Webinar bitglass - complete deck-2
•Download as PPTX, PDF•
0 likes•311 views
We are now three plus years into widespread adoption across industries of public SaaS apps like Office 365. Despite this momentum, security and compliance remain top challenges. This webinar, featuring Matt Hollcraft, CISO for Maxim Integrated, Dave Ruedger, Chief Security Architect for Maxim Integrated, and Rich Campagna, SVP of Products for Bitglass, will help you build a 2017 action plan to embrace public cloud without sacrificing security and compliance. While offering practical, actionable advice for major apps like Office 365, Matt, Dave and Rich will address your top concerns, such as unmanaged device access, external sharing, and mitigating controls. They also will provide real world examples of how other organizations have securely navigated the public cloud.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Webinar bitglass - complete deck-2
Similar to Webinar bitglass - complete deck-2 (20)
More from Bitglass
More from Bitglass (11)
Recently uploaded
Recently uploaded (20)
Webinar bitglass - complete deck-2
- 1. Your 2017 Cloud Security Action Plan Matt Hollcraft, Maxim Integrated CISO Dave Ruedger, Maxim Integrated CSA Salim Hafid, Bitglass Product Marketing Sponsored by:
- 2. Our Presenters Matt Hollcraft Chief Information Security Officer Maxim Integrated 2© 2017 Security Current Dave Ruedger Chief Security Architect Maxim Integrated Salim Hafid Product Marketing Bitglass
- 3. Building Secure Cloud 3© 2017 Security Current Dave Ruedger Chief Security Architect Maxim Integrated
- 4. Cloud Security Considerations Identity Access Data Protection Availability Hosted Services (SaaS/IaaS) Monitoring © 2017 Security Current 4
- 5. Cloud Security – Identity Single Sign On Requires effort and planning to integrate with cloud services Not all providers support SSO integration Synchronization is critical Cloud Service Native Per service provider Difficult to manage Changes to accounts handled manually Password policy enforcement Enable Multi Factor Authentication Admin access at a minimum © 2017 Security Current 5
- 6. Cloud Security – Access Apply same process as internal controls Onboarding/Offboarding Personnel changes must be managed Integrate with Active Directory or Open LDAP Group and Role permissions easier to manage Keeps User permissions for data in sync Restrict use of shared accounts Password rotation is difficult to manage Not auditable for individual usage © 2017 Security Current 6
- 7. Cloud Security – Data Protection It’s still YOUR data = your RISK 3rd Party and Vendor Assessments are necessary Admin access controls Multi factor authentication Monitoring and Auditing Multi-tenancy increases risk of breach Review data segmentation Encryption at rest reduces risk Geographic considerations EU privacy compliance Must consider data storage and transmission © 2017 Security Current 7
- 8. Cloud Security – Availability Availability is a security concern Build for redundancy Recovery may be impacted during a disaster Certificate Management Monitor certificate expiration Impacts all web services and applications, not just corporate website! SPF records may be required Cloud service sending email on your behalf Prevents critical alerts from being flagged as spam © 2017 Security Current 8
- 9. Cloud Security – Hosted Services (SaaS/IaaS) Backup your data Even Amazon has encountered service outages Some cloud failures are unrecoverable Use scheduled exports or replication Review default access security policies May be too permissive Could allow public access to restricted systems/data Utilize IP Whitelisting to further restrict access Penetration testing and vulnerability scanning requires permission Failure to notify could result in your network being blocked Could lead to service outage Protect your API keys © 2017 Security Current 9
- 10. Cloud Security – Monitoring Network monitoring in the cloud is limited or non-existent Only Amazon has VPC monitoring currently Must rely on logging Detection is only as good as what you log Multi cloud environments are even more challenging IP Address space collisions/duplication Inconsistent view of log data Constant monitoring needed to identify shadow IT Next Gen firewalls can tag traffic to the cloud for alerting Implement a CASB for better control Detects and limits/blocks access © 2017 Security Current 10
- 11. The Business Case 11© 2017 Security Current Matt Hollcraft Chief Information Security Officer Maxim Integrated
- 12. Risk: Identity and Access © 2017 Security Current
- 13. Risk: Data Protection © 2017 Security Current
- 14. Risk: Governance and Compliance © 2017 Security Current
- 15. Your 2017 Security Action Plan 15© 2017 Security Current Salim Hafid Product Marketing Bitglass
- 16. What best describes your current public cloud strategy? AUDIENCE POLL: © 2017 Security Current
- 17. 17© 2017 Security Current Office 365 is the leading SaaS productivity suite: No signs of public cloud slowing down
- 18. Major cloud app vendors doing their part to secure cloud apps: ○ Haven’t had massive breaches many naysayers expected ○ Spend more on security personnel and infrastructure ○ Patch vulnerabilities quickly ○ Achieve stringent compliance certifications (ISO 27001, SOC 2, FedRAMP, CSA, etc) Enterprises must use cloud apps securely ○ Still responsible for use of enterprise data and accounts ○ Still responsible for compliance 18© 2017 Security Current Is the cloud secure? It can be, if used securely
