eBay PayPal Cloud Security 2013

486 views
413 views

Published on

Published in: Business, Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
486
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

eBay PayPal Cloud Security 2013

  1. 1. Michael Barrett Chief Information Security Officer PayPal
  2. 2. Michael Barrett, CISM, CISSP Chief Information Security Officer, PayPal
  3. 3. Cloud Adoption as an Opportunity for Better Authentication Passwords just do not work…
  4. 4. The Cloud has Removed the Comfort of Hashes Protecting Passwords…
  5. 5. Same password for email account and financial service provider Many Users Choose Very Poor Passwords . . . . . and Reuse Them Often
  6. 6. A Regulator’s Dream – User’s Nightmare
  7. 7. Authentication is not a Continuum
  8. 8.  Too Many Services and Providers for Unique Passwords – Integrated authentication standardwill be requiredfor broad spectrum adoption  Hybrid Operating Model Requires Local and Cloud Authentication to be Integrated – Federated identity requiredfor seamless operations – Premiseand cloud need to Leverage Same Solution or Standard – User experience must be easy and consistent  Moving Production Workloads and Sensitive Data to Cloud Requires High Assurance Levels of Access Control – Removinga roadblockfor cloud adoption Authentication is Key to the Success of the Cloud
  9. 9. What If We Could Have Something Else
  10. 10. Existing Standards Lots of industry standards out there… FIDO covers new ground, it complements the work they’ve delivered already
  11. 11. The FIDO approach Business Principles: • Enable genuine user choice with strongerauthentication • Reduce developmenttime and costs when deploying new solutions Technical Principles: • Enable and Use existing standards • Align with existing approaches (OAUTH, OATH, OPENID, PSKC, DSKPP) 1. Broad Token Support 2. Dynamic Discovery by RELYING Parties 3. Third Party validation and ATTESTATION 4. Future Proofing
  12. 12. How FIDO works
  13. 13. “Prediction is Very Difficult, Especially About the Future” Cloud Adoption
  14. 14. Where Do We Go From Here  Enhance the user experience  Recognize the need to change authentication models to allow evolution of cloud and premise services  Integration and support of FIDO (www.fidoalliance.org)  Enhance cloud adoption by providing better Authentication
  15. 15. Michael Barrett, CISM, CISSP Chief Information Security Officer, PayPal mbarrett@paypal-inc.com

×