Can Security & Agility Co-Exist
•Download as PPTX, PDF•
0 likes•495 views
Can Security & Agility Co-Exist Presentation given at the 2014 Arizona Technology Summit by Scott Carlson, PayPal @relaxed137
Recommended
Recommended
More Related Content
Similar to Can Security & Agility Co-Exist
Similar to Can Security & Agility Co-Exist (20)
More from Scott Carlson
More from Scott Carlson (15)
Recently uploaded
Recently uploaded (20)
Can Security & Agility Co-Exist
- 1. Can Security and Agility Co-Exist? Arizona Technology Summit 2014 Scott Carlson – PayPal – September 17, 2014 © 2014 PayPal Inc. All rights reserved. Confidential and proprietary.
- 2. 26 CURRENCIES SUPPORTED 152M ACTIVE REGISTERED ACCOUNTS 203 MARKETS OFFER PAYPAL 80 LOCALIZED MARKETING SITES GLOBALLY EUROPEAN UNION EURO AUSTRALIAN DOLLAR CANADIAN DOLLAR NEW ZEALAND DOLLAR HUNGARIAN FORINT MALAYSIAN RINGGIT UNITED KINGDOM POUNDS STERLING HONG KONG DOLLAR UNITED STATES DOLLAR TAIWAN NEW DOLLAR CHINESE RMB SWEDISH KRONA SINGAPORE DOLLAR PHILIPPINE PESO BRAZILIAN REAL RUSSIAN RUBLE NORWEGIAN KRONE JAPANESE YEN MEXICAN PESO TURKISH LIRA SWISS FRANC CZECH KORUNA ISRAELI NEW SHEKEL DANISH KRONE THAI BAHT POLISH ZLOTY
- 3. Q2 2014 Results $1.95B Revenue 152M Tot2a0l% YoY 850M Total $Transactions 55B $40.4B Merchant Services Payment $14.7B Volume 35% YoY Active Accounts Net Total PVoalyummeent 29% YoY Marketplaces Payment Volume
- 4. Compliant with PCI-DSS 2.0 Standards Compliant with local country regulations © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 4 Compliance Statement: http://www.visa.com/splisting/viewSPDetail.do?coName=PayPal
- 5. secure In safe custody or keeping assured; sure; certain; free from or not exposed to danger or harm; safe. agile quick and well-coordinated in movement; marked by an ability to think quickly; intellectual acuity http://www.dictionary.com © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 5
- 6. @ http://xkcd.com used with permission under Creative commons License © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 6
- 7. secure In safe custody or keeping assured; sure; certain; free from or not exposed to danger or harm; safe. © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 7 prevent Be patched, be compliant, be hardened, be layered, don’t let data leave your network detect Log it all; parse it all; sesame street logic; leave no stone unturned respond Quarantine; active defense; mitigate; high priority patches; bug fixes; block ports; kill data streams; sever connections
- 8. @ http://xkcd.com used with permission under Creative commons License “Cyber Attack” http://www.digitalattackmap.com © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 8
- 9. “Cyber Attack” http://www.digitalattackmap.com © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 9
- 10. © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 10
- 11. http://hackmageddon.com/2014/07/07/june-2014-cyber-attacks-statistics/ © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 11
- 12. http://www.geekherocomic.com used with permission under Creative commons License © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 12
- 13. agile quick and well-coordinated in movement; marked by an ability to think quickly; intellectual acuity © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 13 wash Consider everything dirty; examine it; spray the bad parts; clean it; use machines to do the dirty work rinse Run traffic over it; verify assumptions; send it back to the wash if needed; deliver to customer; use it yourself repeat Check you work; check new versions; talk to new people; find all of the new and exciting ways people are doing things
- 14. http://www.lynnecazaly.com - used with permission © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 14
- 15. @ http://xkcd.com used with permission under Creative commons License © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 15
- 16. Compliant ≠ Secure © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 16
- 17. Agile ≠ Risky © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 17
- 18. Secure is not a permanent state © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 18
- 19. Security can not work effectively unless you have Agility © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 19
- 20. debate… decide…deliver secure © 2014 PayPal Inc. All rights reserved. Confidential and proprietary. 20
- 21. For more information, please contact: Scott Carlson @relaxed137 sccarlson@paypal.com © 2014 PayPal Inc. All rights reserved. Confidential and proprietary.
Editor's Notes
- PayPal is a world leader in payments With 203 markets and 26 currencies, we must think globally, we must think about product, we must think about our customers Any part of any of these countries could have an ongoing security issue at any time That matters to us That matters to any global company That should matter to you This is not a local economy, the internet is not local And if you have an internet presence you need to care that everything Is connected across the world
- Talk for a few minutes about the transactions, merchants, accounts What does it mean to have transactions impacted What should it mean to have more accounts 8.5 million transactions impacted if 1% have a problem 850,000 .1% 85,000 .01% 8,500 .001%
- PCI and local regulations drive much of our decision making This is a worldwide standard that drives a significant amount of security, compliance, and security Just because you are PCI compliant though, does not mean that you are protected against every threat PCI is a baseline, it is a starting point But it is not the final solution to solve every problem, in every situation, in every location
- Now to the Primary discussion today Can Security and Agility exist Break down the words Talk about the history of what secure meant In the security community it meant locked down tight, default deny, default entry, no access. Then go from there Not exposed to danger is a big one Agile use to be the antithesis of historic security Agile you need think quick, decide quick,
- Building things with ultimate security might not protect you in all situations