Use Cases Oriented Portfolio. Marko Bobinac PreSales Engineer, Identity & Data Protection

Transcription

1 Use Cases Oriented Portfolio Marko Bobinac PreSales Engineer, Identity & Data Protection

2 Identity and DataProtection portfolio ProtectFile Server/Desktop Agent Network Share Encryption Proxy Protect NAS Storage File Shares Tape Backups Protect V Manager Virtual Appliance Hardware Security Modules Appliance Certificate Infrastructures Nat. IDs E-Passports E-Signatures Authentication Management (On-Premise or Cloud) AMI Metering Protect Infrastructure Protect Cloud & Virtual Infrastructure 2 Trust. Every day. Virtual Instances Virtual Storage AWS, VMWare, Azure, SoftLayer **##** Tokenization Protect Data Centers Applications (.NET, JAVA, KMIP, XML) Databases Key Secure Appliance File encryption L2 HighSpeed Encryptors 3 rd party solutions (e.g. Self-encrypting drives via KMIP) Ethernet FiberChanel Protect Data Transfer Protect Identities

3 Hardware Security Modues Providing root of trust

4 Gemalto HSM Portfolio SafeNet Network HSM SafeNet PCI HSM SafeNet USB HSM PS Internal Express2 ProtectServer External2 SafeNet Java HSM SafeNet Payment HSM 4

5 Use-case: Appliance Private key protection & Strong Authentication SSL Keys are stored in a SafeNet Network Attached HSM SSL SSL Enterprise Applications SafeNet Authentication validates user identities

6 Use-case: Securing Private keys of SSL Proxies Stores SSL keys in a secure FIPS Level 2 or 3 tamper-proof hardware appliance. Private SSL key never leaves the hardware appliance. Offloads SSL transactions from the proxy to accelerate operations. Provides administrators with full key control in accordance with regulatory regimes (PCI DSS, SOX, HIPAA, etc.) 6

7 Use-case: Securing PKI (economic option) Advantages - Most economic setup - Cost benefits Root CA & Issuing CA & OCSP Responder Diadvantages - Single Points-of-Failure - No redundancy - Root Key separated, but not locked on a separate device - No RemotePED Luna SA6 Luna Backup Device (offline, securely stored in vault) Partition A Private Key of Root CA Partition B Private Key of Issuing CA Partition C Private Key of OCSP Resp 7

8 Use-case: Securing PKI (high-security setup) Advantages - Load balancing & high availability - Root Key separated - Redundancy of backups Luna G5 Root CA Issuing CAs OCSP Responder Diadvantages - No spare systems (offline, securely stored in vault) - No dedicated backup systems - Issuing CAs/OCSP Responder share same HSMs - High Availability Group - Cluster Setup - Geographically Located Luna Backup Devices (offline, securely stored in vault) Luna SA6 Partition A Private Key of Issuing CA A Partition Private Key of Issuing CA Partition Private Key of OCSP Responder 8

9 Use-case: Visa and MasterCard Cloud Based Payments Handset used to make contactless transaction Payment details are de-tokenised by card scheme Merchant Acquirer Switch (Scheme) Issuer PCI-HSM 2.0 certified SafeNet Payment HSM

10 HSM Partner Ecosystem 332 HSM Integrations

11 Payment Partner Integrations 58 Payment Integrations

12 Enterprise Key Management Decoupling keys from the data

13 Data Protection Best Practices Protect Data Protect Keys Encrypt or Tokenize Apply Access Controls Decouple KEYS from DATA Manage Key Lifecycle Apply Access Controls

14 Demo available

15 Data Protection Framework with KeySecure and Connectors PARTNERSHIPS ECOSYSTEM Apache Hadoop IBM BigInsights Oracle Microsoft SQL IBM DB2 MySQL MongoDB Cassandra Amazon Web Services Microsoft Azure HP Dell NetApp Storage Chef Docker POINTS OF PROTECTION SQL Databases NoSQL Databases Storage Archive Tapes Big Data ERP & CRM Files, Folders & Shares - DAS/NAS/SAN DATA DISCOVERY P-to-NonP Application Encryption Tokenization Application Key Management Cloud Public & Private ENCRYPTION & TOKENIZATION SafeNet ProtectApp SafeNet ProtectV SafeNet ProtectDB SafeNet ProtectFile SafeNet Tokenization Transform Utility Bulk Tokenization Web Services Database Native TDE Ecosystem ENTERPRISE KEY MANAGEMENT SafeNet KeySecure

16 Gemalto Encryption Ecosystem Offers the industry s most expansive ecosystem of integrations for encrypting data within third party environments SafeNet Protect App SafeNet Protect DB SafeNet Tokenization SafeNet ProtectFile SafeNet ProtectV Web and Application Servers Databases Application Servers Data at Rest File Servers & Shares Virtual Machines Indicates a SafeNet Product 16 SafeNet KeySecure Platform Distributed Key Management Network Encryption SafeNet High Speed Encryptors Layer 2 Ethernet Encryption Data in Motion

17 Gemalto Key Management Ecosystem The industry s most expansive and diverse ecosystem of integrations including the largest # of KMIP integration products File & Disk Encryption Database Encryption Cloud Services Cloud Encryption Gateways Storage & Archive Backup & Storage SIEM Tools SafeNet KeySecure Platform Distributed Key Management 17 SafeNet Tokenization SafeNet ProtectApp SafeNet ProtectFile SafeNet ProtectDB SafeNet ProtectV

18 Use-case: Database and File Protection Options in Physical/Virtual/Cloud environments SQL Database Encryption ProtectApp Application level encryption Tokenization Application level tokenization ProtectDB Transparent column level encryption ProtectFile Transparent database file encryption TDE Transparent data encryption NoSQL Database ProtectApp Application level encryption Tokenization Application level tokenization ProtectFile Transparent database file encryption File/Folder/Share Encryption (DAS/NAS/SAN) ProtectFile Transparent file encryption at the file-system level ProtectApp Multi-purpose APIs to perform data encryption, including file encryption at the application level Customer-Owned Key Management SafeNet KeySecure Physical SafeNet Virtual KeySecure Cloud/Virtual

19 Use-case: Segregate Sensitive Department Data on Shared Servers Documents Images Config Files Password Files Logs & Backups Application Finance Database Files and Folders Operating System Data files Exports Archives SafeNet ProtectFile Sales SSL Server (Windows or Linux) Hardware Local Storage (DAS) Remote Storage (NAS, SAN) Human Resources SafeNet KeySecure

20 Server-side deployment architecture Client Network Attached Storage CIFS, NFS PFClient

21 Client-side Network Share architecture Clients* Network-Attached Storage PFClient1** \\server\user001\ PFClient2 PFClient3... \\server\user002\ PFClient NAS policy for each client \\server\user003\ PFClient6000 \\server\user6000\ *each client has own PF installation (bootstraping) and own set of policies and keys **PFClient deploys NetworkShare Policy to act as CIFS Crypto Proxy on Win7 and Win10

22 High-Speed L2 encryption Protecting the data in motion

23 23

24 SafeNet HSE Product Portfolio CN4010 CN4020 CN6010 CN6100 CN8000 Compact desktop enclosure 10/100/1000Mbps (scalable licensing) Compact desktop enclosure 100/1000Mbps (scalable licensing) 1U rack mount enclosure 1U rack mount enclosure 4U rack mount enclosure 100/1000Mbps (scalable licensing) 1/10Gbps (scalable licensing) 10x10Gbps RJ45 electrical interfaces Pluggable optical SFP RJ45 electrical interfaces Pluggable optical SFP RJ45 electrical interfaces Pluggable XFP optical interfaces Pluggable optical SFP+ External plug pack External plug pack Dual redundant AC/DC supplies Dual redundant AC/DC supplies Dual redundant AC LED LED LCD/Key Pad LCD/Key Pad supplies User-serviceable fans/battery User-serviceable fans/battery User-serviceable fans/battery Latency < 10uS Latency < 10uS Latency < 8uS Latency < 6uS Latency < 8uS CC EAL2+, FIPS level 3 In process CC EAL2+, FIPS level 3 CC EAL2+, FIPS level 3 In process All devices are interoperable and can be managed by SafeNet High Speed Management Platforms

