SlideShare a Scribd company logo
11/24/18
MAXIMIZING DATA'S POTENTIAL
2019 April 02 HPC User Forum Meeting
Cybersecurity and Risk Management and World-wide Standards
Henry Newman CTO Seagate Government Solutions hsn@seagategov.com
2
Agenda
• Digital Disruption
• Global Data Explosion
• Market Transition to Security
• Product Cybersecurity Scope
• Security Certification and Standards
• Manage / Mitigate Risks
• Compliance and Certification Management
• Product Security Operations
• Summary
3
To understand where we are going,
it’s important to understand how we got here.
4
Digital Disruption
1960 - 1970
Mainframe
Centralized
1.0
1980 - 2000
Client-Server
Distributed
2.0
2005 - 2020
Mobile-Cloud
Centralized
3.0
2020 -
Rise of the Edge
Distributed
END
POINTS
10 million
users
2 billion
users
4.0
1+ trillion
users
7 billion
users
55
GLOBAL DATA EXPLOSION
The IDC Data Age 2025 report predicts massive volumes of data creation and a
convergence of every industry utilizing the value of data.
163ZB
5
6
Market Transition to Security is Occurring
• Majority of data requires at least
some form of protection
• Actual amount of data protection falls
far short
• This gap presents an increasing
industry need for security and privacy
technologies, systems, and
processes to address it
• Substantial penalties for non-
compliance
Data created in 2025 that
should be protected90%
Amount that will
actually be protected45%
$7.9M*
GDPR:
2-4%
Annual
Revenue
• https://www.pcmag.com/news/362543/how-much-does-a-data-breach-cost
• Average Cost of Data Breach in US from IBM and Ponemon study.
7
Lines of Protection
Cybersecurity Scope
Enterprise Cybersecurity
Integrated Assurance Management
8
Enabling a Full Lifecycle Data Security Model
Cybersecurity Scope
Manage Risk
9
Security Certification and Standards
Trusted
Life-Cycle
Security
Algorithms
Crypto
Module
Security
Functionality
Secure
Data
Disposal
Trusted Data
Erasure &
Privacy
Security
By-Design
Trusted
Cryptography
Authentic
Security &
Products
Datasphere
Protection
10
Security Algorithm Certifications
Security
Algorithms
• Standard and Trusted Security Algorithms
• Certifications of all algorithms
o Data Encryption
o Integrity & Signatures
o Random # Generation
o Key Derivation…
• Required for FIPS 140-2 & Common
Criteria Certs
Cryptographic Algorithm
Validation Program (CAVP)
Trusted
Cryptography
11
Security Module Certifications: FIPS 140-2
Crypto
Module
• Fundamental Security Certification
• Evaluation by Independent Labs
• Required for Information Security
Products in Sensitive and Unclassified
space in US & Canada
• Value recognized in other geographies
Security By-
Design
Cryptographic Module
Validation Program
(CMVP)
12
Security Module Certifications: Common Criteria
(CC)
Security
Functionality
• Security Use-Case (Protection Profile)
Certification
• Evaluation by Independent Labs
• Certification recognized by 28 member
nations globally for Information Security
acquisition
Datasphere
Protection
Common Criteria
for Information
Security
Evaluation (CC)
13
Sanitization Standard
Secure Data
Disposal
• NIST SP 800-88 (Federal) & ISO
27040 (International) define media
sanitization
• NIST SP 800-57 Defines Crypto
Algorithm Longevity for erasure
assurance.
Trusted Data
Disposal &
Privacy
NIST Special Pub 800-88 ISO 27040
NIST Special Pub 800-57
14
Trusted Life-Cycle Standards
Trusted Life-
Cycle
• The Open Trusted Technology Provider
Standard (O-TTPS) is now a sanctioned
ISO Standard
• Comprehensive Secure Technology
Provider Standard
• Sections for Secure Technology
Development and Secure Supply Chain
• The NIST Cybersecurity Framework
Provides for common framework and
language for managing Cyber Risk
Authentic
Security &
Products
Cybersecurity
Framework
ISO 20243
Trusted Tech Provider Standard
15
Product Cybersecurity Scope
Mitigate Risk Policy-based compliance aligned to OTTPS, ISO and the NIST
Cybersecurity Framework (CSF)
Policies
• Product Development Policy
• Product Development 3rd Parties
Maturity Staircase to Cybersecurity Compliance
• Gap Analysis
• Conformance
• Certification Preparation
• Certification
Scalable to Trusted Product Lifecycle
• Design, Source, Manufacture, Deliver, Service
• Product Security Operations Center (PSOC)
• Product Security Incident Response Team (PSIRT)
Transparent Compliance and Incident Response
Management
Integrated Assurance Management
16
Product Security: Manage Risk
Maturity Staircase Based Policy Compliance
• Product Development Policy
• Product Development 3rd Parties
Identify Protect Detect Respond RecoverPolicies
Gap Analysis
Conformance
Certification
Preparation
Certification
Increasing Levels of
Compliance Maturity
17
Product Security: Certification
Trusted Product Life Cycle Certification
ISO
20243
Certify
Design
Source
Manufacture
Deliver
Service
Identify Protect Detect Respond Recover
18
Certified Erase - Strong Data Protection Assurance
NIST Special Pub 800-88 ISO
27040NIST Special Pub 800-57
✓ Defines Strong Media Sanitization
✓ Defines Security Requirements
✓ Defines Erase Certificate. App. D
Cryptographic Module Validation
Program (CMVP)
Cryptographic Algorithm Validation
Program (CAVP)
✓ Independent Lab Validation
✓ Validates 800-88 Security
Rqmts
✓ Public Online Policy &
Certificate
Common Criteria for Information
Security Evaluation (CC)
✓ Independent Lab Validation
✓ Validates 800-88 Data Erasure
✓ Public Online Policy &
Certificate
EE – Encryption Engine Profile
AA – Authorization Acquisition Profile
✓ Essential & Certified By Design
✓ Trusted Design & Life-cycle
✓ Verifiable HW Roots of Trust
ISO
20243
Trusted Tech Provider Standard
19
Summary
Integrity
Tainted Product
Tampered
Product Security
Life-Cycle
IP Leakage
Over-privileged
Access & Lack
of Controls
Confidentiality
B2B Network
Trust
B2B Security
Assurance
Control /
Detection
Availability
Secure
Product
Product
Security
Managed
Risk in
Digital
Enterprises
20Seagate Confidential
Thank You

