HP Security Voltage. A leading expert in data-centric encryption and tokenization

Transcription

1 HP Security Voltage A leading expert in data-centric encryption and tokenization 1

2 Hewlett Packard Enterprise: Protect your digital enterprise Proactively protect the interactions between users, applications and data across any location or device

3 Attack life cycle: Our approach to security Research Research Potential Threat intelligence Targets HP Security Research Infiltration Phishing Attack and Block adversary Malware HP TippingPoint HP Fortify Monetization Data sold on black market Discovery Mapping Breached Detect adversary Environment HP ArcSight Vertica Exfiltration Exfiltrate/destroy stolen data Capture Protect Obtain data HP Atalla HP Security Voltage

4 Infrastructure Security Creates Exploitable Gaps Consider a Point of Sale POS POS Malware* steals from memory seeking card data in use Dexter PoSeidon BlackPOS Custom POS malware GamaPOS Data-at-rest encryption won t prevent POS data theft Infected POS controlled by BotNets + live data = PCI data breach Data & Applications Middleware/Network Databases File Systems Storage Data is in the clear in this part of the stack data in use Decryption/Encryption (Disk, File, OS Process) Data encrypted at rest data not in use * 4

5 Data Security Coverage End-to-end Data Protection Neutralizing Breaches - Introducing Data-centric Security Threats to Data Traditional IT Infrastructure Security Data Ecosystem Security Gaps HP Data-centric Security Data & Applications Credential Compromise Authentication Management Security Gap Traffic Interceptors SSL/TLS/Firewalls Middleware/Network Security Gap Databases SQL Injection, Malware Database Encryption Security Gap Malware, Insiders SSL/TLS/Firewalls File Systems Security Gap Malware, Insiders Disk encryption Storage 17 Copyright Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.

6 Attack Trends vs. Protection Strategy Effectiveness Data-centric Security Fields and Objects Data stays protected in use, in motion, and at rest Traditional infrastructure level protection: Disk, File Data at rest in disks or files when powered off or in backup Data-centric security protects data over its lifecycle vs. broad threats. Infrastructure-centric solutions only protect from physical threats (e.g. VLE) Graph source: Verizon Data Breach Report

7 Secure Data can go everywhere Without increased risk and while maintaining data sovereignty Data from Devices, Sensors, and Applications Transaction Processors Offshore Test and Dev Cloud Applications & Services SaaS PaaS Enterprise Data Systems Partner Data Systems Big Data Analytics in the Cloud Big Data Analytics in Hadoop Amazon AWS 7

8 HP Security Voltage Products HP SecureData HP Secur Encryption and tokenization of structured data and files Data-centric security for databases, applications and payment streams Windows, Linux, Hadoop, Teradata, z/os, HP NonStop, etc. encryption solution Internal and external encryption Highly scalable to millions of users Easy to use, Outlook, mobile, web browser, etc.

9 HP SecureData Core Technologies Format Preserving Encryption Protect structured data while maintaining functional and analytic integrity of the data Name: Gunther DOB: SSN: Secure Stateless Tokenization High-octane tokenization of PAN data without database management headaches Page Integrated Encryption Extends end-to-end protection to browser, through and beyond the SSL tunnel Name: Uywjlqo DOB: SSN: AB VCXY 1111 Card Number:

10 HP SecureData Use Cases PCI Compliance Data De-Identification Tokenization for PCI scope reduction Point-to-Point Encryption for stores Point-to-Point Encryption for ecommerce Protection of data in production databases and applications Data masking for test/dev Secure analysis for Hadoop and Teradata Protection of data in the cloud

11 HP SecureData Enterprise Data Security Platform - Define access Policies - Data Security Formats - Access Controls - Reporting & Monitoring - Key Rotation Policies - Events and Alerts HP SecureData Central Management Console HSM Authentication & Authorization Sources (e.g Active Directory) - Tokenize/Detokenize/Encrypt/Decrypt/Mask? - IP Valid? Certificate valid? - Application Authenticated? - User/Role validated? - Key Generation/Token table management - Permission granted? Storage Key Management HP SecureData Web Services API HP SecureData Command Lines & Automated File Parsers HP SecureData Native API s (C, Java, C#,.NET) HP SecureData Native UDFs HP SecureData z/protect, z/fpe Partner SaaS & PaaS Cloud Integrations Apps Payment Terminals Policy Controlled Data Protection and Masking Services & Clients Business Applications, Data stores and Processes Volumes and Storage Enterprise Applications Production Databases Payment Systems ETL & Data Integration Suites 3 rd Party Applications Teradata, Hadoop & Vertica HP Nonstop Applications & Databases Mainframe Applications & Databases Network Interceptors Web/Cloud Applications (AWS, Azure) 3 rd Party SaaS Gateways 43 11

12 Example Enabling Mobile, Hybrid Cloud Data Security Large Specialty Insurer 22,000 Employees Global Operations Advanced mobile services Mobile monitoring (apps, energy, conflicts) Backup and Restore services Supporting top telco subscribers Major challenge keeping data secure in cloud on behalf of third parties (top US Telcos) Remaining agile key element of strategy Strategic Cloud operations across multiple clouds (Azure, AWS) Enabling Cloud Based Analytics on large data sets to enable customer service

13 Azure Apps data secured with HP SecureData LARGE Internet Companies Tier 1 telcos

14 AWS Side data secured with HP SecureData Tier 1 Global Telcos

15 Data Risk Surface The Azure Stack Diagram Source:

16 Data Risk Surface The Azure Stack Using IT Security Keys are in the cloud Data protection is at rest Attacks happen in active apps Disk and VM Only Solutions

