Thales esecurity Cloud Data Protection

Transcription

1 Thales esecurity Cloud Data Protection Marcel Derksen

2 Before we start. 2

3 3

4 The old model was perimeter security to wall off the data 4 T h is d o c u m e n t m a y n o t b e re p ro d u c e d, m o d if ie d, a d a p t e d, p u b lis h e d, t ra n s la t e d, in a n y w a y, in w h o le o r in p a rt, o r d is c lo s e d t o a t h ird p a rt y w it h o u t p rio r w rit t e n c o n s e n t o f T h a le s - T h a le s A ll rig h t s re s e rv e d.

5 Old perimeter security doesn t protect data in the clouds 5 T h is d o c u m e n t m a y n o t b e re p ro d u c e d, m o d if ie d, a d a p t e d, p u b lis h e d, t ra n s la t e d, in a n y w a y, in w h o le o r in p a rt, o r d is c lo s e d t o a t h ird p a rt y w it h o u t p rio r w rit t e n c o n s e n t o f T h a le s - T h a le s A ll rig h t s re s e rv e d.

6 How will you secure your data in clouds? Every method. PROTECTION INVESTMENT. HOW VALUABLE? 6

7 How will you secure your data in clouds? Depends on value. Public Data Low Value Data Highly Sensitive or Regulated Data 7

8 How will you secure your data in clouds? Every method. Public Data No Encryption or Native / Full Disk Encryption Low Value Data Native / Full Disk Encryption + Key Management Highly Sensitive or Regulated Data Bring Your Own Encryption 8

9 Application Workload Migration to Cloud Location of Application Workloads (% of Total Workloads) To da y 61% 14% 9% 16% En d of % 12% 9% 21% En d of % 9% 12% 46% On-Premise Co-Location Managed Hosting Public Cloud (SaaS, PaaS, laas) AlphaWise/Morgan Stanley 2016 Annual CIO Survey 100 CIOs 9

10 Multi-Cloud Is Real and Growing 66% of enterprises end up with more than one provider - Carl Brooks, 451 Research, May % of public cloud infrastructure customers use multiple CSPs - Dan Conde, ESG, March, 2017 It is now common for medium and large enterprises to run SaaS, PaaS, and IaaS at different providers, all in parallel with on-premises systems. - Adrian Lane, CTO, Securosis,LLC, April, % of organizations use multiple clouds - IDC Cloudview, July,

11 Broad Cloud Security Concerns 11

12 Shared Responsibility Model Illustrates Data Security Roles Infrastructure as a Service (laas) Platform as a Service (PaaS) Software as a Service (SaaS) Data Data Data Application Application Application Customer Responsibility Runtime Middleware Runtime Middleware Runtime Middleware O/S O/S O/S Provider Responsibility Virtualization Servers Virtualization Servers Virtualization Servers Storage Storage Storage Networking Networking Networking 12

13 You re responsible for data security. What do you do? 13

14 Recommended guidelines and tools for secure cloud migration SECURITY GUIDANCE 14

15 How will you secure your data in clouds? Every method. Public Data No Encryption or Native / Full Disk Encryption Low Value Data Native / Full Disk Encryption + Key Management Highly Sensitive or Regulated Data Bring Your Own Encryption 15

16 Thales esecurity Solutions For the Public Cloud Multi-Cloud Data Security and Control Bring Your Own Keys from High-Assurance hardware Bring Your Own Advanced Encryption - Simplify data security with centralized key management and encryption policies across clouds - Reduce risk of compromised credentials with granular access controls - Stop attacks faster with data security intelligence - Maximize data availability and mobility Enable applications to tokenize or encrypt sensitive data 16

17 Advanced Data Encryption Provides Real Protection and Control Unified Encryption, Key and Policy Management On-premises Key Management In-cloud Key Management FIPS Compliant Secure Key Storage Physical Appliances Virtual Appliances Advanced BYOE Live Data Transformation Ø No downtime: files or database remain online during initial encryption or key rotation Granular Access Control Policies Privileged User Access Control Container Awareness Ø Establish fine-grained access controls for each container Files and Databases AES Encryption Secure Data Portability Security Intelligence Logs Ø Capture granular data access logs of authorized and unauthorized access Tokenization with Dynamic Data Masking Application Layer Encryption Native Encryption Private & Hosted Clouds 17

18 True Encrypted Data Mobility is Only Possible with BYOE Financial Data HIPAA Intellectual Property Centralized Keys Provide Data Mobility PII 18 On-Premises Private Cloud

19 CipherTrust Cloud Key Manager Centralized, multi-cloud key control and management for IaaS and SaaS As a service or on-premises deployment Secure Key Storage Logging and Reporting for enhanced visibility and compliance 19

20 Public Cloud Bring Your Own Key Safer key management practices Strengthens security for sensitive data in the cloud Cloud Applications Stronger key generation High-entropy random number generator in FIPS boundary Greater control over keys On-premises HSM creates, wraps, and exports keys to the cloud 20

21 Thales esecurity Advanced Encryption and Key Management Container security IoT security Data security Payments Customer use cases Cloud security Code signing PKI Key management Tokenization data masking App encryption Digital signing Data encryption Hardware security modules 21

22 Thank You

23 Thales esecurity lunch en rondetafel Programma: Data threat wake up call cijfers & trends, best practices en klantcase Rondetafel: - Beveiliging data-at-rest - Centraal managen van meerdere virtuele, cloud en big data omgevingen - Data encryptie is slechts zo goed als het managen van de sleutels Lunch bij the Harbour Club Tijd: