כנס אבטחת מידע מוטו תקשורת v2
DESCRIPTION
הרצאה מתוך כנס אבטחת מידע של היריחון סטאטוס 18.11.2010TRANSCRIPT
![Page 1: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/1.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 1
Shahar Geiger Maor, CISSP Senior Analyst at STKI
[email protected] www.shaharmaor.blogspot.com
Information Security Trendsin Israel
18.11.2010
![Page 2: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/2.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 2
Presentation’s Agenda
General Trends
Cloud Security
Data-Centric Security
Mobile Security
Regulations: PCI
![Page 3: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/3.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 3
Presentation’s Agenda
General Trends
Cloud Security
Data-Centric Security
Mobile Security
Regulations: PCI
![Page 4: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/4.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 4
Information Security: Israeli Market Size (M$)
2009 changes 2010 changes 2011 changes 2012
Security Software 85.0 23.53% 105.0 4.76% 110.0 9.09% 120.0
GRC & BCP
50.0 50.00% 75.0 9.33% 82.0 9.76% 90.0
Security VAS
85.0 11.76% 95.0 8.42% 103.0 6.80% 110.0
totals 25.00% 7.27% 8.47%220.0 275.0 295.0 320.0
![Page 5: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/5.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 5
Information Security Spendings
1. Usually very “dynamic”2. Crisis/regulation driven instead of policy driven3. Part of budget may be embedded within other IT
units\ projects
Approximately 5% of IT budget*
* Including manpower
![Page 6: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/6.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 6
Security Staffing Ratios
Organization Type Ratios of Security Personnel (Israel)
Average Public Sector 0.15% of Total Users“Sensitive” Public Sector 0.5% of Total Users
![Page 7: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/7.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 7
Information Security “Threatscape”
![Page 8: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/8.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 8
The Web is Dead!
http://www.wired.com/magazine/2010/08/ff_webrip/
![Page 9: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/9.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 9
Is Technology Good or Bad?
![Page 10: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/10.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 10
Israel: a Security Empire
![Page 11: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/11.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 11
Real Empire!!
Source: http://search.dainfo.com/israel_hitech/Template1/Pages/StartSearchPage.aspx
![Page 12: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/12.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 12
Local Security Vendors and CISO’s Decision Making
CISO is usually
considering
technology, local support
and price
Is a local soluti
on available?
Most chance it will
be among
last three
bidders
![Page 13: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/13.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 13
What’s on the CISO’s Agenda?(STKI Index 2010)
EPS/mobile14%
Market/Trends13%
Access/Au-thentication
12%Network Sec
12%
GW10%
DCS9%
DB/DC SEC9%
Vendor/Product
8%
Regulations7%
SIEM/SOC3%
Miscellaneous2%
Encryption1%
![Page 14: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/14.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 14
Presentation’s Agenda
General Trends
Cloud Security
Data-Centric Security
Mobile Security
Regulations: PCI
![Page 15: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/15.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 15
Cloud Security
Source: http://csrc.nist.gov/groups/SNS/cloud-computing/
![Page 16: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/16.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 16
Is Cloud Security Important??
http://www.thepeople.co.il/Index.asp?CategoryID=82&ArticleID=1281
![Page 17: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/17.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 17
How Does Cloud Computing Affect the “Security Triad”?
Confidentiality
IntegrityAvailability
![Page 18: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/18.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 18
Cloud Risk Assessment
Probability
Impact
LOSS OF GOVERNANCE COMPLIANCE
CHALLENGESRISK FROM
CHANGES OF JURISDICTION
ISOLATION FAILURE
CLOUD PROVIDER MALICIOUS INSIDER -
ABUSE OF HIGH PRIVILEGE ROLES
MANAGEMENT INTERFACE COMPROMISE (MANIPULATION,
AVAILABILITY OF INFRASTRUCTURE)
INSECURE OR INEFFECTIVE
DELETION OF DATA
NETWORK MANAGEMENT
http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-risk-assessment/
![Page 19: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/19.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 19
Cloud Security: What’s Missing?
