Taking a Data-Centric Approach to Security in the Cloud
|
|
|
- Rudolf Evans
- 10 years ago
- Views:
Transcription
1 Taking a Data-Centric Approach to Security in the Cloud Bob West Chief Trust Officer CipherCloud 2014 CipherCloud All rights reserved 1
2 Taking a Data-Centric Approach to Cloud Data Protection Bob West Chief Trust Officer 2014 CipherCloud All rights reserved 2
3 Evolving Networking & Security Models 1970 s 1990 s 2000 s 2010 s Mainframe Client Server Internet Cloud Era Computing model Centralized Computing model Distributed, internal Computing model Enterprise-centric Computing model Public, private cloud Connectivity Limited Connectivity Internal only Connectivity Global messaging Connectivity Application level Data storage Centralized Data storage Within enterprise Data storage Enterprise silos Data storage Hybrid Security model Perimeter Security model Perimeter, endpoint Security model Perimeter, endpoint, tunneling, identity Security model Data-centric for any location 2014 CipherCloud All rights reserved 3
4 Today s Reality Data is Flowing Everywhere ERP Databases File Sharing HR CRM Collaboration External User Internal Users Enterprise Boundary External User 2014 CipherCloud All rights reserved 4
5 Changing Nature of IT with De-Perimeterization Protecting infrastructure is not enough Business critical systems now outside the network Key applications are outside your control Reliance on cloud providers to secure systems Cloud customers ask the wrong questions Focus on transferring old legacy security models Need to change to a data-centric model Cloud providers don t accept liability for your data You own the data you need to secure it Security needs to travel with your data You need to control access regardless of location 2014 CipherCloud All rights reserved 5
6 Where Cloud Data Resides and What Laws Might Apply USA Federal CALEA, CCRA, CIPA, COPPA, EFTA, FACTA, ECPA, FCRA, FISMA, FERPA, GLBA, HIPAA, HITECH, PPA, RFPA, Safe Harbor, US PATRIOT Act Canada PIPEDA, FOIPPA, PIPA United Kingdom ICO Privacy and Electronic Communications Regulations Europe Privacy laws in 28 countries European Union EU Data Protection Directive, State Data Protection Laws South Korea Network Utilization and Data Protection Act Japan Personal Information Protection Act Mexico Personal Data Protection Law US States Breach notification in 47 states Brazil Morocco Data Protection Act India Pending Laws under discussion Thailand Official Information Act B.E Taiwan Computer-Processed Personal Data Protection Hong Kong Personal Data Privacy Ordinance Colombia Data Privacy Law 1266 Article 5 of Constitution Singapore Personal & Financial Data Protection Acts Philippines Propose Data Privacy Law Chile Law for the Protection of Private Life CipherCloud 2013 CipherCloud All rights 6 All rights reserved reserved. Argentina Personal Data Protection Law, Information Confidentiality Law South Africa Electronic Communications and Transactions Act Australia National Privacy Principals, State Privacy Bills, Spam and Privacy Bills Privacy Act New Zealand
7 Common Regulatory Themes Mandates to protect personally identifiable information (PII) Penalties include steep fines, and personal liability for executives Breach notification is a big stick Risks of public breach disclosure can be hugely damaging (example: Target) Data owners are responsible, regardless of where data goes Cloud providers may share some limited responsibility, but that does not get data owners off the hook Regulations don t typically tell you what technology to use Legislation rarely can keep up with technological changes Best practices evolve, changing the definition of reasonable As solutions become widely adopted, not adopting them becomes risky 2014 CipherCloud All rights reserved 7
8 Seeking a Safe Harbor Regulation Region Breach Notification Safe Harbor Exemptions Recommendations on Encryption PCI DSS Encryption a critical component GLBA HIPAA, HITECH EU Directives Proposed Proposed ICO Privacy Amendment Privacy Amendment Not specified US State Privacy Laws Generally Yes Safe harbor if encryption has been applied adequately Safe harbor if encryption has been applied adequately New regulation proposes safe harbor exemption if data was adequately encrypted. Notification not required if there are measures in place which render the data unintelligible. Not specified but you should to take adequate measures to prevent the unlawful disclosure Typical breach definitions: - Personal Information: data that is not encrypted - Breach: access to unencrypted data 2014 CipherCloud All rights reserved 8
