Inspiratiesessie Cloud en Security
•
0 likes•90 views
In een wereld waarin flexibiliteit en schaalbaarheid van ICT door bijna iedere organisatie vereist wordt én waarin nieuwe wetgeving en cyberdreigingen steeds geavanceerder worden, zijn cloud en security inmiddels thema’s waar we niet langer omheen kunnen. Bij veel organisaties zijn beide onderwerpen dan ook hottopic op de ICT-agenda. Presentatie van 15 juni 2017
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Inspiratiesessie Cloud en Security
Similar to Inspiratiesessie Cloud en Security (20)
More from ICT-Partners
More from ICT-Partners (20)
Recently uploaded
Recently uploaded (20)
Inspiratiesessie Cloud en Security
- 1. Uw werkplek- en datacenterspecialist Ontwerpen • Implementeren • Optimaliseren
- 3. Agenda • 12.00 - 13.00 uur Lunch • 13.00 - 13.15 uur Opening & welkom • 13.15 - 14.15 uur Deel I - Cloud • 14.15 - 14.45 uur Koffiepauze • 14.45 - 16.00 uur Deel II - Security • 16.00 - … uur Afsluiting & borrel
- 5. Over ICT-Partners • 80 experts • Meer dan 15 jaar ervaring • Drie vestigingen WEST (opgericht per 1 mei) Noord (Paterswolde)
- 6. Focus ICT-Partners • Transities van werkplek- en datacenter infrastructuur • Architectuur / Roadmapping • Security • Cloud (services, Azure, Office 365) • Automation
- 7. Partners
- 8. ICT-Partners over ICT Optimaliseer investeringen en investeer in innovatie Maak van ICT een echte business-enabler Een juist strategisch ICT-beleid omarmt technologische ontwikkelingen die de concurrentiepositie van de business versterken.
- 9. Deel I - Cloud ‘De (praktijk)voordelen van Microsoft Cloud’ Door Jan Depping, Microsoft / André Kamman, ICT-Partners
- 10. Digital Transformation Jan Depping Partner Technology Strategist MCSA Cloud jan.depping@microsoft.com https://www.linkedin.com/in/jdepping
- 11. Technology is fast reshaping our world and has the potential to change everything – people, businesses, communities and nations.” “ Employees work on nearly 2x the number of teams than they did five years ago* 41% employees say mobile business apps are changing the way they work* Information overload wastes 25% of employee time, costing U.S. business $997B each year* 160M customer records leaked* 229 days to detect security infiltration* - Luis Alvarez, CEO, Global Services, BT BT Global Services CIO report 2016: The Digital CIO * Multiple industry sources.
- 13. Azure Intelligent Cloud Jan Depping Partner Technology Strategist MCSA Cloud jan.depping@microsoft.com https://www.linkedin.com/in/jdepping
- 15. Usage is our way of living
- 16. Infinit e devices and data Finite time and attention DATA
- 17. Compliant and Trustworthy Continuous Change Freedom of Choice Software Defined Self-Service Pay per Use Build to Fail Sharing
- 19. Ecosystem Provided Languages, Dev Tools & App Containers CMS & Apps Devices Databases Management MS Integrated Operating systems Bring your own libcloud jclouds IDE
- 22. West US West US 2 Microsoft infrastructure 38 Cloud regions worldwide Central US East US North Central US Brazil South West Europe Japan East South India Southeast Asia Australia Southeast Australia East Central India West India Japan West East Asia China West1 North Europe Germany Northeast2 Canada East Canada Central South Central US China East1 Germany Central2 Korea South3 East US 2 Korea Central3 United Kingdom West United Kingdom South West Central US US Gov Virginia US Gov Iowa US DoD East US DoD West France3 France3 100+ datacenters One of 3 largest networks in the world 1China datacenters operated by 21 Vianet 2German data trustee services provided by T-systems 3France, South Korea and US Gov datacenter regions have been announced but are not currently operational Sovereign datacenters Global datacenters US Gov Texas3 US Gov Arizona3
- 24. Platform Services Infrastructure Services Web Apps Mobile Apps API Apps Notification Hubs Hybrid Cloud Backup StorSimple Azure Site Recovery Import/Export SQL Database DocumentDB Redis Cache Azure Search Storage Tables SQL Data Warehouse Azure AD Health Monitoring AD Privileged Identity Management Operational Analytics Cloud Services Batch RemoteApp Service Fabric Visual Studio Application Insights VS Team Services Domain Services HDInsight Machine Learning Stream Analytics Data Factory Event Hubs Data Lake Analytics Service IoT Hub Data Catalog Security & Management Azure Active Directory Multi-Factor Authentication Automation Portal Key Vault Store/ Marketplace VM Image Gallery & VM Depot Azure AD B2C Scheduler Xamarin HockeyApp Power BI Embedded SQL Server Stretch Database Mobile Engagement Functions Cognitive Services Bot Framework Cortana Security Center Container Service VM Scale Sets Data Lake Store BizTalk Services Service Bus Logic Apps API Management Content Delivery Network Media Services Media Analytics
- 26. Reinventing Productivity for the digital transformation
- 27. Office 365 The most complete, intelligent and secure service for digital work Authoring Word Excel PowerPoint OneNote Mail & Social Outlook Yammer Sites & Content OneDrive SharePoint Delve Chat, Meetings & Voice Microsoft Teams Skype for Business Analytics Power BI MyAnalytics Office 365 Groups Graph Security & Compliance
- 28. GDPR Jan Depping Partner Technology Strategist MCSA Cloud jan.depping@microsoft.com https://www.linkedin.com/in/jdepping
- 29. Privacy, Trust, and the General Data Protection Regulation (GDPR)
- 30. Providing clarity and consistency for the protection of personal data Enhanced personal privacy rights Increased duty for protecting data Mandatory breach reporting Significant penalties for non-compliance The General Data Protection Regulation (GDPR) imposes new rules on organizations that offer goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents, no matter where they are located.
