Encryption & Compliance

Transcription

1 Encryption & Compliance A Sophos & Zones presentation Nagraj Seshadri March 24,

2 Agenda About Sophos Security challenges Sophos security solution Q & A 2

3 About Sophos Founded in1985 Sophos + Utimaco in employees, 600+ in R&D Solid growth, profitable Business focus only Gartner Leader: EPP, NAC, MDP 3

4 Sophos, Simply Secure Sophos (C)

5 Changing security landscape Digital generation set loose Information theft not graffiti Firewall Complex threats... Corporate data Mobile workers Fast changing Targeted Web-based, Invisible...targeting commercial data Contractors, outsourcing Partners, customers Web 2.0 Personally identifiable information Intellectual property Customer data Regulatory disclosure and reputation damage 5

6 Data Breach Incident Types Unknown, 4% Documents Lost/Stolen, 14% Portable Media Lost/stolen, 10% Hacks, Virus, 17% Web, , 17.0% PCs (inc. Laptops) Lost/Stolen, 31% (Note: Similar categories have been combined and aggregated) Fraud, 8% 6

7 Stricter Regulations Drive Data Security Globally Regulation Region Industry Date PCI DSS v1.2 Global Payment card 08 HITECH Act US Healthcare Feb 10 FTC Red Flag Rule US All creditors Jun 10 Gramm Leach Bliley Act US Financial 99 FERPA US Education 74 Data breach notification US states All CMR 17 Mass. state US All Mar 10 PIPEDA Canada All 01, 02, 04 Directive 95/46/EC EU All 95 Data Protection Act UK All 84, 88 Fed. Data Protection Act Germany All 06 Personal Info. Protection Act Japan All 03, 05 7

8 Negative Consequences Of Data Breaches and Non Compliance 346m records 1 compromised since 05 $204/record 2 cost to a company Fines: $1.5m/yr 3, 5k/violation/record 4, unlimited 5 Ci Criminal i lprosecution Extra scrutiny, monitoring, annual reviews 6 Bad press, reputation damage Loss of trust customers, partners, employees 1) 2) 5 th Annual Cost of a Data Breach 10, Ponemon Institute 3) HITECH Act (US) healthcare 4) Mass. Data security regulation 201 CMR 17 5) Data Protection Act (UK) 6) PCI DSS 8

9 Typical Required Security Controls Written Information Security Plan Secure access control, authentication and communication protocols Encrypt data in motion Network file shares, , Web, Wireless Encrypt data at rest PCs, removable media, file shares, databases Firewall, anti malware protection Up to date patches OS andapplicationsapplications Education and training of employees Regular monitoring and review 9

10 Encryption Solution Considerations Communication: B2B or B2C End-user experience: Fully transparent or some- or more-interaction Access to online only or offline too Security risk: very high or high or moderate Compliance requirements Setup: required expertise minimal or considerable Infrastructure: sender/receiver - none or key/certificate management Cost 10

11 Sophos Layered Approach to Security Data Encryption End-to-end encryption Sever-to-server encryption Data Loss Prevention e Monitor and control transfer of sensitive data Continuously audit and report on activities Malware Protection Protect computers from malware infection Stop hackers from accessing resources (bots) Anti-Spam Protect users from productivity loss Protect mail infrastructure from overload 11

12 Sophos SPX: Simple Encryption Best sender & recipient experience Transparent to senders; no training Easy for recipients: i PDF based encrypted Encrypted delivered to in box, accessible offline One time password creation Quick set up with policy wizards 5 steps: configure encryption 5 steps: configure content control (DLP) 12

13 13

14 14

15 15

16 16

17 17

18 18

19 19

20 Excellent focus on data leakage and compliance appliance setup was as easy as it gets Sophos does a great job with the flexibility Overall, a great product at a tremendous value for the money. 20

21 Sophos, Simply Secure Sophos (C)

22 Thank you. Nagraj Seshadri 22

23 Sophos Disk Encryption Secure Authentication and Transparent Full Disk Encryption << Your Company logo / Graphics / Messages >> 23

24 Sophos Management Center Was The Lost Laptop Encrypted? Print, Export, Save Audit Report 24

25 Sophos Data Exchange Transparent Removable Media Encryption & Sharing Colleagues Partners Customers Home Lost Stolen Image: lenovo.com 25

26 Sophos SPX: Simple Encryption Best sender & recipient experience Transparent to senders; no training Easy for recipients: One time password creation Encrypted delivered to in box box, not a confusing web portal Quick set up with policy wizards 5 steps: configure encryption 5 steps: configure content control (DLP) 26

27 SophosLabs Pre packaged Content Control Lists Enforced at the endpoint & gateway 27

28 Provide Warning / Control o To End users s 28

29 CFO Team Collaboration: Time lost with ordinarily encrypted portable media Jane the CFO is preparing annual financial results for her board. Jane tries to access confidential encrypted data provided by the sales regions. I cannot access the data! I need my Helpdesk. Sorry Jane. I don t have the encryption keys to access the data. Darn encryption! Not to mention the time lost. Back to paper data! CFO Team Collaboration: Higher productivity with SafeGuard Enterprise Jane plugs in the portable media containing encrypted reports provided by her team. Jane transparently accesses all the encrypted data and creates her reports. Ladies and gentlemen The magic behind the scenes: SafeGuard Enterprise Key Management SafeGuard Management Console: Security admin. creates a CFO Group. Each member has a SafeGuard Key Ring containing a shared encryption key. Sophos (C) 2009 When Jane s team copies data onto portable media, it is automatically encrypted with the CFO Group key from their SafeGuard Key Ring. Only the CFO Group can read the data. If the media is lost, no one else can read the encrypted data. If members of the CFO Group change, their SafeGuard Key Rings change accordingly. 29

