Subscribed 2015: Architecture, Security, Scalability
Download as PPTX, PDF3 likes2,212 views
In an era of stolen credit card information, polymorphic malware and website downtime, security and scalability are of the utmost importance. Come join Zuora's Technical Operations & Security team to hear about the measures we've taken to ensure your business can scale with us and your customer data is protected.
![[Webinar] - How to Future-proof Your ERP Applications with Intelligent Automa...](https://cdn.slidesharecdn.com/ss_thumbnails/webinar-howtofuture-proofyourerpapplicationswithintelligentautomation-jktech-210506143950-thumbnail.jpg?width=560&fit=bounds)
![[Webinar] – Social Distancing Radar: Smart AI Solution to Restart Your Business](https://cdn.slidesharecdn.com/ss_thumbnails/socialdistancingradarwebinar-201030084750-thumbnail.jpg?width=560&fit=bounds)
![[Webinar] - Intelligent Automation: Enabling Bots with Brain](https://cdn.slidesharecdn.com/ss_thumbnails/webinar-intelligentautomation-enablingbotswithbrain-200917141335-thumbnail.jpg?width=560&fit=bounds)
Ad
More Related Content
What's hot (19)
Similar to Subscribed 2015: Architecture, Security, Scalability (20)
Ad
More from Zuora, Inc. (20)
Ad
Recently uploaded (20)
Subscribed 2015: Architecture, Security, Scalability
- 1. Architecture, Security and Scalability in the Cloud Andrey Kolesnikov VP, TechOps Pritesh Parekh Chief Security Officer
- 2. Agenda Industry Trends Compliance Strategy Securing SaaS Product Security Look Inside the platform Scale and Resiliency Ops Approach
- 4. Industry Data Security Breaches Courtesy: www.informationisbeautiful.net
- 5. Courtesy: Symantec 2015 Internet Security Threat Report Industry Data Security Breaches 2014
- 6. Courtesy: Symantec 2015 Internet Security Threat Report Industry Data Security Breaches 2014
- 7. Courtesy: Symantec 2015 Internet Security Threat Report Industry Data Security Breaches 2014
- 9. Courtesy: Symantec 2015 Internet Security Threat Report Industry Data Security Breaches 2014 • Top 3 entry point used for hacking • Weak Authentication (Employee or Third Party Vendors) • Malware infected using Phishing • Application or Server Weakness • Top motives are CC data and PII with email address • Average Cost per data breach is $3.5 million or $145 per compromised record (does not include loss of reputation) • Hackers targeting CFOs to gain monetary advantage on market moving information
- 10. Industry Leading Compliance Strategy • Required for all service providers storing or processing credit cards • PCI DSS Level 1 since 2008 • 200+ Security Controls required • Supports Customer SOX compliance • SSAE 16 SOC 1 Type II since 2009 • SOC 2 Type II based on Trust Services Principles • HHS HIPAA audit program as a Business Associate • Compliance with Security, Privacy and Breach Notification requirements • Provides a method for U.S. companies to transfer personal data from the EU to US • Protection of consumer personal data
- 11. Enterprise-grade Data Security • TLS Encryption • Network Firewall and Web Application Firewall • Host Intrusion Detection Systems • Sensitive Data Encryption using FIPS certified Hardware Encryption • Multiple layers of authentication • Continuous Application Pen Testing • Daily Network Scans & Third Party Security testing • Centralized Logging and Real-time Alerting • Secure SSAE16 Compliant Data Centers Load Balancers Load Balancers Log ServersDB Servers Firewall IDS Firewall IDS Zuora UI Customer Apps APIs TLS Storage Encryption ApplianceApp Servers Enterprise-grade Data Security
- 12. Strong authentication features support enterprise ecosystem integration • Strong Security Policies • 2-factor Authentication • Single Sign-on support • IP-address filtering
- 13. Granular data access features supports SOX compliance requirements 65 distinct permissions for standard and admin user roles
- 14. Data Access Control WORLDWIDE NORTH AMERICA US CANADA EUROPE ITALY FRANCE
- 15. • Greater Control with the hierarchy based data access feature • Access can be granted on a need- to-know basis (department, geo- location, product etc.) Data Access Control
- 16. Ops
- 17. Private Cloud Commercial Software Quarterly Releases SQL VMs MTBF DIY Stack Trends Public Cloud OSS Continuous Delivery NoSQL Containers MTTR SaaS SaaS v1.0 SaaS v2.Current SLIDE HEADER
- 18. Across Zuora Platform Transactions a month Rows of data synchronized and exported Average Monthly Volume Snapshot: Average platform compute utilization 1.3B 22B 40%
- 19. 3 Team Pillars Customer, Technology, Business 50/50 Developer/Sy sEng Ratio 2 Public Cloud Regions 2 Operation Centers 900+ Nodes 2 Geo Distributed datacenters Look Inside
- 20. Tiers Ephemeral Persistent Infrastructure Fault Domains Vertical Horizontal Scale Horizontal Vertical Partition Approach to Infrastructure