9 World s Leading Enterprises Trust CipherCloud Top 3 US Bank s Consumer Self- Service Loan Origination Portal Largest Hospital Chain Meets HIPAA & HITECH in the Cloud German Cosmetics Giants Meets International Security Regulations Top Canadian Bank Safeguards Proprietary Information in the Cloud Non-Technology Leader Trust Sensitive Data in Cloud Major European Telco Consolidates Call Centers for 25 Countries Global Leader in Customer Loyalty Moves to the Cloud UK Education Organization Deploys Global Cloud-Based Portal Large Pharmaceutical Company Uses Encrypted Major Wall Street Firm Adopts Cloud Applications with Confidence Genomics Testing Leader Protects Patient Data while Using the Cloud New Zealand Bank Collaborates in the Cloud and Meets Compliance Medical Audit Leader Launches Cloud-Based Customer Portal Credit Reporting Giant Deploys Cloud Government-Owned Mortgage Collaboration with DLP Controls 2014 CipherCloud Backer Protect All rights PII Data reserved in the Cloud 9
10 CipherCloud Complete Platform Data Loss Prevention Protecting sensitive data from leaks Extending corporate DLP to the cloud Data Protection Preventing unauthorized access to data Maintaining application functionality Activity Monitoring Monitoring user and data activity Detecting anomalies in user behavior 2014 CipherCloud All rights reserved 10
11 Protect Your Sensitive Data in the Cloud Ground breaking security controls Protect sensitive information in real time, before it is sent to the cloud while preserving application usability. Key Management Searchable Strong Encryption Tokenization Malware Detection Data Loss Prevention 2014 CipherCloud All rights reserved 11
12 Where Should You Protect Your Data? Data in Transit Data at Rest Vulnerabilities Account hijacking* Forced disclosure Data breaches* Malicious insiders* Insecure APIs* Shared technology* Data in Use * Top Threats 2014 CipherCloud All rights reserved 12
13 Key Questions for Cloud Data Protection What data do you need to protect? Who should or shouldn t access it? What functionality needs to be preserved? Are there additional technical requirements? Where should sensitive data reside? 2014 CipherCloud All rights reserved 13
14 One Size Does Not Fit All Range of protection options preserve data structure, format and searching Searchable encryption High-performance encryption and tokenization at the enterprise gateway Tokenization Format preserving Partial encryption Transparent to users Preserves database functionality 2014 CipherCloud All rights reserved 14
15 Tokenization Internal Network Enterprise Control Cloud Application Credit Card Token Internal User Token database FUNCTIONALITY SECURITY OVERHEAD 2014 CipherCloud All rights reserved 15
16 Conventional Encryption Internal Network Enterprise Control Cloud Application Confidential ऑપમમऑપમएপમમથજए Internal User Encryption Keys FUNCTIONALITY SECURITY OVERHEAD 2014 CipherCloud All rights reserved 16
17 Format Preserving Encryption Standard AES Encryption r 丏 軸 与 80l1zx1 丏 k 与 5 与 40l1 丏 h 最 与 2l1 丏 邈 与 41x Credit Card Number Format Preserving Encryption Maintains 16- digit numeric format FUNCTIONALITY SECURITY OVERHEAD 2014 CipherCloud All rights reserved 17
18 Partial Encryption Techniques Internal Network Enterprise Control Cloud Application Customers Search query John Smith ऑપમऑપમएથજए ଶढଯতઈଌਲऑપ ఌত Authorized User Encryption Keys Varies Varies FUNCTIONALITY SECURITY OVERHEAD 2014 CipherCloud All rights reserved 18
19 Authorized User United Oil & Gas Unauthorized User Data is encrypted field-by-field basis, based on your security policies Fields can be partially encrypted Credit card numbers fully encrypted with AES CipherCloud All rights reserved 19
20 Searchable Strong Encryption (SSE) Internal Network Enterprise Control Cloud Application Customers Search query John Smith ऑપમऑપમएથજए ଶढଯতઈଌਲऑપ ఌত Authorized User Encryption Keys Varies Varies FUNCTIONALITY SECURITY OVERHEAD 2014 CipherCloud All rights reserved 20
21 About CipherCloud Company 3.8+ Million Active Users 13 Industries 25 Countries 7 Languages Solutions Cloud Discovery Cloud DLP Strong Encryption Tokenization Activity Monitoring Anomaly Detection Customers 5 out of 10 Top US Banks 3 out of 5 Top Health Providers Top 2 Global Telecomm Company 3 out of 5 Top Pharmaceuticals P 13 Patents 450+ Employees 40% of Global Mail Delivery Largest US Media Company 2014 CipherCloud All rights reserved 23
22 Thank You For additional information : Website: [email protected] LinkedIn: Phone: CIPHER Bob West Chief Trust Officer [email protected] 2014 CipherCloud All rights reserved 24
Can Cloud Providers Guarantee Data Privacy & Sovereignty?
