Secure Data Workflow

Editor's Notes

• #2: Hello Everybody, my name is Benny Czarny and I am the CEO of OPSWAT, manufacturer of Metascan, Metadefender, OESIS and GEARS. Thank you ITpro EXPO 2014 team for the opportunity to sponsor the event together with NextIT and Toshio sun put into making this presentation happen   Today, I am going to talk about challenges we have to protecting data flow to an from organizations , ways and concepts to solve this challenges To elaborate what I am talking about I put togather a diagram
• #3: To help identify the challenges In this diagram you see common data workflow So lets go left to right and start with the data – we have challenge to detect what is good and what is or bad data Then we go to the data entry points , first there are many and they need to be configure , set them up And finally we need to connect the users to the data we confront challenges linking related to creating different data security policies to different users types So what we’ll go over is
• #4: So What I will cover in this presentation are: The data security challenge – what are the challenges to determining if the file or data is good or bad to my organization and inspire how to create a good security policy The data sources configuration – what are challenge, to configure multiple data sources t The user permission challenge, - what are tha challenges to connect data to users with their rolls and inspire how to create a good security policy Then I’ll talk about how to create an effective secure data workflows policy an to address any question you may have so lets start with the data security challenge
• #5: When we try to create a data security policy - one way we can look in to this is creating a policy for known threat and a policy of unknown threat Known threats are threats that are known to the industry – there are many , millions and are still a very difficult to detect effectively and here we can differentiate between known threats to a specific security solution known threats and shared among security vendors e.g “in the wild “ Unknown threats – these could be extremely difficult as threats they are unknown because they are either Still hidden and spread out e.g 0 day attack specifically targeted to your organization so you can trust only your security solutions to detect it and should not
• #6: Another thing we need to consider creating a data security policy is the type of data as different data types bring different threats Different file types introduce different risks for example Documents may contain embedded objects or macro scripts Executables are one of the most risker file formants we may want to detect and may be completely prevent image files introduce buffer overflow and other risks And archives has their own issues such as archive bombs and other risks related to archive
• #7: When we need to go a head and enforce the Data security and the user security policy we will most likely face another challenge Which is how to effectively enforce this across many systems Files can be attached to e-mail Employees can download files from the Internet Files can be uploaded through a Managed File Transfer server or other file upload systems Files can also be brought in on guest devices or on physical media that employees or guests are bringing into a facility
• #8: How can we effectively configure different policies in multiple sources to have the same data security policy for a give users weather it is an exchange , proxy , and usb security What you see here are multiple management consoles w e need to configure in order to effectively track and manage security policies To do it right how many security certification we’ll need our staff to pass
• #9: Some of the difficulties in correctly configuring all of these sources are that there are many steps in setting up the correct policies, which means there are many potential points of failure. Some of these steps are Initial setup of the system Ongoing maintenance of the system, including adding and remove users, moving users between teams Changing configuration to match changes in the organization’s security policy Regular audits of the system to review exceptions and ensure compliance
• #10: Creating a user permission policy is another big challenge as it differ between organization and here we need to ask our self What is the function of the user and what is the best security policy we can get to these users without compromising their productivity Should the front desk or accounting have access to executables ? Should the whole IT team have access to executables or security patches ? How can we balance between security and productivity how can we still enable productivity while we are managing security ?
• #11: So lets talk about effective ways to create a secure data workflow
• #12: One way to To address the risk of known threats, the best approach is to scan files with as many different security engines as possible. This is a simple diagram that shows how using multiple anti-malware engines increases the overall detection rate, even when there is a large overlap between the engines.
• #13: In this test we tested 75 outbreaks against 6 different antimalware application and the detection ended up decent
• #14: Another way to prevent unknow threats is Data Sanitization where
• #15: The most comprehensive approach is to combine multiple protection methods into a single data security policy, which greatly reduces the likelihood that any threat will make it past all of the different protection methods. Some of the different layers that can be used are the following Blacklist known threats and whitelist known trusted files Filter files based on their type to eliminate any file types that are too risky to allow into the organization Use data sanitization to remove embedded objects from files that are otherwise not detected by antivirus engines Validate all digital signatures, and optionally digitally sign files so that they can be verified as clean when they are checked later Use static analysis to examine files, including scanning with multiple antivirus engines Periodically rescan files that were previously identified as clean, so that any threats that are identified after initially scanned can be remediated Use dynamic analysis tools, such as sandboxes, that use different methods to identify threats
• #16: To address the user permission challenge, it is best to create multiple user groups and then assign the appropriate security policy to each group. For example: Anyone in the IT group is allowed to bring in executables, however those executables are required to be scanned by 20 different anti-malware engines Anyone in Accounting, on the other hand, would not be allowed to bring in executables, and any documents they bring in must be sanitized and scanned by 20 different anti-malware engines
• #17: The data source configuration challenge is best addressed by managing data security policies from a central location. By making sure that all data entering an organization, whether through e-mail, a web proxy, or by physical media, is handled by the appropriate security policy, the number of potential points of failure is greatly reduced. All management and definition of the security policies can then be handled from a single location, so there is less chance that inconsistencies introduce vulnerabilities. This is never perfect htough
• #18: To come back to the diagram we covered earlier in the presentation, having a centralized solution like Metadefender, where multi-layer security policies can be centrally defined and managed, helps organizations to protect themselves against potential threats, regardless of the source of the file and who is both bringing the file into and using the file within the organization. This is the vision of OPSWAT – today we cover elements of this secure data workflow what covers kiosk , proxy and email either via metascan metadefender or via a technology partner We are the leader in the space and have Next IT that represent us in Japan for deployment opportunities
• #19: Thank you for your time. If you would like to find out more about designing secure data workflows and how OPSWAT can help you protect your organization from threats you can visit our website, at www.opswat.com.