Prezentace ze semináře "Rozjeďte to s F5 - Partner update" Praha, 13.6.2017

1. Filip Kolář

3. •
•
•
•
• Give citizens control on personal data
• Simplifying the regulatory
• Facilitate free movement of data within EU
Adopted by EU in April 2016, enforced from 25 May 2018
•
• Data Privacy Assessments
• Data Protection Officers
•
•

4. • Data Controller/Processor Data Subject
• Personal Data: Any
Bob Smith IP: 212.168.1.100 bob@smith.com Visa: 4532377152918810, Blond

5. Consumer
(Data Subject)
Vendor
(Data Controller)
VDI
Cloud Storage
(Data Processor)
CRM Cloud
(Data Processor)
Support Staff
(Data Controller)
GDPR Territorial Scope: Example

7. • The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Automated decision making and profiling

8. • 72
• (SA)
• (Data Subjects)
•

9. •
• do not
•
•
•

10. •
•
•
•
•
•
•
•

11. •
•
•
•

12. In a violation act the following sanctions can be imposed:
•
•
• 10M EUR 2%
• 20M EUR 4%

14. • Less than 1
• Adopt behavioral, technology and compliance change
•
•
•

16. 72% narušení kyber bezpečnosti je způsobeno zranitelností
aplikací a zcizením uživatelských identit
Source of data breaches
Source: Based on aggregated data from IT Business Edge, Krebs on Security, Security Week, and CSO Online

18. © F5 Networks, Inc 19
Dnešní typická architektura zákazníka
User
SaaS
Public
Cloud
Data Center/
Private Cloud
• Heterogenní prostředí
• Různá úroveň bezpečnosti
• Nesourodá SLA vůči
koncovým uživatelům
• Omezená flexibilita dalšího IT
rozvoje

19. © F5 Networks, Inc 20
V tradiční modelu jsou data a uživatelé chráněni v rámci
bezpečnostního perimetru
Authorized
User
Managed
Devices Apps Data
PER IMETER SEC U R ITY
Unknown
Users
Malicious
Users
Authorized
Users
DLP Firewall IPS

20. Public Cloud – Sdílená odpovědnost ohledně zabezpečení
infrastruktury
CP Global
Infrastructure
Data Centers
Zones
Regions
Edge
Locations
Networking Services
Compute Database Storage
Deployment & Management
Client-Side Data
Encryption & Data
Integrity Authentication
Server-Side Encryption
(File System and/or
Data)
Network Traffic
Protection (Encryption,
Integrity, Identity)
Operating System, Network and Firewall
Configuration
Platform, Applications, Identity & Access
Management
Customer Data Customer’s responsibility
• Protecting the
confidentiality, integrity,
and availability of their
data in the cloud
• OS and
application-level security
Cloud Provider responsibility
• Providing a global secure
infrastructure and services
PhysicaltoHypervisorOSandApplication
CloudProviderCustomer

21. Proxování aplikací – klíčový bezpečnostní
koncept

22. © F5 Networks, Inc 23
Cílový stav: Aplikačně orientovaná architektura
User
SaaS
• Konzistentní a škálovatelné
prostředí
• Visibilita do SSL provozu
• Aplikační ochrana
• Jednotný přístup
Public
Cloud
Data Center/
Private Cloud
Aplikace

23. F5
© 2017 F5 Networks

25. PROBLEM
•
•
•
GDPR IMPACT
SOLUTION
•
•
•

26. Client Internet
Decrypt Re-encrypt
IPSDLPWeb Gateway Anti-Malware NGFW
Steer
SSL Orchestrator
L2 L3ICAPTAP

27. PROBLEM
•
•
•
•
GDPR IMPACT
SOLUTION
•
•
•
•
•
•
•
•
•

28. Access Protection Architecture
Application Infrastructure
Applications
Users
Attackers
Access
Protection
SaaS Providers
Office 365
Google
Apps
Salesforce
Directory
Services
Corporate
Users
federation
SAML 2.0 / Oauth 2.0
Real-time access control
Access policy enforcement
Authorization
Federation
Identity management
MFA
Challenge
VPN
App Encryption
SSO
Context based Auth
KCD

29. PROBLEM
•
•
GDPR IMPACT
SOLUTION
•
•
•
•
•
•

30. Fraud Protection - Architecture
Web Fraud
Protection
Online Customers
A
B
C
Online Customers
Online Customers
Security
Operations Center
Account
Amount
Transfer Funds
Network
Firewall
Copied Pages
and Phishing
Man-in-the-
Browser Attacks
Application
Automated
Transactions
Encryption

31. PROBLEM
•
•
•
•
GDPR IMPACT
SOLUTION
•
•
•
•
•

32. Application Protection Architecture
Legitimate
User
L7 Protection:
OWASP top 10, BOT protection,
L7 DDoS, Injection, 0-day, AJAX,
JSON, API, Behavioral
Public Cloud
Hosted Web
App
Private/Hybrid
Cloud Hosted
Web App
VA/DAST Scans
Web Application
Firewall Services
Private/Public/Hybrid/Service
Physical Hosted
Web App
Attackers
WAF
3rd party DAST

37. PROBLEM
•
•
•
•
•
GDPR IMPACT
SOLUTION
•
•
•
•
•
•
•

38. • Incorporate data protection as culture
• Put someone in charge
• Identify how the regulation is
• going to impact you
• Identity who is who (Data Processor/Owner)
• Consider people, processes & technology
• Do not address only legal aspects