Can Cloud Providers Guarantee Data Privacy & Sovereignty? Andrew Bartlam, VP EMEA Business Development Cloud Exo Europe 11 th Marcg 2015 2014 CipherCloud All rights reserved. 2014 CipherCloud All rights
Cloud Security Strategies. Fabio Gianotti, Head of Cyber Security and Enterprise Security Systems
Cloud Security Strategies Fabio Gianotti, Head of Cyber Security and Enterprise Security Systems London, 14 October 2015 UNICREDIT AT A GLANCE Employees: more than 146.600 Branches: 8.403 Banking operations
Addressing Information Protection, Privacy & Sovereignty Concerns in Cloud Applications
Addressing Information Protection, Privacy & Sovereignty Concerns in Cloud Applications Varun Badhwar Co-Founder; VP of Products & Solution Engineering 1 2013 CipherCloud All rights reserved. Agenda Introduction
Global Privacy and Data Security in the Cloud September 14, 2011 Miriam Wugmeister
2011 Morrison & Foerster LLP All Rights Reserved mofo.com Global Privacy and Data Security in the Cloud September 14, 2011 Miriam Wugmeister Presenter Miriam Wugmeister Morrison & Foerster LLP New York
Presentation for : The New England Board of Higher Education. Hot Topics in IT Security and Data Privacy
Presentation for : The New England Board of Higher Education Hot Topics in IT Security and Data Privacy October 22, 2010 Rocco Grillo, CISSP Managing Director Protiviti Inc. Quote of the Day "It takes
Data Loss Prevention. Keeping sensitive data out of the wrong hands*
Data Loss Prevention Keeping sensitive data out of the wrong hands* September 9, 2007 Aaron Davies-Morris, Director PwC Advisory Services Zeke Jaggernauth, Manager PwC Advisory Services Agenda Data Breaches
Websense Data Security Solutions
Data Security Suite Data Discover Data Monitor Data Protect Data Endpoint Data Security Solutions What is your confidential data and where is it stored? Who is using your confidential data and how? Protecting
CSR Breach Reporting Service Frequently Asked Questions
CSR Breach Reporting Service Frequently Asked Questions Quick and Complete Reporting is Critical after Data Loss Why do businesses need this service? If organizations don t have this service, what could
White paper. Why Encrypt? Securing email without compromising communications
White paper Why Encrypt? Securing email without compromising communications Why Encrypt? There s an old saying that a ship is safe in the harbour, but that s not what ships are for. The same can be said
Introduction to Data Privacy & ediscovery Intersection of Data Privacy & ediscovery
Today s Topics Introduction to Data Privacy & ediscovery General Overview Data Privacy in the United States Data Privacy in Foreign Countries Intersection of Data Privacy & ediscovery Preservation of Data
Four steps to improving cloud security and compliance
white paper Four steps to improving cloud security and compliance Despite the widespread proliferation of cloud computing, IT decision makers still express major concerns about security, compliance, and
Sybase Solutions for Healthcare Adapting to an Evolving Business and Regulatory Environment
Sybase Solutions for Healthcare Adapting to an Evolving Business and Regulatory Environment OVERVIEW Sybase Solutions for Healthcare Adapting to an Evolving Business and Regulatory Environment Rising medical
Best Practices for Protecting Healthcare Information in the Cloud
White Paper Best Practices for Protecting Healthcare Information in the Cloud How 5 healthcare companies are complying with increasingly strict US HIPAA, HITECH, and international laws with 1 solution
PIPEDA and Online Backup White Paper
PIPEDA and Online Backup White Paper The cloud computing era has seen a phenomenal growth of the data backup service industry. Backup service providers, by nature of their business, are compelled to collect
Flexible Cloud Services to Compete
