Securing Hadoop Data Big Data Everywhere - Atlanta January 27, 2015

Transcription

1 Securing Hadoop Data Big Data Everywhere - Atlanta January 27, Voltage Security, Inc.

2 A History of Excellence Company: Founded in 2002 Out of Stanford University Based in Cupertino, California Mission: To protect the world s most sensitive data By: Providing encryption and tokenization solutions that protect the data wherever it is used or stored Market Leadership: over 1,100 customers including Certified Technology Partner with MapR and other leading distributions PCI solutions and data protection used by 7 of the top 9 U.S. payment processors, and 7 of 10 top US Banks Leading Retailers, Airlines, Healthcare Networks, Government Agencies Contribute technology to top tier standards organizations NIST, ANSI, IEEE, IETF, ISOP 2

3 Attack Trends vs. Protection Strategy Effectiveness Data-centric security protects data over its lifecycle vs. broad threats. Graph source: Verizon Data Breach Report 2014 Data-at-rest solutions only protect from physical threats 3

4 Why is Securing Hadoop Difficult? Rapid innovation in a well-funded open-source developer community Multiple sources of data from multiple enterprise systems, and real-time feeds with varying (or unknown) protection requirements Multiple types of data combined together in the Hadoop data lake 4

5 Why is Securing Hadoop Difficult? Access by many different users with varying analytic needs Automatic replication of data across multiple nodes once entered into the HDFS data store Reduced control if Hadoop clusters are deployed in a Cloud environment 5

6 Existing Ways to Secure Hadoop Existing IT security: Network firewalls Logging and monitoring Configuration management Enterprise-scale security for Apache Hadoop Apache Knox: Perimeter security Kerberos: Strong authentication Apache Argus: Monitoring and Management Need to augment these with data-centric protection of data in use, in motion and at rest 6

7 Introducing Data-Centric Security Threats to Data Traditional IT Infrastructure Security Data Ecosystem Security Gaps Data & Applica>ons Creden;al Compromise Authen;ca;on Management Security Gap Traffic Interceptors SQL Injec;on, Malware Malware, Insiders SSL/TLS/Firewalls Database Encryp;on SSL/TLS/Firewalls Middleware Security Gap Databases Security Gap File Systems Data Security Coverage Security Gap Malware, Insiders Disk encryp;on Storage 7

8 Introducing Data-Centric Security Threats to Data Traditional IT Infrastructure Security Data Ecosystem Security Gaps Voltage Datacentric Security Data & Applica>ons Creden;al Compromise Authen;ca;on Management Security Gap Traffic Interceptors SQL Injec;on, Malware Malware, Insiders SSL/TLS/Firewalls Database Encryp;on SSL/TLS/Firewalls Middleware Security Gap Databases Security Gap File Systems Data Security Coverage End- to- end Data Protec>on Security Gap Malware, Insiders Disk encryp;on Storage

9 Ideal Solution Secure data yet Useful data Data secured during capture Selec>ve Live data elements available to trusted users or BI tools under policy control Data secure in storage Data stays secure in transit Data stays secure in low- trust processes analy;cs, test, development etc 9

10 Format-Preserving Encryption FPE AES Tax ID juYE%Uks&dDFa2345^WFLERG First Name: Gunther Last Name: Robertson SSN: DOB: First Name: Uywjlqo Last Name: Muwruwwbp SSN: DOB: Ija&3k24kQotugDF2390^32 0OWioNu2(*872weW Supports data of any format: Name, address, dates, numbers, etc. Preserves referen;al integrity, data meaning e.g. date ranges Used for produc;on data, analy;c data or test data cases Recognized by NIST (Na;onal Ins;tute of Standards and Technology NIST SP800-38G 10

11 Data Protection with FPE (AES FFX) and SST Name SS# Credit Card # Street Address Customer ID James Potter Farland Avenue G Ryan Johnson Grant Street S Carrie Young Cambridge Court B Brent Warner Middleville Road G Anna Berman Hamilton Drive S FPE FPE SST* FPE FPE Name SS# Credit Card # Street Address Customer ID Kwfdv Cqvzgk BTIR Ykzbpoi Clpppn S Veks Iounrfo MG KYUP Cmxto Osfalu B Pdnme Wntob VK DEPD Zejojtbbx Pqkag G Eskfw Gzhqlv KF PPED Saicbmeayqw Yotv G Jsfk Tbluhm ZX LKRT Wbbhalhs Ueyzg B Enables large amounts of sensitive data to be de-identified in Hadoop Majority of analysis, MapReduce jobs, etc. can occur on de-identified data Reduces insider threats and improves compliance Enables developers to test without exposure Enables Hadoop and cloud adoption

12 Options for Securing Data in Hadoop Hadoop Cluster Enrichment, processing, Applica;ons & Data Applica;ons & Data Landing Zone ETL & Batch Batch MapReduce, Spark, Hive, Pig MapR-DB and governance Interactive Streaming Impala, Drill, Spark Streaming Storm MapR-FS MapR Data Platform Hadoop Jobs & Analy;cs Hadoop Jobs & Analy;cs Applica;ons, Analy;cs & Data Applica;ons & Data Hadoop Jobs Distribu>on including Apache Hadoop Storage Encryp;on Egress Zone ETL & Batch Applica;ons, Analy;cs & Data Source Data & Applica>ons BI Tools & Downstream Applica>ons Legend: Unprotected Data De- Iden;fied Data Applica;on with Voltage Interface Point Standard Applica;on 12

13 Use Case 1: Global Telecommunication Co. Need Solu>on 13

14 Use Case 2: Health Care Insurance Company Need Solu>on 14

15 Use Case 3: Global Financial Services Company Need Solu>on 15

16 Considerations Multi-platform enterprises adopting a data lake architecture need a cross-platform solution for protection of sensitive data The open source community has invested in building enterprise grade security for Apache Hadoop, with core capabilities for perimeter security, authentication, authorization and auditing Add data-centric security to protect data at rest, in use and in motion, and maintain the value of the data for analytics Together these enable comprehensive security, compliance, and rapid and successful Hadoop adoption! 16

17 Questions? Voltage Security, Inc. Confidential