Does Security in the Cloud Get More or Less Complex? Jozef Krakora, Senior Product Manager October 7, 2014

Transcription

1 Does Security in the Cloud Get More or Less Complex? Jozef Krakora, Senior Product Manager October 7, 2014

2 Physical Cloud - Benefits & Drawbacks Infrastructure Benefits Drawbacks Physical Cloud Familiarity Reliable Known capacity & throughputs Security controls hardwired Elastic Cheaper Easier to manage Safer? More expensive Long time for new hardware Long time for reconfigurations Where is the Firewall & Perimeter? Where are my Assets? Where is the Data? Who controls what?

3 Which is Easier to keep Secure?

4 The Islands and the Ships Come and Go Solutionary Founded 2000 Vigilant Minds Acquisition 2007 ActiveGuard V4 Next-Gen Platform 2010 Acquired by NTT 2013 GTIR Published 2014 ActiveGuard 2 nd Patent 2002 Inline Enrichment & Dynamic Correlation 2008 Gartner MQ Leader 2012 GTIR Published Application & Database Security Monitoring 2009 Advanced Detection Analytics 2012 Trillionth Log Processed 2014 Raw Log Search 2001 ActiveGuard V Buffer Zone (Cloud) Patent 2011 Gartner MQ Leader 2013 Big Data Analytics 2014 Next Generation MSSP

5 But the Elements of Security Stay the Same Effectively plan and efficiently operate security controls Broad experience, deep expertise to assist in planning and implementing security controls Consistent, repeatable monitoring and management of security controls Continuously protect against threats Harden your organization to maximize avoidable threats Provide an advanced detective, investigative, and response capability to minimize the impact of threats Predict and prevent future threats through feedback Neighborhood watch identifies threats before they can impact clients Gather, analyze and validate global threat intelligence to create and deploy countermeasures

6 And Good Security Ties All the Pieces Together * User AD xxxxx xxxxx xxxxx xxxxx Anti- Malware xxxxx xxxxx Bytes-in Bytes-out Virus Malware Endpoint Incident Firewall, IDS Malware, Endpoint User Virus/Malware Asset Bytes in/out Geography Malicious Firewall Internet Asset xxxxx xxxxx IDS Geography MHID Compliance Criticality * If you know where all the pieces are, what they are, and what they mean...

7 55+M Pieces to be Exact Into 7 Actionable Alerts Features Global Threat Intelligence SERT Cross-device Correlation Advanced Threat Detection and Context-based Alerts Built-in Heuristics and Anomaly Detection Extension of the Internal Team Unparalleled, Passionate Customer Service 100% of collected logs are analyzed and retained for one year Analyzed by Security Experts 24/7 Portal Access with Industry, Compliance & Custom Reporting Benefits Peace of Mind Maximum Returns on Security Operations Investment or Spend Flexible, Easy-to-do Business with Partner Optimization of Existing Technology Investments Strengthened, Accelerated Security Program Reduced Cost of Security Eased Audits and Compliance Support Incident Response Preparedness (SERT CIR) 55,661,301 Logs Received 286,119 Logs of Interest 8,187 Event queues 732 Events Note: 15 minutes average per Event 1 FTE = 2,080 hours Events Alerted to Client

8 Today, Infrastructures Have At Least One Cloud Cloud Environment WAN Regional Analyzer Internet Solutionary SOCs

9 Firewall & Perimeter Physical Once place Fixed FW policy Fixed security log flow One FW administrator Cloud Many locations Many firewalls Numerous egress points Many security zones Constantly changing Numerous FW administrators

10 Malware & Intrusion Detection Physical One egress Fixed internal networks Known DMZ and zones Known application pathways Limited threat pathways Cloud Many egress SDN unpredictable number of internal networks and zones Difficult or impossible to cover all zones with malware and intrusion detection economically

11 Endpoint Security Physical Fixed and known Cloud Infinitely elastic Exponentially more risky

12 Users, Administrators and Domains Physical Users known Administrators control user access to physical domains and endpoints Fixed and predictable domains with contents and perimeters easy to define and control Cloud # of users can be just as dynamic as # of endpoints Multiple administrators Legacy data center Cloud data center Virtualized infrastructure Dynamically growing applications and databases Dynamic domains with difficult to control perimeters and controls

13 Assets, Data and Compliance Physical Assets are physical Data resides on Assets Compliance easy to map to Assets and Data Cloud Assets come and go Networks and perimeter dynamic Data is swimming from place to place Compliance becomes difficult to impossible to track without tremendous discipline

14 Geography Physical Physical infrastructure is in one place Cloud With load balancing, virtual infrastructure, applications and data move from place to place Cloud providers guarantee locations to a degree, but the boat can still drift from one continent to another unless closely watched

15 Cloud Provisioning & Virtualization Administration Physical n/a Cloud Cloud Administrators (Amazon, Azure, etc.) Hypervisors and Host OSs Virtualization Management Consoles

16 So, Is there Hope for Cloud Security? Despite the countless challenges that clouds introduce to security, with sufficient policy, process, discipline, and testing, cloud security can be achieved, and achieved at scale. But it is tricky!

17 And a Single Pain of Glass Helps

18 Additional Notes to work in Should have end to end visibility into and through the cloud Shouldn't be an island - ideally a single pane of glass to see what's happening where regardless of in the cloud or not You can outsource many things to a cloud provider But very hard to outsource risk and compliance requirements as they get more more detailed and involved with Still need to do all that you did before, Plus more SDN/virtual infrastructure admin monitoring, etc. Hacking the SDN admin console - increased risk

19 Thank You!