white paper Service Providers Need Flexible Cloud Services to Compete Enterprise Customers Demand Flexible Cloud Solutions When the concept of cloud services first came about, there was a great deal of
Email Compliance in 5 Steps
Email Compliance in 5 Steps Introduction For most businesses, email is a vital communication resource. Used to perform essential business functions, many organizations rely on email to send sensitive confidential
Cloud Security: Getting It Right
Cloud Security: Getting It Right Sponsored by Armor Independently conducted by Ponemon Institute LLC Publication Date: October 2015 Ponemon Institute Research Report Cloud Security: Getting It Right Ponemon
Private Cloud for Every Organization
white paper Private Cloud for Every Organization Leveraging the community cloud As more organizations today seek to gain benefit from the flexibility and scalability of cloud environments, many struggle
Cisco SAFE: A Security Reference Architecture
Cisco SAFE: A Security Reference Architecture The Changing Network and Security Landscape The past several years have seen tremendous changes in the network, both in the kinds of devices being deployed
Protecting personally identifiable information: What data is at risk and what you can do about it
Protecting personally identifiable information: What data is at risk and what you can do about it Virtually every organization acquires, uses and stores personally identifiable information (PII). Most
opinion piece Fragmenting DLP assessment, implementation, and management is counter-intuitive
opinion piece Fragmenting DLP assessment, implementation, and management is counter-intuitive Contents Introduction 01 Having the cake and eating it 01 Holistic = end to end 01 The devil is in the detail
Background. Liwei Ren. Trend Micro
Securing Your Data for the Journey to the Clouds Liwei Ren, Ph.D, Trend Micro April, 2015, SNIA DSI 2015, Santa Clara, California Copyright 2011 Trend Micro Inc. 1 Background Liwei Ren Research interests
Protecting Your Data On The Network, Cloud And Virtual Servers
Protecting Your Data On The Network, Cloud And Virtual Servers How SafeGuard Encryption can secure your files everywhere The workplace is never static. Developments include the widespread use of public
Securing Data in the Cloud
Securing Data in the Cloud Meeting the Challenges of Data Encryption and Key Management for Business-Critical Applications 1 Contents Protecting Data in the Cloud: Executive Summary.....................................................
Trend Micro Enterprise Security For the Healthcare Industry
Trend Micro Enterprise Security For the Healthcare Industry A Trend Micro White Paper Assuring regulatory compliance, ephi protection, and secure healthcare delivery July 2010 I. HEALTHCARE REQUIREMENTS
Trend Micro Cloud Security for Citrix CloudPlatform
Trend Micro Cloud Security for Citrix CloudPlatform Proven Security Solutions for Public, Private and Hybrid Clouds 2 Trend Micro Provides Security for Citrix CloudPlatform Organizations today are embracing
Security and Privacy in Cloud Computing
Security and Privacy in Cloud Computing - Study Report Sai Lakshmi General Manager Enterprise Security Solutions 2 Agenda Background & Objective Current Scenario & Future of Cloud Computing Challenges
Practical Advice for Cloud Data Protection
Practical Advice for Cloud Data Protection Ulf Mattsson CTO, Protegrity [email protected] Ulf Mattsson, Protegrity CTO Cloud Security Alliance (CSA) PCI Security Standards Council Cloud & Virtualization
best practice guide The Three Pillars of a Secure Hybrid Cloud Environment
best practice guide The Three Pillars of a Secure Hybrid Cloud Environment best practice guide The Three Pillars of a Secure Hybrid Cloud Environment Introduction How sound risk management, transparency
