Big data security the perfect storm
-
Upload
ulf-mattsson -
Category
Technology
-
view
691 -
download
1
description
Transcript of Big data security the perfect storm
Big Data Security - The Perfect Storm
The Perfect Storm 1991It was the storm of the century, boasting waves over one hundred feet high a tempest created by so rare a combination of factors that meteorologists deemed it "the perfect storm."
When it struck in October 1991, there was virtually no warning.
*: http://books.wwnorton.com/books/detail.aspx?ID=5102
2
The Perfect Storm
3
SecurityAnalysis
CustomerSupport
CustomerProfiles
Sales &Marketing
SocialMedia
BusinessImprovement
Big Data
Regulations& Breaches Increased
profits
Increased profits
Increased profits
Increased profits
Increased profits
Increased profits
Perfect storm
4
More DataWeakerSecurity
IncreasedRegulations
Breach orAudit Fail
($$$)
The Perfect Storm
Big Data is a Time Bomb based on how things are coming together
Big Data deployment is growing fast, rushing into it
• ROI in focus
• Security is not part of Strategy
Shortage in Big Data skills• People don’t know what they are doing
Big Data Security solutions are not effective
General shortage in Security skills
5
Mankind Created Data
Source: IBM
0
5000
10000
15000
20000
25000
30000
35000
40000
2005 2010 2015 2020 Year
Data(exabyte)
6
What is Big Data?
7
What is Big Data?
Source: IBM 0307_Guardium_Final-.pdf
8
What Happens in an Internet Minute?
9
Source: Intel
Four Dimensions of Big Data
Source: IBM 0307_Guardium_Final-.pdf
10
Big Data Sources
Source: IBM
11
Business-driven Outcomes
Source: IBM
12
How is Big Data Different?
13
How is Big Data Different?
Why It’s Different Architecturally: • Shared’ data
• Inter-node communication
• No separate archive – all data is online
• No Security – breaches go undetected
Why It’s Different Operationally: • Insider data access
• Authentication of applications and nodes
• Audit and logging
Source: Securosis SecuringBigData_FINAL.pdf
14
What is The Problem Big Data Security?
15
Big Data and The Insider Threat
16
17
Many Ways to Hack Big Data
Source: http://nosql.mypopescu.com/post/1473423255/apache-hadoop-and-hbase
18
HDFS(Hadoop Distributed File System)
MapReduce (Job Scheduling/Execution System)
Hbase (Column DB)
Pig (Data Flow) Hive (SQL) Sqoop
ETL Tools BI Reporting RDBMS
Avr
o (S
eria
lizat
ion)
Zoo
keep
er
(Coo
rdin
atio
n)
Hackers
PrivilegedUsers
UnvettedApplications
OrAd Hoc
Processes
The Big Data platform may not
be secure,but your
Informationcan be secure.19
A Changing Threat
Landscape
20
21
New York Times about China Attack on US
*: http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
22
One Single Sample: The Chinese APT1 group Compromised 141 companies in 20 industries
Stole hundreds of terabytes of data
Technology blueprints, Proprietary manufacturing processes,
Test results, Business plans, Pricing documents, Partnership agreements, Emails
23
Source: http://www.verizonbusiness.com/Products/security/dbir/, http://en.wikipedia.org/wiki/Timeline_of_events_involving_Anonymous
Dominating “hacktivism”
Attacks by Anonymous include• 2012: CIA and Interpol • 2011: Sony, Stratfor and HBGary Federal
24
http://public.dhe.ibm.com/common/ssi/ecm/en/wgl03027usen/WGL03027USEN.PDF
25
DataLossBD - Incidents Over Time - Increasing
http://public.dhe.ibm.com/common/ssi/ecm/en/wgl03027usen/WGL03027USEN.PDF
26 http://public.dhe.ibm.com/common/ssi/ecm/en/wgl03027usen/WGL03027USEN.PDF
Breakout of Security Incidents by Country
27
*: % of Escalated Alerts
http://public.dhe.ibm.com/common/ssi/ecm/en/wgl03027usen/WGL03027USEN.PDF
Ranking Volume and Type of Security Incidents*
28
*: % of Escalated Alerts
http://public.dhe.ibm.com/common/ssi/ecm/en/wgl03027usen/WGL03027USEN.PDF
Security Incidents - Malicious Code*
What is the Cost of A Breach?