More Related Content

More from inside-BigData.com

Machine Learning for Weather Forecasts
Machine Learning for Weather ForecastsMachine Learning for Weather Forecasts
Machine Learning for Weather Forecasts
inside-BigData.com
 
HPC AI Advisory Council Update
HPC AI Advisory Council UpdateHPC AI Advisory Council Update
HPC AI Advisory Council Update
inside-BigData.com
 
Fugaku Supercomputer joins fight against COVID-19
Fugaku Supercomputer joins fight against COVID-19Fugaku Supercomputer joins fight against COVID-19
Fugaku Supercomputer joins fight against COVID-19
inside-BigData.com
 
Energy Efficient Computing using Dynamic Tuning
Energy Efficient Computing using Dynamic TuningEnergy Efficient Computing using Dynamic Tuning
Energy Efficient Computing using Dynamic Tuning
inside-BigData.com
 
HPC at Scale Enabled by DDN A3i and NVIDIA SuperPOD
HPC at Scale Enabled by DDN A3i and NVIDIA SuperPODHPC at Scale Enabled by DDN A3i and NVIDIA SuperPOD
HPC at Scale Enabled by DDN A3i and NVIDIA SuperPOD
inside-BigData.com
 
State of ARM-based HPC
State of ARM-based HPCState of ARM-based HPC
State of ARM-based HPC
inside-BigData.com
 
Versal Premium ACAP for Network and Cloud Acceleration
Versal Premium ACAP for Network and Cloud AccelerationVersal Premium ACAP for Network and Cloud Acceleration
Versal Premium ACAP for Network and Cloud Acceleration
inside-BigData.com
 
Zettar: Moving Massive Amounts of Data across Any Distance Efficiently
Zettar: Moving Massive Amounts of Data across Any Distance EfficientlyZettar: Moving Massive Amounts of Data across Any Distance Efficiently
Zettar: Moving Massive Amounts of Data across Any Distance Efficiently
inside-BigData.com
 
Scaling TCO in a Post Moore's Era
Scaling TCO in a Post Moore's EraScaling TCO in a Post Moore's Era
Scaling TCO in a Post Moore's Era
inside-BigData.com
 
