This session will provide a deep dive of best practices to securely move customer data to the cloud through AWS, while keeping the customers’ interest top of mind. Michele Iacovone, SVP and CISO at Intuit, will illustrate how companies can successfully and securely harness the power of the cloud to ensure the speed of innovation. (Source : RSA Conference USA 2017)

1. SESSION ID:SESSION ID:
#RSAC
Michele Iacovone
Securely Moving Data to the Cloud with
Confidence and Customer Focus
CSV-R10F
Senior Vice President, Chief Information Security and Fraud Officer
Intuit
@mikiyako

2. #RSAC
About Michele
2
Former Intuit Chief Architect
Previous roles: Global Platforms for Dun & Bradstreet,
as well as CTO for both LiveCapital and Collabria
What I do when I’m not
protecting Intuit’s data

3. #RSAC
What you will learn from this presentation
3
Educate ApplyLearn
I can inspire you to
help your organization
move sensitive work
loads into the cloud….
…so that you can
learn from our
experiences
Guiding principles
will help you to
be successful!
+ =

4. #RSAC
To improve our customers’ financial lives so profoundly…
they can’t imagine going back to the old way.
Consumers Small Businesses Accounting Professionals
Intuit’s Mission
Accountants
Payments
Self-Employed
Serving 42 million customers across the globe!
4

5. #RSAC
Intuit at-a-glance
5
Founded
1983
Employees
7,900+
Engineers
3,000+
Customers
42M
FY’16 Revenue
$4.7B
Online & Mobile
Over $3B
Market Cap
$30.03B

6. #RSAC
Proven track record of managing change
Era of the CloudEra of Windows Era of WebEra of DOS
2010+1980s 1990s 2000s
Intuit Founded
Quicken
DOS
IPO
Quicken
Windows
QuickBooks
DOS
TurboTax Online
QuickBooks
Windows
TurboTax Windows
QuickBooks
MobileQuickBooks Online
QuickBooks
Online Global
• Employees: 150
• Customers: 1.3M
• Revenue: $33M
• INTU + 1,400%, NASDAQ + ~500%
• Employees: 4,500
• Customers: 5.6M
• Revenue: $1.04B
• INTU - 20%, NASDAQ - 40%
• Employees: 7900+
• Customers: 42M
• Revenue: $4.7B
• INTU +160%, NASDAQ 90%
INTU share price
SnapTax
Competitor A
Competitor A Competitor C
Competitor A
Competitor A
Competitor B
Competitor D
Competitor E

7. #RSAC
Intuit is fully committed to winning in the cloud
7
Motivation to increase speed and ease for our engineers
and operations teams
As Intuit shifted to cloud based products – opportunity
to leverage wealth of services in the public cloud
Highly seasonal business – leverage elasticity
but cost was a secondary consideration
As one of the earliest companies of this scale
with sensitive financial data – strong strategic
partnership required

8. #RSAC
Our Cloud Security Journey

9. #RSAC
Our cloud security journey
9
Consider security
needs early in your
journey and iterate
quickly and often
We spent a lot of time thinking about security
before we enabled and mobilized our teams,
and we left room for learning.

10. #RSAC
Our cloud security journey
10
Security in the cloud
requires a trusted
partnership with your
provider
We worked closely with AWS to define
security services and apply security
features across many of their services.

11. #RSAC
Our cloud security journey
11
Speed • Security • Variability
Prioritize the highest
risks and continuously
improve over time

12. #RSAC
What we’ve learned

13. #RSAC
What we’ve learned
13
Figure: Security Hierarchy of Needs

14. #RSAC
Zoning and Containment
14
Figure: Security Hierarchy of Needs
Zoning & Containment
Understanding and controlling blast radius is a
significant principle to avoid issues like
CodeSpaces.
Like firewall zoning, having controls to mitigate
the risk of a single catastrophic event is good
cloud security.
Blast radius isn’t easy, but it is quite necessary
towards creating the constraints required for
security earlier in the software development
lifecycle.

15. #RSAC
Asset Management
15
Figure: Security Hierarchy of Needs
Asset Management
Tracking configuration versioning within cloud
platforms increases security attribution for free.
Understand the infrastructure and compute
landscape when testing and triaging incidents.
Attribution reduces the time required to close
out mistakes.
Worked with AWS to enhance CloudTrail and
develop Config to improve security investigations
and incident response.

16. #RSAC
Logging
16
Figure: Security Hierarchy of Needs
Logging
Everything should be logged and transparent to
increase fast response.
Intuit spearheaded instrumentation for cross-
account visibility and detection of potential
abuse cases integrated with our operational
processes and monitoring.
Logs provide information and data for security to
increase knowledge in real-time about what’s
happening in cloud- based environments.

17. #RSAC
Authentication
17
Figure: Security Hierarchy of Needs
Authentication
Increasing the use of MFA helps to further
protect customer data in the cloud.
The strength of authentication and identity
management is important when sharing.
Securing cloud capabilities and APIs are
increasingly dependent on better identity
verification, authentication and authorization
mechanisms.

18. #RSAC
Encryption
18
Figure: Security Hierarchy of Needs
Use transparent encryption everywhere
Fine-grained application level encryption with
distributed key management can provide data
control in shared environments like the cloud
Focus on your data classification policy
Key rotation, key audit and fine-grained key scope
to minimize blast radius and exposure
Encryption

19. #RSAC
What we’ve learned
19
Figure: Security Hierarchy of Needs
Fine-grained application level encryption with distributed key management
Increase the use of MFA
Everything should be logged and transparent to increase fast response
Tracking configuration versioning within cloud platforms
increases security attribution for free
Understanding and controlling blast radius

20. #RSAC
Security for thought
20
Security can drive innovation and needs a pervasive mindset among
your teams
Security done right, especially in the public cloud, can be a
differentiator
Make security a commitment before you start your journey

21. #RSAC
Questions?