Lista de desejos de um Chief Security Officer

Notas do Editor

• #3: Before we get into today’s discussion. I want to share a little bit about myself. I’m currently the VP of Security/CISO for Sumo Logic, a cloud-native data analytics provider based in the Silicon Valley. Here I’m responsible for the protecting the data of our customers and employees. I have more than 17 year of experience establishing policy management around security metrics and incident response initiatives. I hold a patent for the creation of SecureWorks’ Anomaly Detection Engine (now part of Dell)
• #5: Also, mention the IDC whitepaper: “Assessing the Risk: Yes, the Cloud can be More Secure than your On-Premises Environment” --Pete Lindstrom, June 2015
• #11: Also, mention the IDC whitepaper: “Assessing the Risk: Yes, the Cloud can be More Secure than your On-Premises Environment” --Pete Lindstrom, June 2015
• #12: As many of you know, there is still an innate fear of using the cloud for security purposes. Many security practioners and organizations are struggling to understand how to control security in a cloud-based world, but consider the following stats: According to the State of the Cloud Cloud Survey 2015 by Right Scale, while cloud adoption is growing quickly, most enterprises (68 percent) run less than 20 percent of their workloads in the cloud. However, they report plenty of headroom to move additional applications to the cloud. A majority (55 percent) of respondents report that at least another 20 percent of applications are built on cloud-friendly architectures and are ready for cloud. http://www.rightscale.com/blog/cloud-industry-insights/cloud-computing-trends-2015-state-cloud-survey According to a report by Cisco, by 2018, 59% of the total cloud workloads will be Software-as-a-Service (SaaS) workloads, up from 41% in 2013.  Cisco is predicting that by 2018, 28% of the total cloud workloads will be Infrastructure-as-a-Service (IaaS) workloads down from 44% in 2013. 13% of the total cloud workloads will be Platform-as-a-Service (PaaS) workloads in 2018, down from 15% in 2013.  The following graphic provides a comparative analysis of IaaS, PaaS and SaaS forecasts from 2013 to 2018. Source:  Cisco Global Cloud Index: Forecast and Methodology, 2013–2018 According to IDC, the five-year forecast period, IDC expects that cloud IT infrastructure spending will grow at a compound annual growth rate (CAGR) of 15.6% and will reach $54.6 billion by 2019 accounting for 46.5% of the total spending on IT infrastructure.   http://www.idc.com/getdoc.jsp?containerId=prUS25732415
• #13: Operationally, security organizations need to change their thinking and processes from traditional data center-centric (what I’m now calling “flat Earth”) models to new, more statistical models. For example, we exchange hands-on control over physical hardware with odds over a population of hardware. From a systems administration perspective, we exchange scripts and manual capacity planning and scaling with API calls, triggers, feedback loops, and the automatic provisioning and de-provisioning of spot-bid compute resources. And, of course, from a security perspective, we face the challenge of a world that is not under our complete physical control.
• #14:  176/5000 MIT Sloan School há 20 anos disse que a vantagem competitiva sustentável é a meta de negócios / Graal.Agora isso não é mais acessível e o novo pote de ouro é o Inovação Contínua Ciclo de empresas na na top 500 do mercado, anteriormente ciclo maior hoje o ciclo é menor. A inovação continua força a renovação. Anteriormente, empresas se mantinham na forbes 500 por vantagem competitiva e não por inovação.
• #15: Adam: What have been your top security architecture & technology challenges in a large scale data center deployment? Jim: TOP CONCERN: Lots of different groups with lots of different tools, NOTHING SPEAKING THE SAME LANGUAGE From experience in many data centers, many corporations No matter what – enforcement is a challenge co-location challenges of hardware Cages and closed circuit cameras. Lots of people managing hardware, specialized appliances Previous companies: pull connectivity to find owners Innovator’s dilemma: Automate (APIs) vs. investment justification Adam: Wow – lots of different groups, all with their own technology choices and APIs, lots of different hardware and software tools, including security tools, and a ton of complexity to get all of this speaking the same language. Seems to be a difficult barrier to overcome.
