Preventing Good People From Doing Bad Things Best Practices for Cloud Security Brian Anderson Chief Marketing Officer & Author of “Preventing Good People From Doing Bad Things” Vision Securing the Perimeter Within Consistent policy-driven, role-based access control, fine grained privilege delegation, logging, monitoring and reporting • For infrastructure, end points, data and applications • Across physical, virtual, public, private and hybrid cloud environments • Empower IT governance to strengthen security, improve productivity, drive compliance and reduce expense Public, Private and Hybrid Cloud Computing Security Server & Desktop Physical & Virtualization Windows, Linux, Unix Network Device Security Data Security & Leak Prevention Governance, Risk & Compliance 1 The Problem is Broad and Deep • The threat from attacks is a statistical certainty and businesses of every type and size are vulnerable. • Organizations are experiencing multiple breaches: 59 percent had two or more breaches in the past 12 months. • Only 11 percent of companies know the source of all network security breaches. 2 Privileges are Misused in Different Ways Insider attacks cost an average $2.7 Million per attack1 Desktop configuration errors cost companies $120/yr/pc2 Virtual sprawl and malware are ever-present realities Source: 1 Computer Security Institute and FBI Survey. Source: 2 IDC Report: The Relationship between IT Labor Costs and Best Practices for Identity and Access Management with Active 3 Insider vs Outsider Threats “Organizations continue to struggle with excessive user privilege as it remains the primary attack point for data breaches and unauthorized transactions.” • 48% of all data breaches were caused by insiders (+26%)1 ~ Mark Diodati, Burton/Gartner Group Privileged Identity Management • 48% involved privilege misuse (+26%) 1 • 98% of all data breaches came from servers1 Anti-Virus Firewalls Data Security & Leak Prevention Web Security E-mail Security BeyondTrust Intrusion Detection & Prevention External Threat Source: 1 “2010 Data Breach Investigations Report“ by Verizon with US Secret Service Internal Threat 4 End Point Vulnerabilities in a SAAS World 5 Best Practice For Cloud Security Employ a Full Suite of EndPoint Security Tools Requirements: Anti-Virus Patch Management Privilege Elevation End Point DLP 6 Impact of Virtualization and Cloud Computing Cloud Computing Reality – Public, Hybrid or Private • Increasing scale – from thousands to tens of thousands servers • Increasing complexity makes configuration and change management challenging – Complex directory structures are a major pain point • Reliability is critical to realizing operational improvement 7 Best Practice For Cloud Security Full Life-Cycle Control of Privileged Users Requirements: Account for All Privileged Users Manage Provisioning/De-Provisioning Privileged Credentials Implement a “Least Privilege” based Control System Monitor and Reconcile Privileged Activity Maintain a High Quality Audit Repository Automate Compliance Reporting 8 Impact of Virtualization and Cloud Computing Customer Requirements For Enterprise Grade Cloud Security • Scalable, enterprise grade fabric • Seamless integrations with on-premise and cloud directories • Allow admins to manage policies not infrastructure • Dynamically react to changes in virtual environment • Quantifiable performance metrics of how its performing 9 How Least Privilege Works Task Delegation / Privilege Escalation Master Host (pbmasterd) Log Host (pblogd) Policy Files 1 2 Request a Privileged Task Rejected Event Logs I/O logs Submit Host (pbrun) 2 Accepted Privileged Task 4 3 Privileged User Run Host (pblocald) 110 0 Fully Cloud Based Least Privilege Master Host (pbmasterd) Log Host (pblogd) Policy Files 1 2 Request a Privileged Task Rejected Event Logs I/O logs 2 Accepted 4 Run Host (pblocald) Hosted 3 On- Premise Privileged User Submit Host (pbrun) Privileged Task 111 1 Cloud Hosted Least Privilege Master Host (pbmasterd) Log Host (pblogd) Policy Files 1 2 Request a Privileged Task Rejected Event Logs I/O logs 2 Accepted 4 Hosted On- Premise Submit Host (pbrun) Privileged Task 3 Privileged User Run Host (pblocald) 112 2 Thank You Connect with us... 818.575.4000 www.beyondtrust.com.