CUDA-Python and RAPIDS for blazing fast scientific computing
CUDA-Python and RAPIDS for blazing fast scientific computingCUDA-Python and RAPIDS for blazing fast scientific computing
CUDA-Python and RAPIDS for blazing fast scientific computing
inside-BigData.com
 
Introducing HPC with a Raspberry Pi Cluster
Introducing HPC with a Raspberry Pi ClusterIntroducing HPC with a Raspberry Pi Cluster
Introducing HPC with a Raspberry Pi Cluster
inside-BigData.com
 
Overview of HPC Interconnects
Overview of HPC InterconnectsOverview of HPC Interconnects
Overview of HPC Interconnects
inside-BigData.com
 
Efficient Model Selection for Deep Neural Networks on Massively Parallel Proc...
Efficient Model Selection for Deep Neural Networks on Massively Parallel Proc...Efficient Model Selection for Deep Neural Networks on Massively Parallel Proc...
Efficient Model Selection for Deep Neural Networks on Massively Parallel Proc...
inside-BigData.com
 
Data Parallel Deep Learning
Data Parallel Deep LearningData Parallel Deep Learning
Data Parallel Deep Learning
inside-BigData.com
 
Making Supernovae with Jets
Making Supernovae with JetsMaking Supernovae with Jets
Making Supernovae with Jets
inside-BigData.com
 
Adaptive Linear Solvers and Eigensolvers
Adaptive Linear Solvers and EigensolversAdaptive Linear Solvers and Eigensolvers
Adaptive Linear Solvers and Eigensolvers
inside-BigData.com
 
Scientific Applications and Heterogeneous Architectures
Scientific Applications and Heterogeneous ArchitecturesScientific Applications and Heterogeneous Architectures
Scientific Applications and Heterogeneous Architectures
inside-BigData.com
 
SW/HW co-design for near-term quantum computing
SW/HW co-design for near-term quantum computingSW/HW co-design for near-term quantum computing
SW/HW co-design for near-term quantum computing
inside-BigData.com
 
FPGAs and Machine Learning
FPGAs and Machine LearningFPGAs and Machine Learning
FPGAs and Machine Learning
inside-BigData.com
 
Deep Learning State of the Art (2020)
Deep Learning State of the Art (2020)Deep Learning State of the Art (2020)
Deep Learning State of the Art (2020)
inside-BigData.com
 

More from inside-BigData.com (20)

Machine Learning for Weather Forecasts
Machine Learning for Weather ForecastsMachine Learning for Weather Forecasts
Machine Learning for Weather Forecasts
 
HPC AI Advisory Council Update
HPC AI Advisory Council UpdateHPC AI Advisory Council Update
HPC AI Advisory Council Update
 
Fugaku Supercomputer joins fight against COVID-19
Fugaku Supercomputer joins fight against COVID-19Fugaku Supercomputer joins fight against COVID-19
Fugaku Supercomputer joins fight against COVID-19
 
Energy Efficient Computing using Dynamic Tuning
Energy Efficient Computing using Dynamic TuningEnergy Efficient Computing using Dynamic Tuning
Energy Efficient Computing using Dynamic Tuning
 
HPC at Scale Enabled by DDN A3i and NVIDIA SuperPOD
HPC at Scale Enabled by DDN A3i and NVIDIA SuperPODHPC at Scale Enabled by DDN A3i and NVIDIA SuperPOD
HPC at Scale Enabled by DDN A3i and NVIDIA SuperPOD
 
State of ARM-based HPC
State of ARM-based HPCState of ARM-based HPC
State of ARM-based HPC
 
Versal Premium ACAP for Network and Cloud Acceleration
Versal Premium ACAP for Network and Cloud AccelerationVersal Premium ACAP for Network and Cloud Acceleration
Versal Premium ACAP for Network and Cloud Acceleration
 
Zettar: Moving Massive Amounts of Data across Any Distance Efficiently
Zettar: Moving Massive Amounts of Data across Any Distance EfficientlyZettar: Moving Massive Amounts of Data across Any Distance Efficiently
Zettar: Moving Massive Amounts of Data across Any Distance Efficiently
 
Scaling TCO in a Post Moore's Era
Scaling TCO in a Post Moore's EraScaling TCO in a Post Moore's Era
Scaling TCO in a Post Moore's Era
 
CUDA-Python and RAPIDS for blazing fast scientific computing
CUDA-Python and RAPIDS for blazing fast scientific computingCUDA-Python and RAPIDS for blazing fast scientific computing
CUDA-Python and RAPIDS for blazing fast scientific computing
 