• #16: Adam: Here you are, protecting your data center with lots of groups, lot of security tools, nothing speaking the same language Decision at Infor is to become a CLOUD-FIRST COMPANY Unknowns, unchartered territory, As the CISO of Infor, ready to embark on this journey, what were your top of mind security architecture and technology concerns with not only “security in the cloud”, but “large-scale security” in the cloud? I mean, you’re already dealing with an environment that doesn’t speak the same language, now this! How did you go about getting all of this figured out? Jim: “Trust, but Verify” TOP 3 CONCERNS: (1) security controls (2) security tools, and (3) Compliance Security controls: ISO 27001/27002, or NIST800-53 More than software: process, procedures, people e.g. background checks Tools: Trusting the tools, technology and hardware of a cloud provider like AWS finding appropriate tools to help securely manage the virtual environment Needed the ability focus on the security of the environment rather than the AWS infrastructure. Compliance: Numerous regulatory and contractual compliance requirements Had to be sure our vendor of choice could meet those requirements. I didn’t want my compliance team to be caught up in auditing our provider. Adam: Jim, I get it how those would be any CISO’s top concerns: Security control parity, tools .. Some which were hardware, and of course, compliance. Clearly, these are fair concerns and I’m sure many of our audience would share these concerns!
• #21: AWS certifications are good news for customers, providing additional transparency and independent assurance that we follow internationally-recognized cloud security practices. However, certifying that we follow yet another best practice won’t come as a surprise; we’ve already proven information security is job #1 here at AWS. We have made massive investments in protecting customer data at the highest security levels; an investment that you, our customers, inherit when using our services. Global customers from a wide range of regulated industries (including healthcare, life sciences, federal and state governments, financial services, and public safety) continue to accelerate their use of AWS for the most critical and regulated workloads. While an announcement of a new AWS certification is a win for customers, our innovation is not limited only to building and operating our own advanced security and compliance capabilities. We are focused on taking this to another level by scaling the investment, innovation, automation and those same best practices to you, our customers, through our cloud services. Innovative new cloud security features such as AWS Inspector, AWS WAF (Web Application Firewall), and AWS Config Rules can give you a significant boost in your ability to manage security and establish reliable and ubiquitous controls in your AWS environment. This gains you a material lift in managing security risk, enabling you, whatever your requirements may be, to obtain your own certifications and manage compliance in a comprehensive and transparent manner. This makes the AWS environment more secure than any other environment, making it the best place for sensitive, controlled, and regulated workloads. We routinely attain certificates, demonstrating we have a world-class security program, but more importantly we want you to have a world-class security program as well.
• #23: Compliance should be a standing topic of conversation It needs to be a topic of conversation, and let’s make sure it’s a discussion on the table. Compliance organizations will need proper engagement, in advance Compliance teams need to be educated about the cloud. We need to resolve their concerns. We might need proper legal terms in our EA. They need to adapt their risk and compliance frameworks and do their due diligence on the move to the cloud and the reliance on AWS to operate those controls. They need to know how to handle regulators. This is all very doable, but it generally takes time. The more heavily regulated, the more time it takes. We can and will pave the way to move the most sensitive workload to AWS – we need to engage the right people early on We’d like to engage the people responsible for these activities now, so we can get that ball rolling. We need to engage our SAs and Proserve to help you figure this out.
• #25: Leave no trace Host FW IDS, FIM, WAF/DLP Encrypt it all Continuous Compliance Everyone's security is bad because they can't get their fundamentals right. ANTHEM: The Math of Fundamentals. A security philosophy that took me over ten years to evolve, and yet it’s all totally basic- common sense- simplicity itself: Default deny absolutely everything. Know exactly every service you need to run, what ports it needs, what it’s vulnerabilities are, what patch level it’s at and what OS privileges it needs. Then tie each of those services to a user. Every Port locked down to that user, and each users permissions locked down to the bare minimums. Then firewall every single box to only talk to it’s essential peers on the allowed ports. Everything white-listed and default deny. Anything out of spec is dropped and alerted. File integrity monitoring everywhere on all binaries and config files. Every connection is encrypted. All encryption keys are rotated every 24 hours. Good philosophy, right? Nothing but fundamentals. Totally basic. Does anyone do that? Nobody I can think of, because any ops person will tell you it is totally unrealistic. Too many servers with too many services talking to too many other servers also running too many services, and only so many guys with unix beards and clipboards who could run around and run the 30 bash scripts you needed to run in order to do the basic hardening. So all of our fundamentals suck.
