developing a secure and compliant cloud strategy for financial services
Post on 22-Mar-2017
59 Views
Preview:
TRANSCRIPT
webinarjune 29
2016
developing a secure and compliant
cloud strategy for financial
services
STORYBOARDS
the traditional approach to
security is inadequate
STORYBOARDS
security must evolve to
protect data in the cloud
ungoverned access to
corporate data in the cloud
data-at-rest in the cloud
sensitive cloud data on
unmanaged devices
STORYBOARDS
enterprise(CASB)
end-user devicesvisibility & analytics
data protectionidentity & access control
applicationstorageserversnetwork
native security features can’t be relied upon:the data blind spot
app vendor
STORYBOARDS
CASB: a better approach to cloud security
identity
cloud encryption
data-centric protection
audit + visibility
STORYBOARDS
protecting cloud data end-to-end
■ Cloud data doesn’t exist only “in the cloud”
■ A complete solution must provide visibility and control over data in the cloud
■ Solution must also protect data on end-user devices
■ Leverage contextual access controls
STORYBOARDS
access controlsthe new data reality requires a new security architecture
■ Secure access from any unmanaged device
■ Protect data in “unwrappable” native mobile apps
■ Full data control and visibility for IT
■ Granular DLP applied to data at download time
STORYBOARDS
data leakage preventiona complete set of data controls
■ Apply granular DLP to sensitive data with spectrum of actions from watermarking to outright blocking
■ Context-aware engine can distinguish between users, managed and unmanaged devices, and more
■ Easily modify sharing permissions and quarantine files for review
STORYBOARDS
audit and visibility
■ Detailed logging for compliance and audit.
■ Identify sensitive data at rest and external sharing
■ Easily modify permissions and quarantine files
STORYBOARDS
identity
■ Cloud app identity management should maintain the best practices of on-prem identity
■ Cross-app visibility into suspicious access activity with actions like step-up multifactor authentication
STORYBOARDS
cloud encryptionencrypt data-at-rest while retaining app functionality
■ Necessary for data that is subject to regulatory mandates (e.g. PII, PCI)
○ Only encrypt what’s necessary
■ Structured data
■ Sensitive fields (SSNs, addresses, etc.)
STORYBOARDS
cloud encryptionwhere some solutions fall short
■ Competitors limit the number of Initialization Vectors to support search
■ Ex: search Salesforce for every ciphertext value of “Bob”
○ As number of IVs increases, search time increases exponentially
STORYBOARDS
cloud encryptionencrypt data-at-rest while retaining app functionality
■ Encryption must be at full strength, using industry standard encryption
■ Customer managed keys provide an additional layer of security
■ Solution should be easy to deploy and cost-effective
STORYBOARDS
managed devices
application access access control data protection
unmanaged devices /
byod
in the cloud
Forward ProxyActiveSync Proxy
Device Profile: Pass● Email● Browser● OneDrive Sync
● Full Access
Reverse Proxy + AJAX VMActiveSync Proxy
● DLP/DRM/encryption ● Device controls
API Control External Sharing Blocked
● Block external shares● Alert on DLP events
Device Profile: Fail● Mobile Email● Browser● Contextual multi-factor auth
typical use case:real-time data protection on any device
STORYBOARDS
our mission
total data
protection est. jan
2013
100+ custome
rs
tier 1 VCs
STORYBOARDS
harbor: secure data in the cloudsearchable encryptionpublic cloud app with private cloud data■ searchable, sortable true AES-256 + 256-bit IV■ crypto-independent implementation■ US Patent 9,047,480■ endorsed by leading cryptographers
competition■ maximum 20-bit IVs to support search■ search performance drops with IV length■ no wild-card search, partial-word search...
STORYBOARDS
secure salesforce
+ office 365
financial servicesgiant
17
challenge■ Needed complete CASB for enterprise-wide
migration to SaaS■ Encryption of data-at-rest in Salesforce ■ Security for Office 365
solution■ Searchable true encryption of data in
Salesforce■ Preserve SOQL API integrations■ Full control of encryption keys■ Real-time inline DLP on any device
(Citadel)■ Contextual access control on managed &
unmanaged devices (Omni)■ API control in the cloud■ Discover breach & Shadow IT
STORYBOARDS
client:■ 15,000 employees in 190+
locations globallychallenge:
■ Mitigate risks of Google Apps adoption
■ Prevent sensitive data from being stored in the cloud
■ Limit data access based on device risk level
■ Govern external sharingsolution:
■ Inline data protection for unmanaged devices/BYOD
■ Bidirectional DLP■ Real-time sharing control
secure google apps +
byod
business data
giant
resources:more info about cloud security
■ whitepaper: the definitive guide to casbs
■ infographic: cloud adoption in financial services
■ case study: financial services firm secures salesforce and o365
STORYBOARDS
bitglass.com@bitglass
top related