are your cloud services secure and compliant today?
DESCRIPTION
The cyber threat landscape is evolving faster than security teams can manage without dramatically increasing headcount. As IT organizations seek to achieve new levels of IT efficiency and value for the hybrid cloud, both security and compliance headaches increase in severity as well. See how HP is delivering advanced, data-driven security technologies designed to empower security operations to run more efficiently for the Hybrid Cloud. Register for this webinar to learn how you can benefit from a new style of IT through the combined wealth of information assimilated from multiple sources to provide you valuable insights that impact your business. In addition you will learn how you can enjoy the use of secure compliant cloud services, that can be consolidated in one view and automated to the click of a button.TRANSCRIPT
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
Are your cloud services secure and compliant?Delivering security through cloud service automationSridhar Karnam, Sr. Manager, Product MarketingHP Software
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.2
How much do hackers pay? $499$499$499$399$33$55$99$88$99
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.3
Cloud enables large surface area for attackersThreat landscape
State funded
LulzSecAnonymous
Providers
Infrastructure
Consumers
Attacks24 Million
40 Million
95 Million
101 Million
130 Million
Cloud
Hactivists
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.4
Current solutions are not enough
Providers
1000+ Security vendors
Infrastructure
Consumers
Too much data
Too manysolutions
Too perimeter focused
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
The result
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.6
average time to detect breach
24
3days
2012 January February March April May June July August September October November December 2013
January February March April
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.7
Security is a board level discussion
Security is a bigger than just an IT problem
CISO
Cyber threat56% of organizations have been the target of a cyber attack
Data Breach94% of the data breaches were reported by third-parties
Financial loss $8.6M average cost associated with data breach
Cost of protection 11% of total IT budget spent on security
Reputation damage 30% market cap reduction due to recent events
Reactive vs. proactive
97% of data breaches could have been avoided
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.8
97%
of the breaches could be prevented through simple controls such as log management
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.9
Compliance landscapeAnnual cost of SOX compliance: $1.8M or equivalent cost of roughly 14.4 employees!
• Any similarities in compliance activities?• User management• Access control/authorization• Change management• Security operations • Differences is mainly in interpretation
• Leverage similarities to increase efficiencies and reduce costs
• Consistent themes across regulations
ISO 27001
ISO 17799
COSO
SOX
PCI
SAS 70 NIST
Basel II
ITIL
CobiT
FFIEC
HIPAA
GLBA
FISMA
FERC/NERC
J-SOXUS Patriot Act
CA-1386
SEC
DITSCAP
PIPEDA
NY Privacy
NIACAP
FDPA
DATA
FTC
OCC
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.10
Security Operations
IncidentManagement
Access / Authorization
User Management
SOX
FISMA
OperationsManagement
HIPAA
PCI
CobiT
NIST
70% similarities between compliance & security
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.11
Why use multiple tools then?
Text Common
challenges
ComplianceSecurity
Cloud services
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.12
Who is responsible for cloud security?
PaaS
IaaS
SaaS
Application
User
Consumer responsible Provider responsible
Application
Information
O/S
Network
Physical
O/Simage
Information
Application• Increasing security responsibilities at the information, application & user layers
• Reducing visibility into O/S, network, and physical layers
• Examples:
• IaaS: Amazon EC2
• PaaS: Heroku, Google Apps
• SaaS: SalesForce.com
IaaS PaaS SaaS
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.13
Choice: Open, extensible architecture offers greater flexibility with support for industry standards, open APIs and integration with 3rd party products and services
Confidence: Complete management across traditional IT and cloud offers lower cost and simplifies operations
Consistency: Comprehensive, end-to-end solution allow you to meet business SLAs with secure, compliant cloud services
Transform your IT with HP Hybrid Cloud ManagementGreater flexibility, simpler operations and more comprehensive end-to-end solutions
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
Here is how HP ArcSight helps you secure your cloud…
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.15
Comprehensive & continuous monitoring of cloud
% of the Digital Universe that actually is being tagged and
analyzed
Competitive advantage in the digital universeMassive amounts of useful data are getting lost23%
3%% of data that would be
potentially useful IF tagged and
analyzed
% actually being tagged for Big Data Value (will grow to 33% by 2020)
0.5%¹Source: IDC The Digital Universe in 2020, December 2012
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.16
HP ArcSight Log management and SIEM solution
What we do?