17 Data Centric Security Coverage The Azure Stack Using Data-Centric Security

18 Example Major Auto Manufacturer BigData Dataflow Architecture Hadoop Teradata Sensitive structured data files Edge Node Sqoop Command Line Tools UDFs Hive UDFs Analytics Sensitive structured database sources Map Reduce LZ Cognos HP SecureData Servers IC DataStage 18

19 Example Health Care Insurance Company Fortune 100 company - managed health care, health care insurance Data security for traditional enterprise apps, hybrid apps: secure data as part of a strategic enterprisewide data security strategy Secure communications: encrypted communications, billing statements, claims and mobile interactions for patients and employees Improve customer information, reduce prescription fraud and reverse claim overpayment: quick detection and analysis of customer health status, automate fraud detection and quickly detect claim overpayments Enable competitive advantage: formed internal data exploration hackathons using de-identified data to create market innovations and detect risks HP SecureData protects business process, increases agility and improves customer interaction Enables innovation through data access without risking compliance and privacy regulations (HIPAA/HITECH, PCI, etc.) De-identifies and shares data from multiple data sources; enables analytics on sensitive data Shows that the most effective way of protecting the data is at the field level HP Secur protects sensitive PII and PHI throughout the enterprise, and cloud to customers & extended ecosystem

20 Data Sovereignty is Complicated Legal, contractual, technological mesh Where is a data center located, whose data is being stored No uniform standards, often directly conflicting laws E.g. USA Patriot Act vs. European Data Protection Directive Some jurisdictions are particularly complex Patchwork of federal, territory, and provincial laws Landmark ruling could pose serious concerns for European firms wary of the cloud. Dan Worth, V3.com

21 Example Cloud Data De-Identification, Data Residency Top European Bank Solving European Data Residency Challenges in core banking Solution Components IBM Mainframe, Core Banking HP SecureData Implementation with GSI Data Residency Problem Central Banking Accenture Core Banking Application Challenge: CSSF regulation driven $150m investment at risk Data Residency EU Privacy Challenge Data Ops in Portugal Customer Data in Luxembourg IBM mainframe in scope Need for data separation from Luxemburg and Portugal HP FPE Technology critical enabler for rapid compliance First EU Bank to meet strict new CSSF regulation Avoided $150m data center cost. (C) 2015 Voltage Security, Inc. All Rights Reserved - Confidential 21

22 Example Australia's number one direct wine store Retail and Online merchant Largest e-commerce retailer in Australia Part of Tier 1 parent > 330,000 customers Payment flow with multiple processors Goal - PCI Compliance and de-scoping Solution Voltage SecureData Web & Voltage SecureData Enterprise Solution Components HP SecureData Web HP SecureData Enterprise Outcome PCI scope reduction, reduced breach risk Deployed in < 60 days

23 Wine store e-commerce PCI scope reduction Online shopper browser. Desktop, Mobile Internet Merchant infrastructure Card and Purchase Data Encrypted at capture using PIE E-Commerce Applications & Retail System Interfaces Web Infrastructure Environment Store Front SecureData Web Decrypt & Cardholder Data Environment To Payment Processors Green out of PCI scope Red In Scope of PCI

24 Thank You! Q&A

25 Additional Slides: HP SecureData Platforms

26 HP SecureData for HP NonStop HP SecureData Host SDK Available on HP NonStop Guardian and OSS Host decryption and tokenization capabilities for PAN data HP SecureData Simple API Available on: HP NonStop OSS and HP-UX

27 Integration with Teradata and Informatica Teradata Maximizes the multi node feature of Teradata Implemented through UDFs UDFs invoked through SQL and triggers/views Distributed on nodes for high performance Informatica Integration through hooks in ILM and DDM Modify ETL routine to call HP Security Voltage for encryption or tokenization Implemented through SOAP, native API or command line tool

28 HP SecureData for IBM z/os HP SecureData z/protect API Uses a started task to do actual work Batch programs/cics transactions call minimal APIs Support for HP FPE and native HP SST on z/os HP SecureData z/fpe The z/os Bulk Data Protection Tool Bulk protection of data: flat files, DB2, IMS, VSA, etc. Enables easy data protection and masking Can use Rexx, COBOL, PL/I, C, other languages

29 HP Secur Simple, native user experience just like regular Outlook, iphone, ipad, Android, Blackberry, Web HP Stateless Key Management Architecture No key or message stores to manage Low operational and infrastructure costs Single HP IBE solution for all use cases Internal and external protection and compliance Single technology (IBE, 100% push, message format) Outlook, Exchange, Windows AD Support Global address list, distribution lists, contacts AD Authentication, AD Groups The world s most popular encryption solution It just works bob@corp.com

30 HP SecureData for Big Data

31 Options for Securing Data in Hadoop with HP Security Voltage Hadoop Cluster Applications & Data HP Security Voltage 1 4 Hadoop Jobs & Analytics Applications & Data Applications & Data 2 Landing Zone ETL & Batch HP Security Voltage 3 Hadoop Jobs HP Security Voltage HDFS Storage Encryption HP Security Voltage HP Security Voltage Hadoop Jobs & Analytics HP Security Voltage Egress Zone ETL & Batch HP Security Voltage Applications, Analytics & Data Applications, Analytics & Data BI Tools & Downstream Applications Legend: Unprotected Data De-Identified Data Application with HP Security Voltage Interface Point Standard Application

32 Sample Big Data Analytics Dataflow Teradata ETL / Landing Zone UDFs Analytics BI Tools Sensitive structured data sources De-identification ETL Privileged Analytics Hadoop HP Vertica HP SecureData Key Servers & Tokenization Servers UDFs and Map Reduce & Sqoop UDFs Privileged Analytics Analytics Privileged Analytics Analytics 32