- 21. Embed Ops into Dev Durability > Availability API > Scripts Metrics, Metrics, Metrics Ops Approach
- 22. GRIDGRIDSummary GRID • Compliance Certifications – PCI, SOC1, SOC2 and HIPPA • Data Security – Web Application Firewall, Host Based Intrusion Detection System and Continuous Security Testing • Product Security – 2FA, SSO, Data Access Controls and Strong Security Policies • Infrastructure – Public/Private Cloud, OSS • Architecture – Right size/approach for the problem • Operators – Mix of Developers and Systems Engineers
Editor's Notes
- #3: From a Security standpoint, I want to focus 3 key areas where we made significant investment in security First. Compliance We’ve accomplished several certifications and attestations to meet and exceed industry security requirements. We will walk thru the list of certifications. Next. Implemented several layers of Security as part of our cloud infrastructure stack Finally. Security Features We have built security features for our customers the ability to have strong authentication, authorization and access control
- #5: 2014 was a year of data breaches Healthcare providers like Anthem, PF Chang to retailers like Michaels, Home Depot, Neiman Marcus Industry lost billions of dollars as a result of data breaches
- #6: In 2014, Number of Data breaches increased by 23% and the identities stolen decreased by almost 200M. In 2014, less large data breaches. Most of these breaches are from attackers. What kind of information were exposed? – Names, SSN, Financial Information, Birth dates
- #7: Retail and Financial industry remain on the top for number of records stolen Healthcare and Retail are the top choice for the hacker for number of breaches Although Financial industry has less number of incident but they had large data breaches that made them on top for the number of records stolen
- #8: Why would someone sell email addresses?
- #10: Whats the most common password?
- #11: As a Service Provider storing and processing credit card information, Zuora is required to go through the Payment Card Industry Data Security Standard, that is PCI DSS. Zuora has been Certified with highest level – Level 1 since 2008. Recently completed our PCI certification last month with the latest version of PCI 3.0. Since Zuora is PCI compliant, as a customer of Zuora, your PCI obligations may tremendously be reduced in scope We also annually do SSAE16 (previously known as SAS70) attestation, we completed one in Nov and last year and we are targeting renewal this year around the same timeframe. When our customer goes thru financial audit (SOX audit), auditors need assurance on security/integrity of RBM systems. Zuora can provide that you with the SSAE16 certification Last 2 are privacy certifications US-EU is required to transfer personal data from the EU to US TRUSTe certification is to make sure we safely collect customer data and it further supports Safe Harbor certification Statement on Standards for Attestation Engagements Payment Card Industry Data Security Standard
- #12: At Zuora, we have a defense in depth approach to security. We have embedded security at every layer of the stack. What you see here is a high level simplified view of Zuora Infrastructure stack. Zuora customers can connect to Zuora application via the application/UI (zuora.com) or call SOAP/REST APIs from their application All connection is over SSL and the first layer of defense is our Firewall and Network Intrusion Detection Systems. If there is any malicious traffic or unusual behavior, it gets blocked at this layer. All traffic from there gets terminated at our load balancer and load balancer initiates the connection to the application server. Each application server runs a Host based IDS that detects and alerts any unusual or malicious traffic. If there is Pci data that the customer sends to us, we use a Hardware based Security appliance to encrypt the data Data gets encrypted on the device, the keys never leave the device All the activity in our production infrastructure is logged in a centralized logging system All systems and applications are scanned on a daily basis Our data center where we host the data are PCI compliant and have strong security in place
- #13: What we have covered so far is Compliance and Infrastructure Security. Now are talking about the Security Feature that we provide to our customer to have strong authentication. 1/3rd of the breaches happened last year were as a result of weak authentication Zuora has made significant investment to provide strong authentication features
- #14: 65 distinct permissions for standard and admin user roles Access can be granted on a need-to-know basis (department, geo-location, product etc.)
- #17: 1/3rd view
- #18: Full screen view
- #19: 1/3rd view
- #21: 1/3rd view
- #24: 1/3rd view