Best Practices in Identity and Access Management (I&AM) for Regulatory Compliance. RSA Security and Accenture February 26, 2004 9:00 AM
Best Practices in Identity and Access Management (I&AM) for Regulatory Compliance RSA Security and Accenture February 26, 2004 9:00 AM Agenda Laura Robinson, Industry Analyst, RSA Security Definition of
The HR Skinny: Effectively managing international employee data flows
The HR Skinny: Effectively managing international employee data flows Topics we will cover today Laws affecting HR data flows HR international data protection challenges and strategic solutions Case study
[Company Name] HIPAA Security Awareness and Workforce Training Program Manual
[Company Name] HIPAA Security Awareness and Workforce Training Program Manual The Importance of Security Awareness Training 4 Data Security Breaches 5 What is Information Security? 6 Roles and Responsibilities
Governance, Risk and Compliance Assessment
Governance, Risk and Compliance Assessment Information security is a pervasive business requirement and one that no organisation can afford to get wrong. If it s not handled properly, your business could
HIPAA in the Cloud. How to Effectively Collaborate with Cloud Providers
How to Effectively Collaborate with Cloud Providers Speaker Bio Chad Kissinger Chad Kissinger Founder OnRamp Chad Kissinger is the Founder of OnRamp, an industry leading high security and hybrid hosting
SECURING SENSITIVE DATA WITHIN AMAZON WEB SERVICES EC2 AND EBS
SECURING SENSITIVE DATA WITHIN AMAZON WEB SERVICES EC2 AND EBS The Challenges and the Solutions Vormetric, Inc. 2545 N. 1st Street, San Jose, CA 95131 United States: 888.267.3732 United Kingdom: +44.118.949.7711
Why Email Encryption is Essential to the Safety of Your Business
Why Email Encryption is Essential to the Safety of Your Business What We ll Cover Email is Like a Postcard o The Cost of Unsecured Email 5 Steps to Implement Email Encryption o Know Your Compliance Regulations
Enterprise Data Protection
PGP White Paper June 2007 Enterprise Data Protection Version 1.0 PGP White Paper Enterprise Data Protection 2 Table of Contents EXECUTIVE SUMMARY...3 PROTECTING DATA EVERYWHERE IT GOES...4 THE EVOLUTION
Securing and protecting the organization s most sensitive data
Securing and protecting the organization s most sensitive data A comprehensive solution using IBM InfoSphere Guardium Data Activity Monitoring and InfoSphere Guardium Data Encryption to provide layered
Securing The Cloud. Foundational Best Practices For Securing Cloud Computing. Scott Clark. Insert presenter logo here on slide master
Securing The Cloud Foundational Best Practices For Securing Cloud Computing Scott Clark Agenda Introduction to Cloud Computing What is Different in the Cloud? CSA Guidance Additional Resources 2 What is
Cyber Warfare. Global Economic Crime Survey. Causes of Cyber Attacks. David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP. Why Cybercrime?
Cyber Warfare David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP Global Economic Crime Survey Cyber crime is the fastest growing economic crime up more than 2300% since 2009 1 in 10 companies
Best Practices for a BYOD World
Face Today s Threats Head-On: Best Practices for a BYOD World Chris Vernon CISSP, VTSP Security Specialist Agenda Mobile Threats Overview 2013 State of Mobility Survey Canada BYOD Best Practices 2 Mobile
The State of Data Centric Security
The State of Data Centric Security Sponsored by Informatica Independently conducted by Ponemon Institute LLC Publication Date: June 2014 Ponemon Institute Research Report State of Data Centric Security
HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT
HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT A Review List This paper was put together with Security in mind, ISO, and HIPAA, for guidance as you move into a cloud deployment Dr.
