Fully Managed Secure Data Sharing (a cloud service)

Transcription

1 Protect your critical infrastructure, information & interactions Fully Managed Secure Data Sharing (a cloud service) working on behalf of

2 What is Fully Managed Secure Data Share - FMSDS?

3 Core Technology

4 FMSDS Enrolment Key Management Policy Admin User ID Obfuscation Reporting Gradian Secure Cloud Administrator

5 FMSDS Using Symantec-PGP technology, we provide a fully secure, cloud based, managed solution for protecting data stored in and shared through the cloud This eliminates the requirement for onsite management server infrastructure and support. IT Management overhead is dramatically reduced. All access requests are managed securely from the cloud.

6 What s Different from On-site Protected, proprietary technology and processes, provide fully secure: Enrolment Key management Policy Reporting. from the cloud

7 Key Safeguard Features Data leaves your network encrypted Admin only manages: User ID obfuscation (initial set up) Policy Key revocation schedule Gradian never has access to: Data User IDs Delivered from secure, scalable, SLA controlled environment

8 Service Level Agreement Availability: Enrolment 99.5% New users 99.9% Reports 99.5% Enrolment Interface Response time < 7 seconds Backup Keys 99.9%

9 Consultancy Services Architectural design Audits, Health Checks, Reviews Deployment Project Management Training Examples : Integration with existing Symantec-PGP User awareness and education training SOW Creation and Delivery

10 Thank You. Protect your critical infrastructure, information & interactions

11 Back Up Slides Architecture and processes

12 Architecture A redundant architecture configured in a matrix networking model External interfaces are firewalled to only the Symantec Server Internal Admin interface is firewall restricted to the services published through the Web Admin Consoles

13 Data Centre Specifications Diverse fibre from Virgin and BT Fully meshed BGP multi-gigabit network High-end Cisco stacked routers and switches Under-floor Denco air-conditioning system Fully redundant Riello UPS system Volvo diesel backup generator VESDA smoke detection FM200 fire suppression system Secure locked server racks CCTV and access control throughout

14 Disaster Recovery Local site failover Manual DNS change to enable the PGP Slave server to process requests All other services are automatically configured for automatic failover Offsite data replication for backup The PGP database is backed up and encrypted before being transferred offsite for secure storage Support team have a dedicated console to monitor the health of the system components 24x7 Heartbeats and dummy requests to test the performance and availability 4 hour Total time to Recover In the event of a data centre loss

15 Data Security All systems are firewalled Secure Physical Site Access Control Internal Administration requires 2 factor authentication All application requests are logged and audited Change control process requires secondary level authentication before certain changes can be made User Data is obfuscated from Gradian

16 FMSDS Design Principles Deliver a secure, reliable fault tolerant Symantec Secure Data Share solution as a fully managed, cloud delivered service Critical Processes Enrolment Encryption Key backup Business Processes Policy Reporting

17 UserID obfuscation Gradian generate unique UserIDs when a customer places an order These UserIDs are also provided with default passwords This UserID and Password must be used to perform the enrolment, the password can be changed after the initial enrolment The customer is responsible for maintaining knowledge of which UserID was provided to which actual end user for folder access This eliminates the risk of a security compromise at Gradian

18 Customer Security Process When a customer is added to the service they are required to provide 2 authorised administrative contacts Contact details include , office phone, & mobile phone A unique Access Credential is provided to each of the administrative contacts via secure . A customer that requests support or key retrieval must be validated in the following way One of the administrative contacts must be the initiator of the request. Gradian will take the initial call and then call the contact back on one of the numbers that were specified during customer enrolment The administrative contact must provide the Access Credential to the Gradian Support operative along with the Gradian issued UserID that they require support/key retrieval for. The support request will be handled by Gradian s MSP support staff Customers must inform Gradian of any change in authorised administrative contacts

19 Thank You. Protect your critical infrastructure, information & interactions