Introducing HPC with a Raspberry Pi Cluster
Introducing HPC with a Raspberry Pi ClusterIntroducing HPC with a Raspberry Pi Cluster
Introducing HPC with a Raspberry Pi Cluster
 
Overview of HPC Interconnects
Overview of HPC InterconnectsOverview of HPC Interconnects
Overview of HPC Interconnects
 
Efficient Model Selection for Deep Neural Networks on Massively Parallel Proc...
Efficient Model Selection for Deep Neural Networks on Massively Parallel Proc...Efficient Model Selection for Deep Neural Networks on Massively Parallel Proc...
Efficient Model Selection for Deep Neural Networks on Massively Parallel Proc...
 
Data Parallel Deep Learning
Data Parallel Deep LearningData Parallel Deep Learning
Data Parallel Deep Learning
 
Making Supernovae with Jets
Making Supernovae with JetsMaking Supernovae with Jets
Making Supernovae with Jets
 
Adaptive Linear Solvers and Eigensolvers
Adaptive Linear Solvers and EigensolversAdaptive Linear Solvers and Eigensolvers
Adaptive Linear Solvers and Eigensolvers
 
Scientific Applications and Heterogeneous Architectures
Scientific Applications and Heterogeneous ArchitecturesScientific Applications and Heterogeneous Architectures
Scientific Applications and Heterogeneous Architectures
 
SW/HW co-design for near-term quantum computing
SW/HW co-design for near-term quantum computingSW/HW co-design for near-term quantum computing
SW/HW co-design for near-term quantum computing
 
FPGAs and Machine Learning
FPGAs and Machine LearningFPGAs and Machine Learning
FPGAs and Machine Learning
 
Deep Learning State of the Art (2020)
Deep Learning State of the Art (2020)Deep Learning State of the Art (2020)
Deep Learning State of the Art (2020)
 

Recently uploaded

Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
OnBoard
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance
 
Elevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object CalisthenicsElevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object Calisthenics
Dorra BARTAGUIZ
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
Product School
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
Alison B. Lowndes
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
Cheryl Hung
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
Prayukth K V
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Ramesh Iyer
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
BookNet Canada
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Thierry Lestable
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 

Recently uploaded (20)

Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
 
Elevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object CalisthenicsElevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object Calisthenics
 
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...
 
Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........Bits & Pixels using AI for Good.........
Bits & Pixels using AI for Good.........
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
Empowering NextGen Mobility via Large Action Model Infrastructure (LAMI): pav...
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 

