsTrust
Trusted Domain (Corporate)
ClientClientClientClient ProtocolGateway
SecurityAgent
30
Elasticity
Semi-trusted Domain (Private cloud)
ApplicationApplicationApplicationApplication
ServerServerServerServer
Agent
Application Application Application Application
DatabaseDatabaseDatabaseDatabase
Untrusted Domain
(Public cloud)
Out-sourcedIn-house
Trust, Elasticity dimensions and system componentsTrust
Trusted Domain (Corporate)
ClientClientClientClient ProtocolGateway
Security
31
Elasticity
Semi-trusted Domain (Private cloud)
ApplicationApplicationApplicationApplication
ServerServerServerServer
SecurityAgent
Application Application Application Application
DatabaseDatabaseDatabaseDatabase
Untrusted Domain (Public cloud)
Out-sourcedIn-house
The Trendin
32
inData Protection
Rather than making the protection platform based, the security is applied directly to the data, protecting it wherever it goes, in any environment
How Data-Centric Protection Increases Security in Cloud Computing and Virtualization
Cloud environments by nature have more access points and cannot be disconnected – data-centric protection reduces the reliance on controlling the high number of access points
33
How to Balance Risk and
34
Risk and Data Access
Value-preserving data-centric security methods
• How to keep track of your data and monitor data access outside the enterpriseenterprise
• Best practices for protecting data and privacy in the perimeter-less enterprise.
• What New Data Security Technologies are Available for Cloud?
35
Computational Value
Risk Adjusted Storage – Data Leaking Formats
H
36
Data
Leakage
Strong-encryption Truncation Sort-order-pres erving-encryption Indexing
L
I I I I
Corporate Network
Security Gateway Deployment – Database Example
ClientSystem
CloudGateway
RDBMS
037
EnterpriseSecurity
AdministratorSecurity Officer
Should I AllowData Leakage?
38
Data Leakage?
Corporate Network
ClientSystem Cloud
Gateway
Security Gateway – Searchable Encryption
RDBMSQuery
re-write
039
EnterpriseSecurity
AdministratorSecurity Officer
Order preserving encryption
Corporate Network
ClientSystem
CloudGateway
Security Gateway – Search & Indexing
RDBMSQuery
re-write
040
EnterpriseSecurity
AdministratorSecurity Officer
IndexIndex
Data Centric Security – Risk Adjusted Data Leakage
Index
Trust
HIndex
Leaking
Sensitive
Data
Sort Order Preserving
Encryption Algorithms
Leaking Sensitive
Data
41
Index Data
ElasticityOut-sourcedIn-house
L
Index NOT
Leaking
Sensitive
Data
Data Centric Security – Balance Security & Value
Value
Preserving
Classification of Sensitive Data
Granular Protection of Sensitive Data
42
Index Data
Leaking
Sensitive
Data ?
Encoding
Leaking
Sensitive
Data ?
What is Data Tokenization?
43
Data Tokenization?
Data Tokenization – More Than Wrapping The Data
44
Source: Interestingengineering.com
Source: plus.google.com
De-identification / Anonymization Field Real Data Tokenized / Pseudonymized
Name Joe Smith csu wusoj
Address 100 Main Street, Pleasantville, CA 476 srta coetse, cysieondusbak, CA
Date of Birth 12/25/1966 01/02/1966
Telephone 760-278-3389 760-389-2289
E-Mail Address joe.smith@surferdude.org eoe.nwuer@beusorpdqo.org
SSN 076-39-2778 076-28-3390
CC Number 3678 2289 3907 3378 3846 2290 3371 3378
Business URL www.surferdude.com www.sheyinctao.com
Fingerprint Encrypted
Photo Encrypted
X-Ray Encrypted
Healthcare / Financial Services
Dr. visits, prescriptions, hospital stays and discharges, clinical, billing, etc.Financial Services Consumer Products and activities
Protection methods can be equally applied to the actual data, but not needed with de-identification
45
How GranularShould Data Should Data Security be?
46
Cost of Application
Changes
High -
Risk Adjusted Data Formats - Payment Card Data
Risk Exposure
Cost
47
All-16-clear Only-middle-6-hidden All-16-strongly-encrypted
Low -
I I I
Can SecurityImprove
48
ImproveUser Productivity?
High -
Risk Adjusted Data Security – Access to Data
Risk Exposure
User Productivity and Creativity
49
Access to Sensitive Data in
Clear
Low Access to Data High Access to Data
Low -
I I
High -
Risk Adjusted Data Security – Masked Data
User Productivity and Creativity
50
Access to
Masked Data
Low Access to Data High Access to Data
Low -
I I
Risk Exposure
What isCost -effectiveness
51
Cost -effectivenessof
Data Protection?