• #26: In the same way that you segment your own environments today, you can segment your virtual networks within your AWS environment. You can define which networks get Internet access and which don’t, You can define access control lists to restrict what traffic goes where. You can define user groups and define who gets access to what. The big difference in AWS is the amount of time and money it takes to do this. You don’t have to buy and manage a whole lot of hardware to get this done. You just need to define the policies of what traffic needs to go where, and what shouldn’t
• #27: With AWS Identity and Access Management tools you get to define which of your users get to do what – in the same was as you define role-based access controls within your environment today. You can use hardware token based or software/mobile based multifactor authentication to add an extra level of assurance for your more sensitive applications, This can all integrate with your on premises environment by integrating with your existing corporate directory, and implementing federation and single sign on so that this becomes a seamless experience for your customers.
• #29: Config Rules launched on Dec 18, so we’re still gathering use cases that we can reference externally. Here are some stories I’ve been working on with customers   Security: T-mobile security has codified several of their recommendations for configuring AWS resources as Config Rules using Lambda functions. They are using these rules to ensure their developers are following best practices, such as using the appropriate AMIs with instances, IAM policies with expected permissions. They no longer need to maintain infrastructure to execute these rules or store the results of compliance. All of this is managed by AWS Config Rules and available via APIs and the security team gets notified when a rule or resource becomes non-complaint. They can decide to cut a ticket or take appropriate actions.   Compliance in Healthcare: We have noticed quite a bit of interest from the healthcare/pharma vertical. J&J, BMS, Merck have used AWS Config to record a history of all their configurations for compliance assessment. They are required to have access to this configuration data for 7+ years for GxP compliance. Some customers are looking at using rules too. For example, a customer subject to HIPAA has written a rule that ensures all instances are using dedicated tenancy.   Ease of use: Nasdaq is a Config Rules customer using rules to ensure resources are tagged consistently. They are in early stages of rolling this out across their accounts into production. They find Config Rules to be an effective and easy mechanism to ensure tags are consistent. It’s important to note that they are using managed rules. This implies AWS owns and maintains the code to ensure these rules are working correctly. Nasdaq simply configured them correctly the first time. This “hands off” use case is appealing to several customers who no longer want to invest in maintaining home-grown solutions to monitor configuration changes for compliance.   We have two external facing case studies on core-config (i.e. not rules) . The customers that have official case studies are Burt  and British Gas. We are working on Config Rules, but external reference for rules will almost certainly not be available in time for SKO.
• #30: EMEA/france: http://aws.amazon.com/fr/solutions/case-studies/veolia-water/ (french language) EMEA/Aire: http://aws.amazon.com/solutions/case-studies/aire/ EMEA/Nordics: https://aws.amazon.com/solutions/case-studies/supercell/ Supercell - To monitor, manage, and control its environment, Supercell uses a range of tools in the AWS Console. Amazon CloudWatch and AWS CloudTrail allow it to monitor the current environment and give it a detailed log of all actions in the development and production environments. “The AWS API is one of the most important services for us—we use it a lot,” Yliharju says. “For example, the API commands allow us to easily manage and boot up new servers and even run full load-testing environments to simulate different situations and determine our capacity needs.” Aire - “We quickly saw that building a redundant infrastructure with AWS tools would be easy," says Kimball. "On the security side, it was trickier. Our financial-services clients all have different but very high security expectations, so from the start we looked to AWS to help us find the right security levels. Plus, we needed a platform that we could use to anticipate customer requirements, not just now, but into the future, too.”From a security perspective, AWS Identity and Access Management (IAM) allows the startup to create, track, and manage users within AWS. AWS CloudTrail records API calls, while monitoring service Amazon CloudWatch helps Aire to monitor log files and set alerts. AWS Key Management Service (KMS) controls encryption keys and also integrates with Amazon RDS and CloudTrail, providing logs that enable the firm to meet its compliance needs.
