The document discusses the General Data Protection Regulation (GDPR) and its implications. It notes that GDPR gives citizens more control over personal data and simplifies data regulations within the EU. It also outlines some key aspects of GDPR such as data privacy assessments, data protection officers, data subject rights, and potential sanctions for non-compliance. The document suggests that organizations incorporate data protection as part of their culture, identify how GDPR will impact them, and address the issue from legal, process, and technological perspectives.

1. Filip Kolář

3. •
•
•
•
• Give citizens control on personal data
• Simplifying the regulatory
• Facilitate free movement of data within EU
Adopted by EU in April 2016, enforced from 25 May 2018
•
• Data Privacy Assessments
• Data Protection Officers
•
•

4. • Data Controller/Processor Data Subject
• Personal Data: Any
Bob Smith IP: 212.168.1.100 bob@smith.com Visa: 4532377152918810, Blond

5. Consumer
(Data Subject)
Vendor
(Data Controller)
VDI
Cloud Storage
(Data Processor)
CRM Cloud
(Data Processor)
Support Staff
(Data Controller)
GDPR Territorial Scope: Example

7. • The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Automated decision making and profiling

8. • 72
• (SA)
• (Data Subjects)
•

9. •
• do not
•
•
•

10. •
•
•
•
•
•
•
•

11. •
•
•
•

12. In a violation act the following sanctions can be imposed:
•
•
• 10M EUR 2%
• 20M EUR 4%

14. • Less than 1
• Adopt behavioral, technology and compliance change
•
•
•

16. 72% narušení kyber bezpečnosti je způsobeno zranitelností
aplikací a zcizením uživatelských identit
Source of data breaches
Source: Based on aggregated data from IT Business Edge, Krebs on Security, Security Week, and CSO Online

18. © F5 Networks, Inc 19
Dnešní typická architektura zákazníka
User
SaaS
Public
Cloud
Data Center/
Private Cloud
• Heterogenní prostředí
• Různá úroveň bezpečnosti
• Nesourodá SLA vůči
koncovým uživatelům
• Omezená flexibilita dalšího IT
rozvoje

19. © F5 Networks, Inc 20
V tradiční modelu jsou data a uživatelé chráněni v rámci
bezpečnostního perimetru
Authorized
User
Managed
Devices Apps Data
PER IMETER SEC U R ITY
Unknown
Users
Malicious
Users
Authorized
Users
DLP Firewall IPS

20. Public Cloud – Sdílená odpovědnost ohledně zabezpečení
infrastruktury
CP Global
Infrastructure
Data Centers
Zones
Regions
Edge
Locations
Networking Services
Compute Database Storage
Deployment & Management
Client-Side Data
Encryption & Data
Integrity Authentication
Server-Side Encryption
(File System and/or
Data)
Network Traffic
Protection (Encryption,
Integrity, Identity)
Operating System, Network and Firewall
Configuration
Platform, Applications, Identity & Access
Management
Customer Data Customer’s responsibility
• Protecting the
confidentiality, integrity,
and availability of their
data in the cloud
• OS and
application-level security
Cloud Provider responsibility
• Providing a global secure
infrastructure and services
PhysicaltoHypervisorOSandApplication
CloudProviderCustomer

21. Proxování aplikací – klíčový bezpečnostní
koncept

22. © F5 Networks, Inc 23
Cílový stav: Aplikačně orientovaná architektura
User
SaaS
• Konzistentní a škálovatelné
prostředí
• Visibilita do SSL provozu
• Aplikační ochrana
• Jednotný přístup
Public
Cloud
Data Center/
Private Cloud
Aplikace

23. F5
© 2017 F5 Networks

25. PROBLEM
•
•
•
GDPR IMPACT
SOLUTION
•
•
•

26. Client Internet
Decrypt Re-encrypt
IPSDLPWeb Gateway Anti-Malware NGFW
Steer
SSL Orchestrator
L2 L3ICAPTAP

27. PROBLEM
•
•
•
•
GDPR IMPACT
SOLUTION
•
•
•
•
•
•
•
•
•

28. Access Protection Architecture
Application Infrastructure
Applications
Users
Attackers
Access
Protection
SaaS Providers
Office 365
Google
Apps
Salesforce
Directory
Services
Corporate
Users
federation
SAML 2.0 / Oauth 2.0
Real-time access control
Access policy enforcement
Authorization
Federation
Identity management
MFA
Challenge
VPN
App Encryption
SSO
Context based Auth
KCD

29. PROBLEM
•
•
GDPR IMPACT
SOLUTION
•
•
•
•
•
•

30. Fraud Protection - Architecture
Web Fraud
Protection
Online Customers
A
B
C
Online Customers
Online Customers
Security
Operations Center
Account
Amount
Transfer Funds
Network
Firewall
Copied Pages
and Phishing
Man-in-the-
Browser Attacks
Application
Automated
Transactions
Encryption

31. PROBLEM
•
•
•
•
GDPR IMPACT
SOLUTION
•
•
•
•
•

32. Application Protection Architecture
Legitimate
User
L7 Protection:
OWASP top 10, BOT protection,
L7 DDoS, Injection, 0-day, AJAX,
JSON, API, Behavioral
Public Cloud
Hosted Web
App
Private/Hybrid
Cloud Hosted
Web App
VA/DAST Scans
Web Application
Firewall Services
Private/Public/Hybrid/Service
Physical Hosted
Web App
Attackers
WAF
3rd party DAST

37. PROBLEM
•
•
•
•
•
GDPR IMPACT
SOLUTION
•
•
•
•
•
•
•

38. • Incorporate data protection as culture
• Put someone in charge
• Identify how the regulation is
• going to impact you
• Identity who is who (Data Processor/Owner)
• Consider people, processes & technology
• Do not address only legal aspects