30 The CEO s Presentation: Life with an ordinary encrypted hard disk Joe the CEO is working on an urgent customer presentation. A coffee spill blows How can I Sorry Joe, encrypted his motherboard. get my data back? data takes a day to recover. Oh no!! The CEO s Presentation: Crisis averted with SafeGuard How can I get my data? I need to call my Helpdesk! Hi Joe, don t worry. We will send up a new laptop in a few minutes that we ll connect to your old encrypted hard disk. Thank you, Helpdesk! Ladies and gentlemen Deal closed: Won! The magic behind the scenes: SafeGuard Enterprise Key Management Encrypted disk removed from broken laptop. Placed in external enclosure & connected to new laptop. SafeGuard Management Console: Security admin. drags & drops old disk encryption key into Joe s personal SafeGuard Key Ring. Sophos (C) 2009 Joe s SafeGuard Key Ring now has the old disk s encryption keys. Hi Joe, when you log into your new laptop you can automatically access the old encrypted drive! 30

31 Top Compliance Enabling Technologies Source: The State of Privacy & Data Security Compliance (Oct 2009), Ponemon Institute 31

32 Sophos Encryption Solutions 1. Sophos Security Appliance - Multi-layer security: encryption + DLP + anti-spam + anti-malware 2. Sophos SafeGuard MailGateway - Advanced key/certificate based encryption. Policy based 3. Sophos SafeGuard PrivateCrypto - Lightweight, client-based encryption of attachments 32

33 How it works Sender Sends through their normal client as usual Sends password out-of-band, user registers their own password, or integrated into existing authentication infrastructure (via web service) Sender Password (sent out of band) Sophos Appliance with SPX Encryption Policy determines encryption requirements /Attachments encrypted into a PDF container Password returned to sender, registration notification to recipient, or established through existing authentication infrastructure SPX Encryption Receiver Receives with encrypted PDF attachment Opens/views by entering supplied password Responds securely by clicking a link in the Recipient 33

34 Sophos Appliances at a glance Managed Appliances Remote monitoring from Sophos NOC: alerting, remediation 50+ sensors ensure the health of the device (ease of use akin to a managed service) Complete Protection & Compliance Simple encryption DLP analysis of message & attachment content Stop spam, malware, phishing, and protect data Simplified Administration Easy-to-use web-ui for non-technical users Wizard driven policy and reporting 34

35 TLS Encryption at a glance Industry standard gateway-gateway encryption Ideal solution for trusted partner encryption Automatic transparent encryption at the gateway Simple policy configuration Opportunistic (on-demand) or Per Domain Completely transparent Included in: Sophos Appliances PureMessage for UNIX 35

36 Sophos Security and Data Protection Essential requirements: Anti-spam 90% of business is spam Sender genotype and SLX real-time anti-spam updates Threat protection ti Modern spam attacks link to malicious URL s which download spyware which steals data Data Leakage Prevention 80% of critical corporate information is stored in mail servers Encryption 90% of data loss incidents are accidental SophosLabs proactive blended threat protection with a single AV/AS engine Integrated pre-packaged content control lists take the guess-work out of DLP Patent-pending SPX encryption provides the best user experience in the industry Easy to deploy Most IT admin s spend too much time managing security Choice of software/hardware Security that fits your business Tightly integrated spam, threat, and data protection make security simple Exchange, Domino or PureMessage Unix with a variety of managed appliance HW 36

37 Simplified administration Flexible and Powerful Policy Builder Wizard based encryption policy builder Encryption criteria: Keywords & regular expressions Attached file names & types Sender/recipient user & groups Message attributes (size, headers, mail relay, etc.) Other policy attributes: Custom PDF templates Password management 37

38 Simplified administration Simplified TLS Encryption Policy Setup Set TLS encryption On/Off Opportunistic Per Domain Encryption and Certificate validation 38

39 Sophos SPX Really Simple Encryption Game changing technology Unique, patent-pending Utilizes ubiquitous PDF Reader technology Best user experience available Automatic encryption at the gateway Flexible policy configuration Completely transparent 39

40 Award-winning protection Reader s Choice Gold Winner Best Security Products September 2009 Sophos Security earned top grades across the board, with users giving it high marks where it counted most, detecting and blocking spam, phishing, viruses and spyware. SC Magazine gold medal March 2008 This appliance is easy to deploy and manage and gets a gold medal for its impressive anti-spam performance. ITPro Editor s Choice January 2008 A winner for its anti-spam capabilities... delivering i high h accuracy scores straight from the box." 40

41 Simplified, centralized, customization... Fully customizable and branded cover page message message, with customizable signature 41

42 Transparent and flexible... Recipient views encrypted in their PDF reader Attachments can be opened and worked on just like any other 42

43 Transparent and flexible... Reply button integrated into message enabling secure response 43

44 44