8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 1/30
Look Up: It’s a Bird! It’s a Plane!
It’s your Sensitive Data in the Cloud!
Joel RosenblattDirector, Computer & Network Security
Columbia University in the City of New York
Eric ChavDirector, Technica
CloudLoc
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 2/30
Look Up: It’s a Bird! It’s a Plane! It’s your Sensitive Data in the C
Topics for Discussion:
Users work the way they live
Columbia University - a snapshot
DLP - What is it and why do you care?
A new security model (people-centric)
1
2
3
4
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 3/30
Users are working the way they live: What the media says
a lot of the more interesting innovations areentering through the consumer channels first
The dream off
employees should be empoweredwhatever technology they need
problems at hand.
When it comes to shadow IT, CEOs must
support users first
David Linthicum
InfoWorld
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 4/30
Users are working the way they live: Productivity vs. Security
● By and large, your userswant to do the right thing
● Users look to gain
efficiency at work througheasier collaboration anduse of apps
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 5/30
Users are working the way they live: User-enabled Apps
H O M E
W O R K
login via to gain access to
login via to gain access to
Spotify need
Mindmeister nee
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 6/30
Columbia University - a snapshot
Users work the way t1
Columbia University - a s
DLP - What is it and why do yo
A new security model (people-
2
3
4
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 7/30
Columbia University - a snapshot
● Large research university
(Intellectual Property)● 65,000 MAC addresses active on
average● No sniffing traffic or scanning
machines allowed● No university-wide (corporate like)
firewalls● Between 50,000 - 80,000 active
email accounts
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 8/30
4 13
Columbia University - a snapshot
25 20k17 4SCHOOLS
AFFILIATESCHOOLS
LIBRARIES EMPLOYEES
UNDERGRAD GRADUATE
9.5MM
VOLUMES
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 9/30
Columbia University - Support Model
Central IT (CUIT)Departments,
Schools, Affiliates
EMAIL NETWORK
PAYROLL / FIN SERV.
STUDENT SERVICES
MAIN WEB SERVERS
SELF SUPPORT orPURCHASE CUIT
● Can lead to an imbalance in support coverage (rich departments get stronger support)
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 10/30
Old on-prem security paradigm challenges
Users work the way t1
Columbia University - a s
DLP - What is it and why do yo
A new security model (people-
2
3
4
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 11/30
What is DLP and why do you care?
● Data Loss Prevention or Data Leak Prevention
● How to stop the exfiltration of information eitherthrough loss, theft or hacking● Privacy Laws
● FERPA - Family Educational Rights and PrivacyAct
● HIPAA - Health Insurance Portability andAccountability Act
● NYS Internet Security and Privacy Act● Institutional policies● $$$$
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 12/30
Create a DLP Plan and make it INCLUSIVE of the Cloud
● Get authority to deal with t
Governance● Define what is important –
Classification Policy● Define a policy to deal with
found
● Find all of the data – This ione
● Wash, Rinse and Repeat
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 13/30
Governance
● Who do you report to?● What is your authority?● Who funds the project?
● Can you change yoursituation?
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 14/30
Data Classification (Achievable in the Cloud)
● Don’t go crazy (more is not better)
● Columbia has four classes:
● Data can be classified (tagged) in the cloud
CONFIDENTIALINTERNALPUBLIC
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 15/30
Protecting your Data
● Get rid of it (don’t collect data that you don’t
● Obfuscate it● Encrypt it
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 16/30
Finding your data
● A Bloom filter was created with every SSN we could
● Sources for finding possible SSNs● HR● Finance/Payroll● IAM● Student services
● Alumni
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 17/30
Finding your data
● A file containing certified
● Now what?● What group owns the dat● Who created the file?● Is the file needed?
● Old file
● Current business proce● Can the file be deleted, a
encrypted?● Establishing ownership is
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 18/30
Finding your data within the Cloud (Google Drive Example)
● We have contracted with the CloudLockcompany for monitoring Google Drivehttp://www.cloudlock.com/
Di
C l a s s i f i c a t i o n
C
Apps...etc.
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 19/30
Consequences of Losing your Data
● The number of sbreaches are on
● NYS disclosure l
estimate that eacSSN will cost be$150 and $200
● Front page of the NYTimes, Washington Post,etc.
● Student confidence● Employee confidence● Possible Job Loss
Reputational Damage Financial Damage
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 20/30
Consequences of Losing your Data - Doing the Math
1 FILE
DOB
SSN
ADDRESS
PHONE
5,000 RECORDS
At a $194 cost per SSN loss….
FIN
$970
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 21/30
A New Security Model
Users work the way t1
Columbia University - a s
DLP - What is it and why do yo
A new security model (people-
2
3
4
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 22/30
With or without the support of traditional storage administrators,
storage is infiltrating organizations via developers, businessstakeholders, and end users, and I&O teams must look to embrause of these services to complement existing storage infrastrucresources. Beyond the potential cost reduction benefits of cloudthese services can provide business stakeholders with instantanaccess to resources and let systems of engagements extend th
of data to customers and partners.
The cloud is a viable option for data storage: Analysts agree
What the Evolution of Cloud Storage m
Henry Baltazar, James Staten with ChristopheFebruary 14, 2014
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 23/30
Users have options - something has to change in security
● A proliferation of storage solutions has enabled the
see alternatives to the thumbdrive and network sha
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 24/30
Old on-prem security paradigm challenges: User frustration mou
PASSWORD
REQUIRED
NOTALLOWED!!
SECURITYVIOLATION
PROJECT
DEADLINE
VPNTIMEOUT
YOU DIDN’THIT SAVE
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 25/30
Old on-prem security paradigm challenges: Path of least resistan
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 26/30
A new security model (people-centric): Allow the users to work
● IT / Security teams can be enablers in Higher Edu
○ Permit users access and authority to work○ The cloud IS safe and IS an option○ Make policies well known○ Reach out to users on an as-needed basis
ALLOW INFORM EDU
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 27/30
A new security model (people-centric): Trust your users
● IT / Security teams new focus:
○ Trust the users○ Work with trusted vendors○ Enable users to meet their needs
■ Progressive student population■ Faculty is equipped to work
productively● IT can focus on core programs and
projects for enhancing productivityacross the college / university
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 28/30
Name: Susan BlakeSSN: 025-62-0091DOB: 01/12/1995
English Studies
123abc987xyz
A new security model (people-centric): Educate the user
Biology Lab
123abc987xyz
INFORM &EDUCATE
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 29/30
Summary - Strike the Balance Between Security and Productivity
● IT security has c
● Users are more sand technically cthan ever before
● Responsibility of
teams to inform educate
● Guide the user tosmart choices
8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)
http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 30/30
Joel RosenblattDirector, Computer & Network Security
Columbia University
Eric ChaDirector, Technical
CloudLock
Thanks!