• #33: CONNECTWISE - “With AWS WAF we have been able to completely hand these [traffic]concerns to Amazon.  When we detect anomalies in our traffic we can protect our quality of service by blocking this traffic at the edge nodes across the world.  This traffic no longer touches our infrastructure at all and is handled by CloudFront near the point that the traffic is generated.”– Robert Isaacs (Co-founder), Chief Software Architect, ConnectWise GLIDE - “Protecting our open sites and even API's is of course great in protecting and blocking attacks, however what it does more is a dramatically improvement to the reliability of our monitoring and alert systems. The attacks and hacking efforts are creating noise in our system that often leads to false positives. Integrating WAF allows us to focus on the real issues.– Roi Ginat (Co-founder), Glide Talk TREND MICRO - “[AWS WAF] is a fantastic new service that you should be looking to add to your deployment asap.” – Mark Nunnikhoven (Vice President, Cloud Research), Trend Micro Trend Micro: Deep Security IP Lists to AWS WAF IP Lists: https://github.com/deep-security/aws-waf Webinar: Defending Your Workloads with AWS WAF and Deep Security
• #34: [TODO] – analysis of why this is true – compare and contrast [TODO] Address the objection to this vision which is “I can’t rewrite all my apps.”
• #35: Adam: Excellent training Matt, thank you. OK, now’s let move to true business impact How Infor’s leaders, the officers of the company, have improved visibility In terms of security, procurement, cost, alignment, and compliance Let’s have a look at how visibility of the business has changed for for the CISO, CIO, COO, and finally the CFO since moving to the cloud…
• #36: Adam (CISO QUESTION): Jim, let’s start with you, as the CISO, What’s the top visibility improvement for you. Jim (CISO ANSWER): Our security visibility is night and day now Now in the inner circle. For example, Trend Micro – new systems, policy exceptions Old days – IN THE WAY, New way: teams move faster to the cloud, SETTING DIRECTION Before we found out through back channels, now we get called in way in advance to help out. Inner circle: AWS aware tools enable collaboration with all cloud teams Adam (CIO QUESTION): Wow – it seems you are now critically involved in setting the direction, where before, you may have felt as more like a passenger. How about the CIO, what do you believe is the CIO’s biggest benefit? Jim (CIO ANSWER): Network segmentation & Appling unique security control requirements to each environment (ITAR vs. demo system) Elimination of Rogue IT Servers underneath desks, now instances jump out at you Auto protection when auto-scaling with our security stack (Trend Micro’s Deep Security) Use AWS as another tool Demo networks and other extreme special security Adam (COO Question): That’s a great news story for any CIO out there. How about the COO, what’s improvements have occurred in the compliance and governance arena? Jim: (COO Answer): Improved rhythm and efficiency of compliance activities Reliance upon the maturity of the AWS compliance activities Single pane of glass Supporting audits It keeps the auditors out of our network, reducing scope AUDITORS APPRECIATE THIS Adam (CFO Question): It sounds like some outstanding benefits to both your COO and to the auditors. And I can appreciate how that helps with scale as well. Finally, how about the CFO in terms of cost management, routing to various cost centers, to help measure and manage the business health of each group? Can you also speak to the security costs as well? Jim (CFO Answer): Rogue IT to fiscally responsible culture Amazing cultural transformation You can see cost easily and directly by using AWS accounts and running reports AWS APIs allows you to automate shutting down inactive instances Cost savings in terms of reduction of tools Don’t require multiple agreements with multiple vendors Adam: That’s amazing that there’s a cultural shift from procuring off the books to be agile, to now having teams be fiscally more responsible and turning down their workloads when they are now using them.
• #37: Adam summarizes the takeaway: Theme in Infor’s journey: Simplicity enables scalability: tool reduction, standard exchange of security data, segmentation, speaking the same language Visibility enables scalability: The “Single pane of glass” with Infor’s security stack enables them to continue to scale at a rapid rate. Large Enterprises can scale their security operations teams while moving up the value chain and increasing their visibility. Once, there, they are a key part of the Cloud Operations team. You have also seen the cookbook to get them on their way. The Cloud Security teams can be part of the inner circle and add tremendous value to the overall cloud operations CxOs have more visibility in terms security, IT operations, procurement, compliance, governance, costs, profitability giving them a competitive advantage over their peers who remain in the data center. Compliance and auditors work more effectively together, reducing time, and allowing your business to move faster.
• #38: Adam: Matt, we just heard from Jim about Infor’s journey in terms of operations teams, skills, and training? What are some of the new roles and skills that AWS recommends for customers looking to deploy at large scale should follow? Matt: Answers the question. Adam: Thanks Matt. Now what are some of AWS’s recommended certifications, training to best position a serious security team ready for the cloud? Matt: Answers the question, shows info to get more info