25 Use-case: Multi-tenanted infrastructures Ethernet Network Business Objective Secure communications across multi-enterprise infrastructure Centralised management with localised admin Separation of VLAN Multiple certificate support HSE Benefits VLAN separation CMS provides multiple admin control via central platform Granular policy control Ability to use customer specific certificates

26 Branch Offices Use-case: Securing Branch Office Connectivity VLAN 1 100M Carrier Ethernet VLAN 2 250M 10G VLAN 3 5G0M Headquarters VLAN 4 1G VLAN 5 1G Business Objective Sensitive/regulated data traversing network Need to support Voice, Video and VLANs Simple management for multiple sites HSE Benefits Centralized management VLAN bypass option Automated VLAN set-up Small footprint branch office solution

27 Use-case: Custom ECC - Bring your Own Curves CM7 can now create EC Parameter PEM files User supplies domain parameters CM7 checks parameters Generates PEM file E.g. RFC5639 Brainpool Standard Curves

28 Use-case: Custom ENTROPY - Bring your Own Keys This design decision provides a two fold benefit: The entropy pool is not polluted in any fashion with internal processing. For the purposes of AES assurance testing, it would be possible to install known entropy to provide black box testing capability to the customer.

29 SafeNet HSE is #1 > HIGHEST SECURITY > The most secure data in motion protection > FIPS L3, CC, CAPS, UC APL, NATO, UK CPA (in progress) > BEST PERFORMANCE > Maximum throughput with zero protocol overhead > Lowest OH, latency, jitter, lowest power draw, smallest footprint > MOST FLEXIBLE > In-field upgradeability to meet MEF use cases > 10Mb to 10G, multi-protocol, field upgrades > COST EFFECTIVE > Can you afford not to encrypt? > Future proof, rate limiting, mesh environments, low cost models

30 Strong Authentication Securing access and operations of digital identities

31 GEMALTO CAN DO IT ALL Supported Secure Elements Badge & NFC / BT Smart Connectivity Needed Large compatibility UICC Fragmented market usd Slot Needed ese Fragmented market Secure Element Galaxy TEE Fragmented market In roadmap Badge & Attached Reader Low user convenience Large compatibility 31

32 We are leaders in the Authentication Market [SafeNet] demonstrated a very sound market understanding and very strong product strategy and innovation. - Gartner 32

33 150 Authentication Integrations

34 Product convergence strategy TODAY etoken Pro Java 72K etoken Pro Anywhere etoken 5100/5105 etoken 5200/5205 NG-OTP etoken 7300 etoken 5110 IDBridge K30/50 etoken 5300 Full client PKCS#11 lib Minidriver etoken Pro card IDClassic etoken 4100 IDPrime.NET ID Prime MD 830/840 IDPrime MD 900 SafeNet Authentication Client Planned EOS IDPrime.NET Challenging migration Token/OS/Applet Convergence Middleware Convergence 34

35 Use-case: PKI security for Mobile device management Simple Bluetooth pairing PREPARE APP User launches the MobilePKI for Good app on their mobile. The mobile then searches for devices in pairing mode PREPARE DEVICE User presses button on Bluetooth device for 3 seconds to put it into pairing mode CONNECT User selects device to pair and enters PIN. After MobilePKI for Good has been successfully enrolled, user may use any of the registered Good apps 35

36 MobilePKI for Good components SafeNet MobilePKI for Good App and Support provides strong 2FA on top of the Good platform and is available from the Good App Store SafeNet Reader CT1100 is a Bluetooth Smart enabled smart card badge holder, perfect for existing PKI badge deployments SafeNet Reader K1100 is a Bluetooth Smart enabled USB token. Customers not using PKI can benefit from two-factor authentication, based on secured cryptographic keys stored on the SafeNet K1100 token 36 SafeNet Prime MD 8840 MicroSD card combines the storage capability of a standard MicroSD 8 or 16 GB memory card with the high security level of a PKI smart card or smart token--works seamlessly with the internal capabilities of most Android mobile devices