Cybersecurity and Risk Management and World-wide Standards

  • 1. 11/24/18 MAXIMIZING DATA'S POTENTIAL 2019 April 02 HPC User Forum Meeting Cybersecurity and Risk Management and World-wide Standards Henry Newman CTO Seagate Government Solutions hsn@seagategov.com
  • 2. 2 Agenda • Digital Disruption • Global Data Explosion • Market Transition to Security • Product Cybersecurity Scope • Security Certification and Standards • Manage / Mitigate Risks • Compliance and Certification Management • Product Security Operations • Summary
  • 3. 3 To understand where we are going, it’s important to understand how we got here.
  • 4. 4 Digital Disruption 1960 - 1970 Mainframe Centralized 1.0 1980 - 2000 Client-Server Distributed 2.0 2005 - 2020 Mobile-Cloud Centralized 3.0 2020 - Rise of the Edge Distributed END POINTS 10 million users 2 billion users 4.0 1+ trillion users 7 billion users
  • 5. 55 GLOBAL DATA EXPLOSION The IDC Data Age 2025 report predicts massive volumes of data creation and a convergence of every industry utilizing the value of data. 163ZB 5
  • 6. 6 Market Transition to Security is Occurring • Majority of data requires at least some form of protection • Actual amount of data protection falls far short • This gap presents an increasing industry need for security and privacy technologies, systems, and processes to address it • Substantial penalties for non- compliance Data created in 2025 that should be protected90% Amount that will actually be protected45% $7.9M* GDPR: 2-4% Annual Revenue • https://www.pcmag.com/news/362543/how-much-does-a-data-breach-cost • Average Cost of Data Breach in US from IBM and Ponemon study.
  • 7. 7 Lines of Protection Cybersecurity Scope Enterprise Cybersecurity Integrated Assurance Management
  • 8. 8 Enabling a Full Lifecycle Data Security Model Cybersecurity Scope Manage Risk
  • 9. 9 Security Certification and Standards Trusted Life-Cycle Security Algorithms Crypto Module Security Functionality Secure Data Disposal Trusted Data Erasure & Privacy Security By-Design Trusted Cryptography Authentic Security & Products Datasphere Protection
  • 10. 10 Security Algorithm Certifications Security Algorithms • Standard and Trusted Security Algorithms • Certifications of all algorithms o Data Encryption o Integrity & Signatures o Random # Generation o Key Derivation… • Required for FIPS 140-2 & Common Criteria Certs Cryptographic Algorithm Validation Program (CAVP) Trusted Cryptography
  • 11. 11 Security Module Certifications: FIPS 140-2 Crypto Module • Fundamental Security Certification • Evaluation by Independent Labs • Required for Information Security Products in Sensitive and Unclassified space in US & Canada • Value recognized in other geographies Security By- Design Cryptographic Module Validation Program (CMVP)
  • 12. 12 Security Module Certifications: Common Criteria (CC) Security Functionality • Security Use-Case (Protection Profile) Certification • Evaluation by Independent Labs • Certification recognized by 28 member nations globally for Information Security acquisition Datasphere Protection Common Criteria for Information Security Evaluation (CC)
  • 13. 13 Sanitization Standard Secure Data Disposal • NIST SP 800-88 (Federal) & ISO 27040 (International) define media sanitization • NIST SP 800-57 Defines Crypto Algorithm Longevity for erasure assurance. Trusted Data Disposal & Privacy NIST Special Pub 800-88 ISO 27040 NIST Special Pub 800-57
  • 14. 14 Trusted Life-Cycle Standards Trusted Life- Cycle • The Open Trusted Technology Provider Standard (O-TTPS) is now a sanctioned ISO Standard • Comprehensive Secure Technology Provider Standard • Sections for Secure Technology Development and Secure Supply Chain • The NIST Cybersecurity Framework Provides for common framework and language for managing Cyber Risk Authentic Security & Products Cybersecurity Framework ISO 20243 Trusted Tech Provider Standard
  • 15. 15 Product Cybersecurity Scope Mitigate Risk Policy-based compliance aligned to OTTPS, ISO and the NIST Cybersecurity Framework (CSF) Policies • Product Development Policy • Product Development 3rd Parties Maturity Staircase to Cybersecurity Compliance • Gap Analysis • Conformance • Certification Preparation • Certification Scalable to Trusted Product Lifecycle • Design, Source, Manufacture, Deliver, Service • Product Security Operations Center (PSOC) • Product Security Incident Response Team (PSIRT) Transparent Compliance and Incident Response Management Integrated Assurance Management
  • 16. 16 Product Security: Manage Risk Maturity Staircase Based Policy Compliance • Product Development Policy • Product Development 3rd Parties Identify Protect Detect Respond RecoverPolicies Gap Analysis Conformance Certification Preparation Certification Increasing Levels of Compliance Maturity
  • 17. 17 Product Security: Certification Trusted Product Life Cycle Certification ISO 20243 Certify Design Source Manufacture Deliver Service Identify Protect Detect Respond Recover
  • 18. 18 Certified Erase - Strong Data Protection Assurance NIST Special Pub 800-88 ISO 27040NIST Special Pub 800-57 ✓ Defines Strong Media Sanitization ✓ Defines Security Requirements ✓ Defines Erase Certificate. App. D Cryptographic Module Validation Program (CMVP) Cryptographic Algorithm Validation Program (CAVP) ✓ Independent Lab Validation ✓ Validates 800-88 Security Rqmts ✓ Public Online Policy & Certificate Common Criteria for Information Security Evaluation (CC) ✓ Independent Lab Validation ✓ Validates 800-88 Data Erasure ✓ Public Online Policy & Certificate EE – Encryption Engine Profile AA – Authorization Acquisition Profile ✓ Essential & Certified By Design ✓ Trusted Design & Life-cycle ✓ Verifiable HW Roots of Trust ISO 20243 Trusted Tech Provider Standard
  • 19. 19 Summary Integrity Tainted Product Tampered Product Security Life-Cycle IP Leakage Over-privileged Access & Lack of Controls Confidentiality B2B Network Trust B2B Security Assurance Control / Detection Availability Secure Product Product Security Managed Risk in Digital Enterprises