Brief overview of concepts and data about how we create, storage and consume information we use daily. Covers also information time-span paradox, and limited research about what personal risks related to cyberspace and information domain are available to capture with simple survey.

1. Artur Marek Maciąg
toperzak@gmail.com
Krótka historia bezpieczeństwa
Twojej informacji – etap chmurowy

2. Dla niecierpliwych:
• Informacje to dane i ich kontekst (w tym wartość)
• Proces zarządzania informacjami w chmurze jest zwielokrotniony
• Czas życia informacji jest subiektywny i różny od postrzeganego publicznie
• W chmurze danych rodzi się nasz cyfrowy bliźniak, warto go znać!
• Wiemy o chmurze mniej niż nam się wydaje, potrzebujemy lepszych raportów
• Współcześnie zabezpieczanie danych możliwe jest jedynie w modelu współdzielonej odpowiedzialności
• Przenoszenie do chmury starych nawyków jest bardzo niebezpieczne
• Warto użyć modeli i standardów do oceny kondycji zabezpieczeń danych w swojej organizacji
• Niezbędne jest rozszerzenie modeli oceny o czynnik ludzki i osobiste analizy ryzyka dla każdej sytuacji
• Własny przykład działa!

3. Safety
Culture
Initiative

4. 13-14 czerwca 2019
https://techrisk.pl/cfp

5. CLOUD!

6. WHAT “CLOUD” IS?
FOCUS HERE
Cloud Security Alliance: Security Guidance for Critical Areas of Focus In Cloud Computing v4.0

7. INFORMATION OR DATA?

8. DATA
META-
RECORD
INFORMATION Creation and
Receipt
Distribution
Use
Maintenance
Disposition
Creation
Indexing
Workflow
Version
control
Access
control
Digital
Asset
Management
Information
Lifecycle
Management
Create
Store
Use
Share
Archive
Exceptions Destroy
Data
Security
Lifecycle
Talk about incident caused by wrong .

9. WHERE IS MY DATA?
Cloud Security Alliance: Security Guidance for Critical Areas of Focus In Cloud Computing v4.0, based on http://www.securosis.com/blog/data-security-lifecycle-2.0

10. SHORT STORY?

11. Lifetime:
Effort:
Value:
~42.000 yr
high
legacy
~200 yr
high
legacy
cave painting painting photo
~200 yr
moderate
chronicle
selfie
~1/52 yr
low
chronicle/entertainment

12. INFORMATION LIFESPAN PARADOX (controlled vs uncontrolled)
Picture taken
Picture
print
Print
decay/destroyed
Picture
composed
Picture
stored
Picture
analyzed
Picture
shared
Picture
modified
Picture
deleted?
Metadata
created
Metadata
enhanced
Metadata
enriched
Metadata
used by you
Metadata re-
used by others
Picture print
digitalized
classical camera
digital camera
/smartphone
lifespan
controlled
uncontrolled
service provider
other service provider
unauthorized use

13. DIGITAL TWIN!

14. https://panoptykon.org/zapleczeinternetu
#skasujciastko
https://qz.com/1525661/your-digital-identity-has-three-layers-and-you-can-only-protect-one-of-them/

15. SO, WHY?

16. https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

17. WHERE?

18. COLLABORATIONBUSINESS
CONSUMERENTERPRISE
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

19. SINGEPROVIDER
MULTI PROVIDER
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

20. WHAT?

21. https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services
Confidential data in the
cloud are about 5.5% of
total data in the cloud!

22. HOW?

23. %OFUSERSSHARINGFILES%OFFILESSHARED
SHARED WITH?
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

24. AND SECURITY?

25. 3,263,144,325
Total events per month
3,217Anomalous events per month
31.3Threats per month
An average institution statistics:
3x109
3x103
3x101
WORLD
SMALL CITY
FAMILLY
USER BEHAVIOR ANALYTICS ROLE
THE CHALLENGE
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services

26. WHO TO TRUST?

27. Consider following relations:

28. CLOUD USERS SIDE VIEW: HOW MANY CLOUD APPLICATIONS YOU USE?
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services + survey of 1,400 security professionals in 11 countries

29. CLOUD PROVIDER SIDE CONTROLS: ADAPTATION OF CRITICAL SECURITY CONTROLS
https://www.skyhighnetworks.com/cloud-computing-trends-2019/ 30 million McAfee MVISION Cloud users, 50 attributes of user behavior analysis, signatures for 25,000 cloud services
PicturebyAdrianGrigorof,MariusMocanu

30. HOW TO ANALYZE THE DATA LIFECYCLE IN CLOUD ENVIRONMENT?
http://www.securosis.com/blog/data-security-lifecycle-2.0

31. HOW TO SECURE MOVE TO THE CLOUD?
https://cloudsecurityalliance.org/guidance/#_overview
Don’t bring bad habits!

32. BAD HABITS?

33. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
HOW TO ANALYZE ORGANIZATION SECURITY POSTURE?

34. https://www.cisecurity.org/white-papers/cis-controls-cloud-companion-guide/
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
https://www.cisecurity.org/cis-controls-version-7-whats-old-whats-new/
DEVIL HIDES IN DETAILS…

35. HOW TO ANALYZE PERSONAL SECURITY POSTURE?
MODERN DECALOG OF SAFETY
FOR HUMANS WITH MACHINES
RESPECT PRIVACY PRUDENCE ASSERTIVENESS EXEMPLAR
IDENTIFY PROTECT DETECT RESPOND RECOVER
DESIGNED BY SAFETY CULTURE INITIATIVE PICTOGRAMS FROM WWW.ENTYPO.COM
NIST CSF
HUMAN FACTOR
#poProstuBezpiecznie

36. PERSONAL RISK EXPOSURE AND REMEDIATION PLANS
#projektFeniks
https://uodo.gov.pl/pl/138/667
https://sci-ikb.blogspot.com/2019/01/projektfeniks.html
disaster, what to do?
will handle, sometime
can do that
inconvenient
that is happened
barely noticed
disaster, what to do?
will handle, sometime
can do that
inconvenient
that is happened
barely noticed
By accident, error or criminal activity you’ve lost UNIQUE
data that can’t be recover or recreated.
Examples are: photos, recordings, personal
documentation – in general archives and memories.
How this will impact you?
72 responses
By criminal, third party or yourself activity your
SENSITIVE and CONFIDENTIAL data you OWN are
disclosed. You’ve lost control over these data what is
adverse for you.
Examples are: PII, PHI, private photos that can
compromise you reputation, credentials, access keys,
information about your habits, addictions – in general
these are your secrets. How this will impact you?
72 responses

37. PERSONAL RISK EXPOSURE AND REMEDIATION PLANS
#projektFeniks
https://uodo.gov.pl/pl/138/667
https://sci-ikb.blogspot.com/2019/01/projektfeniks.html
disaster, what to do?
will handle, sometime
can do that
inconvenient
that is happened
barely noticed disaster, what to do?
will handle, sometime
can do that
inconvenient
that is happened
barely noticed

38. THANK YOU!
AND STAY SAFE…