Solving data residency and privacy compliance challenges Delivering business agility, regulatory compliance and risk reduction
Solving data residency and privacy compliance challenges Delivering business agility, regulatory compliance and risk reduction Introduction In today s dynamic business environment, corporation s intangible
Thales e-security keyauthority Security-Hardened Appliance with IBM Tivoli Key Lifecycle Manager Support for IBM Storage Devices
> Thales e-security keyauthority Security-Hardened Appliance with IBM Tivoli Key Lifecycle Manager Support for IBM Storage Devices WHITE PAPER November 2011 www.thales-esecurity.com TABLE OF CONTENTS THE
How To Protect Yourself From A Hacker Attack
Cybersecurity Demystified: Information Technology Security Trends Joe Oleksak, Plante Moran Agenda Data Security Trends Example Attacks Industry Examples An Answer 1 Who Are The Victims? Targets - victims
Avoiding The Hidden Costs. of the Cloud
Avoiding The Hidden Costs of the Cloud 2013 CONTENTS 4 5 6 7 8 9 10 INTRODUCTION ROGUE CLOUD IMPLEMENTATIONS CLOUD BACK UP AND RECOVERY INEFFICIENT CLOUD STORAGE COMPLIANCE AND ediscovery SSL CERTIFICATE
Overview. What are operational policies? Development, adoption, implementation
Practical Geospatial Policies: Resolving Operational Issues to Optimize Your SDI Ed Kennedy Hickling Arthurs Low Corporation and Cynthia Mitchell and Simon Riopel Division, Natural Resources Canada Overview
Protecting What Matters Most. Bartosz Kryński Senior Consultant, Clico
Protecting What Matters Most Bartosz Kryński Senior Consultant, Clico Cyber attacks are bad and getting Leaked films and scripts Employee lawsuit Media field day There are two kinds of big companies in
STORAGE SECURITY TUTORIAL With a focus on Cloud Storage. Gordon Arnold, IBM
STORAGE SECURITY TUTORIAL With a focus on Cloud Storage Gordon Arnold, IBM SNIA Legal Notice The material contained in this tutorial is copyrighted by the SNIA. Member companies and individual members
Security Issues in Cloud Computing
Security Issues in Computing CSCI 454/554 Computing w Definition based on NIST: A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources
opinion piece Eight Simple Steps to Effective Software Asset Management
opinion piece Eight Simple Steps to Effective Software Asset Management Contents Step 1: Collate your licence agreements 01 Step 2: Determine your actual licence position 01 Step 3: Understand your existing
Cloud Security and Managing Use Risks
Carl F. Allen, CISM, CRISC, MBA Director, Information Systems Security Intermountain Healthcare Regulatory Compliance External Audit Legal and ediscovery Information Security Architecture Models Access
Cloud Security Trust Cisco to Protect Your Data
Trust Cisco to Protect Your Data As cloud adoption accelerates, organizations are increasingly placing their trust in third-party cloud service providers (CSPs). But can you fully trust your most sensitive
A Benchmark Study of Multinational Organizations
A Benchmark Study of Multinational Organizations Research Report Independently Conducted by Ponemon Institute LLC January 2011 The True Cost of Compliance Benchmark Study of Multinational Organizations
Security in Fax: Minimizing Breaches and Compliance Risks
Security in Fax: Minimizing Breaches and Compliance Risks Maintaining regulatory compliance is a major business issue facing organizations around the world. The need to secure, track and store information
7 Demands Enterprises Must Make from Cloud Providers
7 Demands Enterprises Must Make from Cloud Providers When choosing a provider for your enterprise cloud, there is plenty to consider. How do you know a provider is actually enterprise-ready, despite their
The Onslaught of Cyber Security Threats and What that Means to You
The Onslaught of Cyber Security Threats and What that Means to You No End in Sight for Cyber Crime Growth Number of mobile devices affected IBM Number of accounts hacked CNN Money Number of malware samples
A Websense Research Brief Prevent Data Loss and Comply with Payment Card Industry Data Security Standards
A Websense Research Brief Prevent Loss and Comply with Payment Card Industry Security Standards Prevent Loss and Comply with Payment Card Industry Security Standards Standards for Credit Card Security
HIPAA security rules of engagement
healthcare HIPAA security rules of engagement The use of health information technology continues to expand in healthcare. Healthcare organizations are using web-based applications and other portals that
Where Data Security and Value of Data Meet in the Cloud
Where Data Security and Value of Data Meet in the Cloud - Practical advice for cloud data security Ulf Mattsson CTO, Protegrity [email protected] Ulf Mattsson, Protegrity CTO Cloud Security Alliance
Using a Managed File Transfer technology to prepare your customers for the GDPR (whatever is next)
Using a Managed File Transfer technology to prepare your customers for the GDPR (whatever is next) Richard Chapman Regional Manager MFT Division 4 th Nov 2015 November 19, 2015 Over two thirds of IT professionals
Email Security in Law Firms. What you need to know and how you can use secure email to win more clients
Email Security in Law Firms What you need to know and how you can use secure email to win more clients Introduction As clients are demanding greater protection of their information, law firms must incorporate
