Krótka historia obejmująca zarówno koncepcje jak i dane na temat tego jak tworzymy, składujemy i konsumujemy informacje we współczesnym środowisku chmurowym

1. Artur Marek Maciąg
toperzak@gmail.com
Krótka historia bezpieczeństwa
Twojej informacji – etap chmurowy

2. Dla niecierpliwych:
• Informacje to dane i ich kontekst (w tym wartość)
• Proces zarządzania informacjami w chmurze jest zwielokrotniony
• Czas życia informacji jest subiektywny i różny od postrzeganego publicznie
• W chmurze danych rodzi się nasz cyfrowy bliźniak, warto go znać!
• Wiemy o chmurze mniej niż nam się wydaje, potrzebujemy lepszych raportów
• Współcześnie zabezpieczanie danych możliwe jest jedynie w modelu współdzielonej odpowiedzialności
• Przenoszenie do chmury starych nawyków jest bardzo niebezpieczne
• Warto użyć modeli i standardów do oceny kondycji zabezpieczeń danych w swojej organizacji
• Niezbędne jest rozszerzenie modeli oceny o czynnik ludzki i osobiste analizy ryzyka dla każdej sytuacji
• Własny przykład działa!

3. Inicjatywa
Kultury
Bezpieczeństwa

4. 13-14 czerwca 2019
https://techrisk.pl/cfp

5. CHMURA!

6. WHAT “CLOUD” IS?
FOCUS HERE
Cloud Security Alliance: Security Guidance for Critical Areas of Focus In Cloud Computing v4.0

7. INFORMACJE CZY DANE?

8. DATA
META-
RECORD
INFORMATION Creation and
Receipt
Distribution
Use
Maintenance
Disposition
Creation
Indexing
Workflow
Version
control
Access
control
Digital
Asset
Management
Information
Lifecycle
Management
Create
Store
Use
Share
Archive
Exceptions Destroy
Data
Security
Lifecycle

9. WHERE IS MY DATA?
Cloud Security Alliance: Security Guidance for Critical Areas of Focus In Cloud Computing v4.0, based on http://www.securosis.com/blog/data-security-lifecycle-2.0

10. KRÓTKA HISTORIA?

11. Lifetime:
Effort:
Value:
~42.000 yr
high
legacy
~200 yr
high
legacy
cave painting painting photo
~200 yr
moderate
chronicle
selfie
~1/52 yr
low
chronicle/entertainment

12. INFORMATION LIFESPAN PARADOX (controlled vs uncontrolled)
Picture taken
Picture
print
Print
decay/destroyed
Picture
composed
Picture
stored
Picture
analyzed
Picture
shared
Picture
modified
Picture
deleted?
Metadata
created
Metadata
enhanced
Metadata
enriched
Metadata
used by you
Metadata re-
used by others
Picture print
digitalized
classical camera
digital camera
/smartphone
lifespan
controlled
uncontrolled
service provider
other service provider
unauthorized use

13. CYFROWY BLIŹNIAK!

14. https://panoptykon.org/zapleczeinternetu
#skasujciastko
https://qz.com/1525661/your-digital-identity-has-three-layers-and-you-can-only-protect-one-of-them/

15. ZATEM DLACZEGO?

16. https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

17. GDZIE?

18. COLLABORATIONBUSINESS
CONSUMERENTERPRISE
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

19. SINGEPROVIDER
MULTI PROVIDER
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

20. CO?

21. https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services
Confidential data in the
cloud are about 5.5% of
total data in the cloud!

22. JAK?

23. %OFUSERSSHARINGFILES%OFFILESSHARED
SHARED WITH?
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

24. A BEZPIECZEŃSTWO?

25. 3,263,144,325
Total events per month
3,217Anomalous events per month
31.3Threats per month
An average institution statistics:
3x109
3x103
3x101
WORLD
SMALL CITY
FAMILLY
USER BEHAVIOR ANALYTICS ROLE
THE CHALLENGE
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

26. KOMU ZAUFAĆ?

27. Consider following relations:

28. CLOUD USERS SIDE VIEW: HOW MANY CLOUD APPLICATIONS YOU USE?
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services + survey of 1,400 security professionals in 11 countries

29. CLOUD PROVIDER SIDE CONTROLS: ADAPTATION OF CRITICAL SECURITY CONTROLS
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services
PicturebyAdrianGrigorof,MariusMocanu

30. HOW TO ANALYZE THE DATA LIFECYCLE IN CLOUD ENVIRONMENT?
http://www.securosis.com/blog/data-security-lifecycle-2.0

31. HOW TO SECURE MOVE TO THE CLOUD?
https://cloudsecurityalliance.org/guidance/#_overview
Don’t bring bad habits!

32. ZŁE NAWYKI?

33. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
HOW TO ANALYZE ORGANIZATION SECURITY POSTURE?

34. https://www.cisecurity.org/white-papers/cis-controls-cloud-companion-guide/
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
https://www.cisecurity.org/cis-controls-version-7-whats-old-whats-new/
DEVIL HIDES IN DETAILS…

35. HOW TO ANALYZE PERSONAL SECURITY POSTURE?
MODERN DECALOG OF SAFETY
FOR HUMANS WITH MACHINES
RESPECT PRIVACY PRUDENCE ASSERTIVENESS EXEMPLAR
IDENTIFY PROTECT DETECT RESPOND RECOVER
DESIGNED BY SAFETY CULTURE INITIATIVE PICTOGRAMS FROM WWW.ENTYPO.COM
NIST CSF
HUMAN FACTOR
#poProstuBezpiecznie

36. PERSONAL RISK EXPOSURE AND REMEDIATION PLANS
#projektFeniks
https://uodo.gov.pl/pl/138/667
https://sci-ikb.blogspot.com/2019/01/projektfeniks.html

37. PERSONAL RISK EXPOSURE AND REMEDIATION PLANS
#projektFeniks
https://uodo.gov.pl/pl/138/667
https://sci-ikb.blogspot.com/2019/01/projektfeniks.html

38. THANK YOU!
AND STAY SAFE…