Df2012 securing information_assets_in_saa_s_clouds_3_0
-
Upload
debbanerjee -
Category
Technology
-
view
152 -
download
0
description
Transcript of Df2012 securing information_assets_in_saa_s_clouds_3_0
Dreamforce 2012 1
Securing Information Assets in SaaS Clouds
Deb BanerjeeTechnical Director, Symantec
@banerjeesec
Shared Responsibility for Security in SaaS Clouds
Dreamforce 2012 2
PAAS
IAAS
SAASEnterprise
Responsibility
Dreamforce 2012 3
Shared Security Model: Enterprise Responsibilities
Dreamforce 2012 4
Dreamforce 2012 5
ASSETS
Sensitive Information Assets
Dreamforce 2012 6
• Applications
-Standard -Custom• Documents
• Database Tables
Asset Discovery is a Foundational Capability.
SaaS Information Asset Classification
Dreamforce 2012 7
• PII
• PCI
Data Classification
• Context-based: DLP-Lite
• Content Inspection: Traditional DLP
Force.com Apex agents
SaaS Information Asset Classification: Context-Based
Identifies data owners based on activity streams
Enables Data Classification based on sensitivity of owner roles
Dreamforce 2012 8
Polling Question
Which sensitive data do you have in the Cloud?
Dreamforce 2012 9
•PCI – Credit card data
•PII/EU DP privacy-related
•HIPAA – Health Care
•FERPA - Education
•Other Company Sensitive
Dreamforce 2012 10
VULNERABILITIES
Configuration Vulnerability: External Service Integrations
Dreamforce 2012 11
External Service Integration
Configuration Vulnerability: Application Permissions
Presentation Identifier Goes Here 12
Application Permissions
SaaS Asset Configuration Assessment: Sharing Rules
Dreamforce 2012 13
SaaS Asset Configuration Assessment: User Permissions
Dreamforce 2012 14
SaaS Asset Configuration Assessment: User Permissions
Presentation Identifier Goes Here 15
Presentation Identifier Goes Here 16
PLAYING DEFENSEBest Practices/Solutions
Data Classification
Content-Based Classification
Context-based Classification
Multiple Deployment Models Agents as Salesforce Apps
Activity Monitoring
Cloud Security Brokers
Presentation Identifier Goes Here 17
User Management
User Provisioning/De-Provisioning
Access Control Context-aware e.g. location-based, data sensitvity-aware
Strong Authentication
Presentation Identifier Goes Here 18
Configuration Assessment
Permissions Applications, Users, Roles/Profiles
Configuration Change Assessments Did someone’s permission to sensitive data increase “unusually”?
Applications Which apps, What data, What users, What external services?
Presentation Identifier Goes Here 19
Encryption/Tokenization
Geo-Residency and Privacy Requirements
Defense in Depth
Encryption Key Management
Impact on hosted application
Network Deployment Model Cloud Security Brokers
Dreamforce 2012 20
SaaS Activity Monitoring for Insider Threat Detection
Dreamforce 2012 21
Activity Logs:
Activity Logs:
Solution Architecture: Extending Out From The Enterprise
Dreamforce 2012
22
Asset Feed
Asset Classification
Activity Feed
Asset Metadata Feed
DLP Agent (APEX)
Remediation Agent(APEX)
API Orchestration
Remediation
Asset Feeds
Cloud Security Brokers
Asset Discovery
Activity LogRemediation
Control Assessment
Asset Compliance View
Information Classification View
Activity-based Threat detection
SFDC Collector
Content & Context
SFDC Config Checks
SFDC API
SFDC API
Security & Compliance
Admin
Security Ops
End User
DLP
SIEM/DI
Security Ops
Dreamforce 2012
Polling Question
Which Security Solutions are you using today?
Dreamforce 2012 23
•Data Classification
•User Provisioning and Access Management
•Encryption/Tokenization
•Configuration Assessment
•Activity Monitoring
Deb BanerjeeDeb Banerjee
Technical Director@banerjeesec