Reduction of Pain with New Protection Techniques
High
Pain& TCO
Strong Encryption Output:AES, 3DES
Format Preserving EncryptionDTP, FPE
Input Value: 3872 3789 1620 3675
!@#$%a^.,mhu7///&*B()_+!@
8278 2789 2990 2789
52
1970 2000 2005 2010
Low
Vault-based Tokenization
Vaultless Tokenization
8278 2789 2990 2789
Format Preserving
Greatly reduced Key Management
No Vault
8278 2789 2990 2789
Cloud Gateway - Requirements Adjusted Protection
Data Protection Methods Scalability Storage Security Tr ansparency
System without data protection
Weak Encryption (1:1 mapping)
Searchable Gateway Index (IV)
VaultlessTokenization
Partial EncryptionPartial Encryption
Data Type Preservation Encryption
Strong Encryption (AES CBC, IV)
Best Worst
53
Significantly Different Tokenization Approaches
Property Dynamic Pre-generated
Vault-based Vaultless
54
Fine Grained Data Security Methods
Tokenization and Encryption are Different
Used Approach Cipher System Code System
Cryptographic algorithms
Cryptographic keys
TokenizationEncryption
55
Cryptographic keys
Code books
Index tokens
Source: McGraw-HILL ENCYPLOPEDIA OF SCIENCE & TECHNOLOGY
Use
Case
How Should I Secure Different Data?
Simple –PCI
PII
Encryption
of Files
CardHolder Data
Tokenization of Fields
Personally Identifiable Information
Type of
DataI
Structured
I
Un-structured
Complex – PHI
ProtectedHealth
Information
56
Personally Identifiable Information
How can I Secure Data
in Production
57
in Production and Test?
Fine Grained Security: Encryption of Fields
Production SystemsEncryption of fields• Reversible• Policy Control (authorized / Unauthorized Access)• Lacks Integration Transparency• Complex Key Management• Example: !@#$%a^.,mhu7///&*B()_+!@
58
Non-Production Systems
Fine Grained Security: Masking of Fields
Production Systems
59
Non-Production SystemsMasking of fields• Not reversible• No Policy, Everyone can access the data• Integrates Transparently• No Complex Key Management• Example: 0389 3778 3652 0038
Fine Grained Security: Tokenization of Fields
Production Systems
Tokenization (Pseudonymization)
• No Complex Key Management• Business Intelligence• Example: 0389 3778 3652 0038
60
Non-Production Systems
• Reversible • Policy Control (Authorized / Unauthorized Access)
• Not Reversible• Integrates Transparently
How can I Secure the
Perimeter -less
61
Perimeter -less Enterprise?
Centralized Policy Management - ExampleApplication
RDBMS
MPP
AuditLog
AuditLog
AuditLog
EnterpriseSecurity
Administrator
PolicyPolicyPolicyPolicyPolicyPolicyPolicyPolicyPolicy
Cloud
Security Officer
AuditLog
AuditLog
AuditLog
62
File Servers
Big Data
Gateway Servers
HP NonStopBase24
IBM Mainframe Protector
AuditLog
AuditLog Audit
Log
AuditLog
Protection Servers
AuditLog
AuditLog
Enterprise Data Security Policy
What is the sensitive data that needs to be protected.
How you want to protect and present sensitive data. There are several methods for protecting sensitive data. Encryption, tokenization, monitoring, etc.
Who should have access to sensitive data and who should not. Security access control. Roles & Users
What
Who
How
63
When should sensitive data access be granted to those who have access. Day of week, time of day.
Where is the sensitive data stored? This will be where the policy is enforced.
Audit authorized or un-authorized access to sensitive data.
When
Where
Audit
The biggest challenge in this new paradigm• Cloud and an interconnected world
• Merging data security with data value and productivity
What’s required?• Seamless, boundless security framework – data flow
• Maximize data utility & Minimizing risk – finding the right balance
Value-preserving data-centric security methods
Summary
Value-preserving data-centric security methods• How to keep track of your data and monitor data access outside the enterprise
• Best practices for protecting data and privacy in the perimeter-less enterprise.
What New Data Security Technologies are Available for Cloud?
How can Cloud Data Security work in Context to the Enterprise?
64
Thank you!Thank you!
Questions?
Please contact us for more information
www.protegrity.com
Ulf.Mattsson@protegrity.com
top related