Standards & Regulations
![Page 20: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/20.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 20
Presentation’s Agenda
General Trends
Cloud Security
Data-Centric Security
Mobile Security
Regulations: PCI
![Page 21: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/21.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 21
Data-Centric Security
![Page 22: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/22.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 22
Incidents by Vector (2009)
http://datalossdb.org/statistics
DL
PI
RM
![Page 23: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/23.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 23
The Relative Seriousness of IT Security Threats
Source: Computer Economics
![Page 24: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/24.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 24
DLP Scenario in Israel
No Data Classification
Poor Security Policy
Project is a failure
![Page 25: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/25.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 25
What Should be Done in Order to Succeed?
Look for your assets!Classify and label!Discover and protect confidential data wherever it is stored or used
Monitor all data usageAutomate policy enforcementSafeguard employee privacy
![Page 26: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/26.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 26
Presentation’s Agenda
General Trends
Cloud Security
Data-Centric Security
Mobile Security
Regulations: PCI
![Page 27: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/27.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 27
Y 2010 - Going Mobile!
![Page 28: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/28.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 28
![Page 29: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/29.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 29
Real Mobility is Coming to the Enterprise
![Page 30: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/30.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 30
Mobile Security: What worries CISOs?
Internal users: No central management How to protect corporate data on device? Device’s welfare ???
External users: Sensitive traffic interception Masquerading\ Identity theft
![Page 31: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/31.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 31
Mobile Security: What Do CISOs want?
1. Manage SMDs as if they were another
endpoint
2. Protecting business information on your
device
3. Multi-platform support
![Page 32: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/32.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 32
Presentation’s Agenda
General Trends
Cloud Security
Data-Centric Security
Mobile Security
Regulations: PCI
![Page 33: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/33.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 33
NetworkNetworkDSL Router
POS
Serv
er
POS
Term
inal
s
Requirement 1Requirement 2Requirement 3Requirement 4Requirement 5Requirement 6Requirement 7
Polic
ies
Requirement 8Requirement 9Requirement 10Requirement 11
3rd Party Scan Vendor
Requirement 12
PIN
Pad
s
PCI-DSS -Challenges
![Page 34: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/34.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 34
What is the Incentive?
Source: http://datalossdb.org/statistics?timeframe=all_time (2000-2010)
• Data loss incidents2,754
• Credit-card related data loss396 (35%)
• How?Hack (48%)
• CCN compromised297,704,392• …CCNs\Incident 751,779• Actual $$$ loss…?
![Page 35: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/35.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 35
Israeli PCI: Market Status (May 2010)
PCI “Newborns”
Gap Analysis
PCI work plan (Prioritized Approach?)
1-4 Milestones4+ Milestones
Financial Sector
Telco\Services Sector
Retail\Whole sale\Manu’ Sector
Healthcare Sector
PCI Compliance
You are here
![Page 36: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/36.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 36
PCI Challenges: The “New trend Syndrome”
“Am I the first one to implement this solution?”
“Are there any other references? ”
![Page 37: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/37.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 37
PCI Challenges: Customer Experience
System heterogeneity –Sensitive data is scattered
around in all sorts of formats
Main-Frame and other legacy systems –how is it
possible to protect sensitive data without changing
the source code?
What happened to risk management??? (PCI vs. SOX)
![Page 38: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/38.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 38
PCI Challenges: Customer Experience 2
“My DB does not support PCI” –the “Upgrade vs. pay the fine” dilemma
“Index token is cheaper than other alternatives” –True or false?
Inadequate knowledge of the QSAs?
Who audit the auditors?
should be
answered by the
PCI Council
![Page 39: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/39.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 39
PCI Challenges -The PCI paradox
PCI compliance
1 security patch is missing
A data loss incident occurs…
An investigation
starts
Remember that security
patch?
![Page 40: כנס אבטחת מידע מוטו תקשורת V2](https://reader033.vdocuments.mx/reader033/viewer/2022061116/54651123af7959167a8b6b2c/html5/thumbnails/40.jpg)
Your Text hereYour Text here
Shahar Maor’s work Copyright 2010 @STKI Do not remove source or attribution from any graphic or portion of graphic 40
Thank You!
Visit my Blog: shaharmaor.blogspot.com