TITUS @ Security Summit Verona 2011 - Classificazione & User Driven Security

Security & Classification Solutions

Gary McConnell

WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

My friend Tim…


Historically

Focused on protecting the payload in the event of an incident (crash)

Seatbelts, Strong Steel, Crumple zones

New Focus

is on preventing the incidents in the first place

Focus on the Driver (user)

The Volvo Shift

*You should still wear your seat belt


Tim’s Vacation

European Road Trip

7 Countries

SE, DK,DE,CZ,AT,IT, CH

4,300km

No speeding tickets

1 wrong turn*


User Warning System

Warns user when violating policy

Following too close can be dangerousBenefit: Education and Awareness - “Safe Driving Distance”


Risk Management Controls

User can tune policy based on their risk tolerance


Adaptive Cruise Control

Uses Sensors to Detect Threats (other cars)Applies policies based on the situationPolicies: Acceleration, Braking


Lane Departure Warning

Other Services

Collision Avoidance

Won’t make coffee, but will tell you when it is time for one


Technology Helps, Not perfect

Still a role for the driverSomebody (or some dog) could get hurt


Observations

Works great in some environmentsAutobahn in Germany


Less Effective in Other Locales!

• Too many Warnings

• Distracted

• Reduced Productivity

• Sometimes you have to disable the system


Technology can help

Educate

Create situational awareness

User/Driver still needs to be part of the equation for best results

Need to find the right balance

Some Observations


Is technology enough?

WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED |

Which leads me to …


User Awareness and Responsibility

Raise User AwarenessApply Visual MarkingsForce User to Classify and react to policy violationsHelp themRecord Actions

“If you don’t know what data you have you can’t protect it”


BLIS – BLindspot Information System


#1 data loss risk is inadvertent mistakes


Scenario - Inadvertently sending email containing PII

Karen works at an Insurance company. She accidentally forwards a customers Social Insurance Number to an external recipient.

WWW.TITUS.COM | © TITUS. ALL RIGHTS RESERVED | 25

© Bridgestone

Scenario – Send to wrong person


Reduce Inadvertent Disclosure


Classification Selector in Word

Compose document and save

Classification pop-up with guided

classification


Classification in Microsoft Office®


One Click Classification


Collision Avoidance

• Brakes Applied automatically when collision imminent


Emailing Confidential Intellectual Property Externally

Jeff in research and development decides to share the latest car prototype with a friend.


TITUS con McAfee DLP

3. Send/Save/Print2. Classificazione4. HBSS/DLPAgent

6. Applica le regole DLP per all’end point (Blocco Storage Rimovibili)

McAfee DLPUser con TITUS

5. Policy Decision

Allow

Prevent

Quarantine

Return

Protect

1. Composizione


TITUS Overview


Protecting Over 1.5 Million Users

Government

• US Dept of Energy• US Dept of Veterans Affairs• US Department of Commerce• NASA• 33 Australian Federal Depts.• Bank of Canada• Government of Scotland• Serious Organized Crime Agency• 15+ UK Police Forces• BAE Systems• Defence Science and Tech.• Fujitsu• UK Nuclear Decommissioning

Office• U.S. Department of

Transportation• U.S. Department of State

Military

• Canada DnD• NATO • Danish Defense• U.S. Air Force• MNF-Iraq• Australian Department of Defence • U.S Army Accessions Command• U.S. CENTCOM, SOUTHCOM,

STRATCOM• U.S. Forces Japan• U.S. Navy• Albanian Armed Forces• Lithuanian MoD• Belgian MoD• USMC Combat Operations• U.S. Army Central Command

Commercial

• UniCredit Bank• G4S Bulgaria• Paternoster• Dow Corning• Bechtel• BAE• DRS Technologies• AT&T• Beers + Cutler• Turkcell• Fujitsu Services• Hitatchi• International Monetary Fund (IMF)• Honeywell• Northrop Grumman• Mazda• Pharma Suisse


Thank You!

...1 Wrong Turn.. ?

TITUS @ Security Summit Verona 2011 - Classificazione & User Driven Security

Business

Transcript of TITUS @ Security Summit Verona 2011 - Classificazione & User Driven Security