Collect
Store
Analyze
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.17
What is ArcSight?
5 minutes to generate IT GRC report ArcSight content generates IT GRC reports that otherwise would take 4 weeks
3 days to run an IT auditSearch results yield audit-quality logs that otherwise would take 6 weeks
10 minutes to fix an IT incidentFull-text searching of any data enables incident resolution that otherwise would take 8 hours
4 hours to respond to a breachArcSight enables forensic investigation and a quick response to a data breach that otherwise would take 24 days
2 days to fix a threat vulnerabilityArcSight builds threat immune that otherwise would take 3 weeks
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.18
How do we do it? Feature Benefit
Collect Collect logs from any device, any source, and in any format at high speed
Enrich Machine data is unified into a single format through normalization and categorization
Search Simple text-based search tool for logs and events without the need of domain experts
Store Archive years’ worth of unified machine data through high compression ratios
Correlate Automate the analysis, reporting, and alerting of machine data for IT security, IT operations, and IT GRC
?
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.19
HP ArcSight & Cloud services deliver
Universal log management
Compliance & risk management
Perimeter, data center & network security
Insider threat mitigation
Advanced persistent threat remediation
Mobile security
Data privacy & data loss prevention
Application & transaction monitoring
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
Deploy Logger within CSA in three simple steps
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.21
Modular packaging designed for cloud transformation
HP Cloud and Automation Ultimate Suite
Service lifecycle management
Resource/Capacity management
Automation and Orchestration
Compliance
HP Products: HP Cloud Service Automation, HP Server Automation, HP Operations Orchestration, HP Database and Middleware Automation, UCMDB, ArcSight Logger, HP SiteScope
IaaS, PaaS, SaaS
Security: Access Mgmt
Application Perf. Mgmt
HP Business Service Mgmt
Asset ManagementHP Asset Manager
Business Management
HP Executive Scorecard
Application SecurityHP Fortify
Network SecurityHP Tipping Point
DevOpsHP Continuous Delivery
Auto.
BackupHP Data Protector
Portfolio Management
HP Product and Portfolio Mgmt
Help DeskService Performance
Mgmt
Add optional features as needed
Get started quickly with HP Cloud and Automation Ultimate Suite
Note: HP ArcSight Logger’s 6 months trial available through HP Cloud Service Automation Ultimate Suite .
Alternatively, download a copy of the HP ArcSight Logger Trial Software from:www.hp.com/go/hplogger
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.22
HP ArcSight Logger Service Design
Deployment step 1:
Log into a CSA consumer portal and select HP ArcSight Logger
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.23
Supply the required information, to complete the request for the subscription
Deployment step 2:
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.24
Once completed, you can look at the subscription, and access HP ArcSight within HP CSA
Deployment step 3:
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.25
managed cloud
SaaS
Sto
rag
e
Apps
●●
Continuous compliance
in-house/legacycustom apps
SIEMlog management
Ap
plicati
on
s
350+ CEF partners
Big
Data
Cloud security
Insi
der
thre
ats
Secu
rity
An
aly
tics
Mobile Monitoring
Secu
rit
y
Virtual
IT operations
Systems Monitoring
Thank you
© Copyright 2013 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.26
HP Cloud Management: hp.com/go/cloudmanagement HP Cloud Service Automation: hp.com/go/csa
HP Software’s premier customer event: hp.com/go/discover
HP Software’s Community of IT Professionals: hp.com/go/swcommunity
HP Software Education Services: hp.com/software/educationHP Software Support Services: hp.com/go/hpswsupportHP Software Professional Services: hp.com/go/hpswprofessionalservices
For more information: [email protected]
Additional resources