29
Cost of Data Breach per RecordIndependently Conducted by Ponemon Institute LLC March 2012
30
http://www.symantec.com/content/en/us/about/media/pdfs/b-ponemon-2011-cost-of-data-breach-global.en-us.pdf
31
How are Breaches Discovered?
Unusual system behavior or performance
Log analysis and/or review process
Financial audit and reconciliation process
Internal fraud detection mechanism
Other(s)
Witnessed and/or reported by employee
Unknown
Brag or blackmail by perpetrator
Reported by customer/partner affected
Third-party fraud detection (e.g., CPP)
Notified by law enforcement
0 10 20 30 40 50 60 70
By percent of breaches . Source: 2012, http://www.verizonbusiness.com/Products/security/dbir/
%
What is the Trend in
Regulations?
32
Regulations: Be Proactive in Protecting Data
33
HIPAA Omnibus - Penalties if PHI isn’t encrypted
34
http://www.diagnosticimaging.com/physicians-experts-make-case-secure-data-exchange-himss13
Regulations: Be Proactive in Protecting Data
Big Data must prepare for the changing landscape
• Trend: Encryption requirements are increasing
PCI DSS, US State Laws
Health Data Regulations • Need for Data Segmentation (tokenization,
encryption or masking)
• Extra Sensitive Data (drug abuse, HIV codes, sex abuse and more)
Ponemon Institute “Big Data Analytics in Cyber Defense”
• 61 percent will solve pressing security issues
• Only 35 percent currently have security solutions
35
Balancing security and data insight
Tug of war between security and data insight
Big Data is designed for access, not security
Privacy regulations require de-identification which creates problems with privileged users in an access control security model
Only way to truly protect data is to provide data-level protection
Traditional means of security don’t offer granular protection that allows for seamless data use
36
The Solution is
Finally Here37
38
The Solution - Preventing Misuse of Data
Hackers
PrivilegedUsers
UnvettedApplications
Ad Hoc
Processes
Application
DataProtection
Policy
User
Data Misuse Prevention
Attackers
Administrators
Issued Patents
Selective Data Protection
39
Support Business Applications
2 %
8%
90%
PAN
6 digits clear
4 digits clear
6 digits encoded
98 %Applicationtransparent
2 % Applicationchanges
AccessRight Level
Risk
TraditionalAccessControl
IMore
ILess
High
Low
How can we handle the Risk with Big Data?
40
Data Tokens
CreativityHappens
At the edge
Small Data Big Data
41
Securing the Data Flow
HDFS(Hadoop Distributed File System)
MapReduce (Job Scheduling/Execution System)
Hbase (Column DB)
Pig (Data Flow) Hive (SQL) Sqoop
ETL Tools BI Reporting RDBMS
Legacy Systems Big Data Legacy Systems
42
Support Data Classification and Analytics
Secured Data Fields (encoded)
Encrypted FileData in Clear
Application
43
Big Data
The Process of Automating Security for Big Data
Discover sensitive data
ImplementSolution
Control usage of sensitive
data
Understand
Secure
Monitor
Lock down sensitive data
Integrate
SUMMARY
44
Big Data Security Problem - Summary
Traditional security solutions cannot bridge the gaps between
1. Data breach protection and compliance
2. Provide powerful analysis and data insight
3. Utilize the power of a big data environment.
45
Proactive Data Protection for Big Data
Know your data flow• Protect the data flow - including legacy systems
Protecting your data now could save big time and $ in retroactive security later
• Breaches and audits are on the rise – Organizations that fail to act now risk losing their hard earned investments.
Granular data protection is cost effective • Addressing regulations and data breaches• Data available for analytics and other usage
• Provide separation of duties for administrative functions
Catch abnormal access to data• Including (compromised) insider accounts
46