- 19. 19© 2017 Security Current Public Cloud App Separation of Duties enterprise (CASB) end-user devices visibility & analytics data protection identity & access control application storage servers network cloud app vendor
- 20. What are your top cloud security concerns? AUDIENCE POLL: © 2017 Security Current
- 21. Critical Cloud Control Areas 21© 2017 Security Current
- 22. Where to get controls? Existing Security, App Native, Third Party Existing Investments VPN, NGFW/SWG, DLP (Endpt/Ntwk) Pros: - Minimal new investment (time, $) - Existing expertise Cons: - Backhauling inefficient, poor performance - BYOD blindspot - May not be cloud aware App Native Varies by application Pros: - No additional products/vendors to deploy Cons: - Requires different strategy/execution per app - Capabilities vary widely across apps - App team controls data/security Third Party (CASB) CASB, IdaaS Pros: - Single policy across all apps - Comprehensive security model - Dual controls (app vs sec team) Cons: - Additional vendor, new expertise 22© 2017 Security Current
- 23. Major Healthcare Firm 23© 2017 Security Current Secure Office 365 & BYOD Client ■ 180,000 employees ■ Among the largest US healthcare orgs Challenge ■ HIPAA Compliant cloud and mobile ■ Controlled access to Office 365 from managed & unmanaged devices ■ Control external sharing ■ Real-time inline data protection Solution ■ Real-time inline protection on any device ■ Contextual access control on managed & unmanaged devices (Omni) ■ Real-time DLP on any device ■ API control in the cloud ■ Agentless BYOD with selective wipe ■ Enterprise-wide for all SaaS apps
- 24. Financial services client 24© 2017 Security Current Secure Salesforce and Office 365 Client ■ 20,000 employees ■ Global presence ■ $6T in assets under management Challenge ■ Needed complete CASB for enterprise-wide migration to SaaS ■ Security for Office 365 ■ Encryption of data-at-rest in Salesforce Solution ■ Searchable true encryption of data in Salesforce ■ Real-time inline DLP on any device (Citadel) ■ Contextual access control on managed & unmanaged devices (Omni) ■ API control in the cloud ■ Discover breach & Shadow IT
- 25. ✓ Prioritize critical applications ✓ Identify security & compliance gaps ✓ Evaluate built-in controls vs third party (CASB, IdAAS, etc) ✓ Design/implement policies ✓ Align to app deployment timeline 25© 2017 Security Current Your 2017 Cloud Security Action Plan
- 26. bitglass mission total data protection outside the firewall 26 #1 CASB real-time data protection founded 2013 tier 1 funding award-winning tech leader 3 patents, 3 pending
- 27. ■ Gartner Marketguide to CASBs ■ Whitepaper: Definitive Guide to CASBs ■ Case Study: fortune 100 healthcare firm secures o365 27© 2017 Security Current Resources: More About Public Cloud Security
- 28. Thank you for joining us Matt Hollcraft Chief Information Security Officer Maxim Integrated 28© 2017 Security Current Dave Ruedger Chief Security Architect Maxim Integrated Salim Hafid Product Marketing Bitglass
Editor's Notes
- Salim Intros
- Key points to present: IAM is key for cloud security because: - Naturally accessible via public internet - Multi-tenant environments are only as strong as the weakest link - Just like any network, lacks access control standards causes issues in areas such as separation of duties, change management and confidentiality. Risk reduction strategies should include: - Multi-factor authentication - Review and approval of cloud provider admins and personnel - Consideration for prohibition of competitor provisioning in adjacent servers
- Key points to present: Focus on the data. It’s all about the data, because: - Data, unlike almost any other asset, can be replicated in many places - Data stored on someone else’s servers should be encrypted, if needed, just like any other place. - Your data is like your kids, you just don’t allow anyone to be responsible for it and you always agree on the return process (i.e. exiting the cloud provider) Risk reduction strategies for data include: - Understand you data map and flows, physically where the data is stored (privacy) - Encryption, encryption , encryption – in transit and rest! - Robust Ts & C’s language and negotiation for return or deletion of data when exiting a provider (including cloud provider back ups)
- Key points to present: Don’t forget the due diligence: - The data owner is still responsible for G&C - Cloud providers feel they are not responsible - Your controls are only as strong as their validation Risk reduction strategies should include: - Require completion of SSAE 16 SOC 2 annually - Ensure your access to ALL audit and monitoring tools provided – ideally at no charge with the service - For any adverse findings in the audit reports, demand an action plan for remediation (success depends on the spend with the provider) and possibly include language in the T’s and C’s
- what best describes your organization’s current public cloud strategy? Cloud only Cloud first Cloud sometimes Cloud if we have to Cloud never
- Explosion of SaaS in the enterprise, leveraging Bitglass Cloud Adoption Report data O365 and productivity suites as proxy for broader cloud adoption in the enterprise across all verticals and all software functions.
- what best describes your organization’s current public cloud strategy? Cloud only Cloud first Cloud sometimes Cloud if we have to Cloud never
- Critical control areas Cloud - data-at-rest protection - encryption, sharing/backend sync controls, etc. Access - who has access to what and in which context? access controls, DLP, etc Identity - SSO, 2FA, identity best practices from prem, etc. Mobile - protecting cloud data sync'd/downloaded to devices, both managed and BYOD.