Rethinking the Enterprise Perimeter | SnowFROC Presentation
•
0 gefällt mir•228 views
How is your enterprise software company handling sensitive data? IronCore CEO Patrick Walsh's presentation, which you can watch here (https://www.youtube.com/watch?v=LNAC2R39HFA), challenges common assumptions about the traditional perimeter and proposes a new data privacy mindset and solution.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Rethinking the Enterprise Perimeter | SnowFROC Presentation
Ähnlich wie Rethinking the Enterprise Perimeter | SnowFROC Presentation (20)
Mehr von IronCore Labs
Mehr von IronCore Labs (7)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Rethinking the Enterprise Perimeter | SnowFROC Presentation
- 4. @zmre Other 4% Integrated Risk Mgmt 9% Infrastructure Protection 29% Identity 20% Network Security 25% Cloud Security 0.9% Data Security 7% Application Security 6% Total InfoSec Product Spend $53.22 billion IAM + Infra. Protection + NetSec $39.24 billion 74% AppSec + CloudSec + DataSec $6.99 billion 13% Why? Source: Gartner 2019 InfoSec Spending
- 8. @zmre IT Responsibility Engineering Responsibility • Infrastructure Security • Network Security • Risk Management • App Security • Data Security • Cloud Security • Identity Security Teams Invest Where They Have Control
- 9. @zmre Significant New Privacy Laws Substantially new or expanded data privacy laws passed or put in effect in 2017, 2018, or 2019. Source: DLA Piper / dlapiperdataprotection.com Since 2017
- 15. @zmre Control Granularity Evolution Perimeter DMZ VLANs ➞ ➞ Endpoints ➞ • We keep shrinking our focus. Net to subnet to VLAN to device.
- 16. @zmre Control Granularity Evolution Perimeter DMZ VLANs ➞ ➞ Endpoints ➞ • We keep shrinking our focus. Net to subnet to VLAN to device. ➞ ?
- 17. @zmre Control Granularity Evolution Perimeter DMZ VLANs ➞ ➞ Endpoints ➞ • Next up: Data • It’s flowing in and out of the perimeter. Not controlled like devices. Data ➞
- 22. @zmre Options for handling sensitive data 1. Don’t share — Use that network security investment to best effect 2. Hope for the best 3. Privacy preserving techniques 4. Encryption patterns
- 23. @zmre Options for handling sensitive data 1. Don’t share 2. Hope for the best — Wait and see how the new laws shake out. 3. Privacy preserving techniques 4. Encryption patterns
- 24. @zmre Options for handling sensitive data 1. Don’t share 2. Hope for the best 3. Privacy preserving techniques — Disassociate, deidentify, tokenize, etc 4. Encryption patterns
- 25. @zmre Options for handling sensitive data 1. Don’t share 2. Hope for the best 3. Privacy preserving techniques 4. Encryption patterns — Use encryption to manage and track access
- 26. @zmre Rest of presentation: tactical approaches to PII 1. Don’t share 2. Hope for the best 3. Privacy preserving techniques — 4 approaches 4. Encryption patterns — 4 approaches
- 27. @zmre Separate Out Names Name Account Balance 1 John Smith $5,000 2 Pam Jones $123,000 3 Jeff Bezos $126,000,000,000 4 Alice Walker $1,201,532 1/4
- 28. @zmre Name Account Balance 1 John Smith $5,000 2 Pam Jones $123,000 3 Jeff Bezos $126,000,000,000 4 Alice Walker $1,201,532 Removed to isolated lookup table But can you guess which one is Bezos? Separate Out Names 1/4
- 29. @zmre Tokenize or Pseudonymize Name Account Balance 1 a1 $5,000 2 b3 $123,000 3 c8 $126,000,000,000 4 d2 $1,201,532 2/4 Same problem. But now separate access control on tokenized data.
- 30. @zmre k-anonymize Name Account Balance 1 * $0 - $150,000 2 * $0 - $150,000 3 * $1,000,000 - ∞ 4 * $1,000,000 - ∞ 3/4 Make sure at least k people have identical rows. Typically done with bucketing. But be careful this doesn’t join to other data… Name Account Balance 1 John Smith $5,000 2 Pam Jones $123,000 3 Jeff Bezos $126,000,000,000 4 Alice Walker $1,201,532 2-anonymity
- 31. @zmre Differential Privacy App1 App2 App3 1 1 1 0 2 0 1 1 3 0 0 0 4 0 1 0 4/4 Random values mixed in Aggregate values are approximately correct. Hard to say for sure if any one person has App2.
- 32. @zmre Privacy Techniques Massaging the Data The Good The Bad • If the data is re-identifiable, you’re still on the hook. It probably is. • Deidentified data is a Cryptogram puzzle — more data points => more likely to solve. • Anonymizing data or deidentifying it is expressly allowed by GDPR. • Relatively simple changes to make to comply.
- 33. @zmre • The Weather Channel collected your location data. • Stripped your name, but sold the location. • Trivially reversed by reporters joining public data sets to it.
- 35. @zmre Org • Use existing KMS, policies, SIEM, monitoring -- effectively extend the perimeter around partner. • Subpoena-resistance (unless a gov. can eventually compel code changes). • But still server-side access and use by Salesforce. Salesforce Shield (w/ Cache-only Keys) 1/4
- 37. @zmre Encryption Proxy 2/4 Client CASB App DB Client App DB Proxy DB • CASB pattern puts the customer in control, but can be terrible for functionality breaking. • DB Proxy pattern makes life slightly more annoying for hackers, if they somehow hacked the DB but not the app. CASB In-house
- 38. @zmre Key Custodian 3/4 Client Key Custodian App DB • Split trust model using a trusted 3rd party • Idea is that keys and encrypted data are separated between organizations and networks. • Essentially end-to-end since app has no access to data. Similar to CASB that way.
- 39. @zmre Zero-trust 4/4 Client Facilitator App DB • Encryption-backed access control. • Identity aware. • App can access data with its own keys. • 3rd party never sees keys or data. • Per-service per-datatype access models. Full disclosure: my company offers a solution for this. Also for adding “shield" to existing SaaS products.
- 41. @zmre Q&A ?
- 42. Thank You