look up: it's a bird! it's a plane! it's your sensitive data in the cloud!...

8/11/2019 Look Up: It's a Bird! It's a Plane! It's Your Sensitive Data in the Cloud! (236887648)

http://slidepdf.com/reader/full/look-up-its-a-bird-its-a-plane-its-your-sensitive-data-in 1/30

Look Up: It’s a Bird! It’s a Plane!

It’s your Sensitive Data in the Cloud!

Joel RosenblattDirector, Computer & Network Security

Columbia University in the City of New York

Eric ChavDirector, Technica

CloudLoc



Look Up: It’s a Bird! It’s a Plane! It’s your Sensitive Data in the C

Topics for Discussion:

Users work the way they live

Columbia University - a snapshot

DLP - What is it and why do you care?

A new security model (people-centric)

1

2

3

4



Users are working the way they live: What the media says

a lot of the more interesting innovations areentering through the consumer channels first

The dream off

employees should be empoweredwhatever technology they need

problems at hand.

When it comes to shadow IT, CEOs must

support users first

David Linthicum

InfoWorld



Users are working the way they live: Productivity vs. Security

● By and large, your userswant to do the right thing

● Users look to gain

efficiency at work througheasier collaboration anduse of apps



Users are working the way they live: User-enabled Apps

H O M E

W O R K

login via to gain access to

login via to gain access to

Spotify need

Mindmeister nee




Users work the way t1

Columbia University - a s

DLP - What is it and why do yo

A new security model (people-

2

3

4




● Large research university

(Intellectual Property)● 65,000 MAC addresses active on

average● No sniffing traffic or scanning

machines allowed● No university-wide (corporate like)

firewalls● Between 50,000 - 80,000 active

email accounts



4 13


25 20k17 4SCHOOLS

AFFILIATESCHOOLS

LIBRARIES EMPLOYEES

UNDERGRAD GRADUATE

9.5MM

VOLUMES



Columbia University - Support Model

Central IT (CUIT)Departments,

Schools, Affiliates

EMAIL NETWORK

PAYROLL / FIN SERV.

STUDENT SERVICES

MAIN WEB SERVERS

SELF SUPPORT orPURCHASE CUIT

● Can lead to an imbalance in support coverage (rich departments get stronger support)



Old on-prem security paradigm challenges





2

3

4



What is DLP and why do you care?

● Data Loss Prevention or Data Leak Prevention

● How to stop the exfiltration of information eitherthrough loss, theft or hacking● Privacy Laws

● FERPA - Family Educational Rights and PrivacyAct

● HIPAA - Health Insurance Portability andAccountability Act

● NYS Internet Security and Privacy Act● Institutional policies● $$$$



Create a DLP Plan and make it INCLUSIVE of the Cloud

● Get authority to deal with t

Governance● Define what is important –

Classification Policy● Define a policy to deal with

found

● Find all of the data – This ione

● Wash, Rinse and Repeat



Governance

● Who do you report to?● What is your authority?● Who funds the project?

● Can you change yoursituation?



Data Classification (Achievable in the Cloud)

● Don’t go crazy (more is not better)

● Columbia has four classes:

● Data can be classified (tagged) in the cloud

CONFIDENTIALINTERNALPUBLIC



Protecting your Data

● Get rid of it (don’t collect data that you don’t

● Obfuscate it● Encrypt it



Finding your data

● A Bloom filter was created with every SSN we could

● Sources for finding possible SSNs● HR● Finance/Payroll● IAM● Student services

● Alumni



Finding your data

● A file containing certified

● Now what?● What group owns the dat● Who created the file?● Is the file needed?

● Old file

● Current business proce● Can the file be deleted, a

encrypted?● Establishing ownership is



Finding your data within the Cloud (Google Drive Example)

● We have contracted with the CloudLockcompany for monitoring Google Drivehttp://www.cloudlock.com/

Di

C l a s s i f i c a t i o n

C

Apps...etc.

http://www.cloudlock.com/



Consequences of Losing your Data

● The number of sbreaches are on

● NYS disclosure l

estimate that eacSSN will cost be$150 and $200

● Front page of the NYTimes, Washington Post,etc.

● Student confidence● Employee confidence● Possible Job Loss

Reputational Damage Financial Damage



Consequences of Losing your Data - Doing the Math

1 FILE

DOB

SSN

ADDRESS

PHONE

5,000 RECORDS

At a $194 cost per SSN loss….

FIN

$970



A New Security Model





2

3

4



With or without the support of traditional storage administrators,

storage is infiltrating organizations via developers, businessstakeholders, and end users, and I&O teams must look to embrause of these services to complement existing storage infrastrucresources. Beyond the potential cost reduction benefits of cloudthese services can provide business stakeholders with instantanaccess to resources and let systems of engagements extend th

of data to customers and partners.

The cloud is a viable option for data storage: Analysts agree

What the Evolution of Cloud Storage m

Henry Baltazar, James Staten with ChristopheFebruary 14, 2014



Users have options - something has to change in security

● A proliferation of storage solutions has enabled the

see alternatives to the thumbdrive and network sha



Old on-prem security paradigm challenges: User frustration mou

PASSWORD

REQUIRED

NOTALLOWED!!

SECURITYVIOLATION

PROJECT

DEADLINE

VPNTIMEOUT

YOU DIDN’THIT SAVE



Old on-prem security paradigm challenges: Path of least resistan



A new security model (people-centric): Allow the users to work

● IT / Security teams can be enablers in Higher Edu

○ Permit users access and authority to work○ The cloud IS safe and IS an option○ Make policies well known○ Reach out to users on an as-needed basis

ALLOW INFORM EDU



A new security model (people-centric): Trust your users

● IT / Security teams new focus:

○ Trust the users○ Work with trusted vendors○ Enable users to meet their needs

■ Progressive student population■ Faculty is equipped to work

productively● IT can focus on core programs and

projects for enhancing productivityacross the college / university



Name: Susan BlakeSSN: 025-62-0091DOB: 01/12/1995

English Studies

123abc987xyz

A new security model (people-centric): Educate the user

Biology Lab

123abc987xyz

INFORM &EDUCATE



Summary - Strike the Balance Between Security and Productivity

● IT security has c

● Users are more sand technically cthan ever before

● Responsibility of

teams to inform educate

● Guide the user tosmart choices



Joel RosenblattDirector, Computer & Network Security

Columbia University

Eric ChaDirector, Technical

CloudLock

Thanks!

[email protected]

mailto:[email protected]

look up: it's a bird! it's a plane! it's your sensitive data in the cloud!...

Documents