- 31. Personal privacy What are the key changes with the GDPR? Controls and notifications Transparent policies IT and training Processors will need: • Train privacy personnel & employee • Audit and update data policies • Employ a Data Protection Officer (for larger organizations) • Create & manage processor/vendor contracts Processors will need to: • Protect personal data using appropriate security practices • Notify authorities within 72 hours of breaches • Receive consent before processing personal data • Keep records detailing data processing Individuals have the right to: • Access their personal data • Correct errors in their personal data • Erase their personal data • Object to processing of their personal data • Export personal data Processors are required to: • Provide clear notice of data collection • Outline processing purposes and use cases • Define data retention and deletion policies
- 32. How do I get started? Identify what personal data you have and where it resides Discover1 Govern how personal data is used and accessed Manage2 Establish security controls to prevent, detect, and respond to vulnerabilities & data breaches Protect3 Keep required documentation, manage data requests and breach notificationsReport4
- 33. Discover: In-scope: • • • • • • • • • • Inventory: • • • • • • • Microsoft Azure Microsoft Azure Data Catalog Enterprise Mobility + Security (EMS) Microsoft Cloud App Security Dynamics 365 Audit Data & User Activity Reporting & Analytics Office & Office 365 Data Loss Prevention Advanced Data Governance Office 365 eDiscovery SQL Server and Azure SQL Database SQL Query Language Windows & Windows Server Windows Search Example solutions 1
- 34. 2 Example solutions Manage: Data governance: • • • • • • • • Data classification: • • • • • • • Microsoft Azure Azure Active Directory Azure Role-Based Access Control (RBAC) Enterprise Mobility + Security (EMS) Azure Information Protection Dynamics 365 Security Concepts Office & Office 365 Advanced Data Governance Journaling (Exchange Online) Windows & Windows Server Microsoft Data Classification Toolkit
- 35. 3 Example solutions Protect: Preventing data attacks: • • • • • • • • Detecting & responding to breaches: • • • • • • Microsoft Azure Azure Key Vault Enterprise Mobility + Security (EMS) Azure Active Directory Premium Microsoft Intune Office & Office 365 Advanced Threat Protection Threat Intelligence SQL Server and Azure SQL Database Transparent data encryption Always Encrypted Windows & Windows Server Windows Defender Advanced Threat Protection Windows Hello Device Guard
- 36. 4 Example solutions Report: Record-keeping: • • • • • Reporting tools: • • • • • • Microsoft Trust Center Service Trust Portal Microsoft Azure Azure Auditing & Logging Microsoft Azure Monitor Enterprise Mobility + Security (EMS) Azure Information Protection Dynamics 365 Reporting & Analytics Office & Office 365 Service Assurance Office 365 Audit Logs Customer Lockbox Windows & Windows Server Windows Defender Advanced Threat Protection
- 37. Data governance & rights management Responsibility SaaS PaaS IaaS On-prem Client endpoints Account & access management Identity & directory infrastructure Application Network controls Operating system Physical network Physical datacenter CustomerMicrosoft Physical hosts ALWAYS RETAINED BY CUSTOMER VARIES BY SERVICE TYPE TRANSFERS TO CLOUD PROVIDER Cloud service provider responsibility Customer responsibility A Partnership
- 38. CLOUD CONSUMER AS DATA CONTROLLER Information security, privacy, compliance, legal, policy requirements 1 CLOUD PROVIDER AS DATA PROCESSOR MICROSOFT COMMITMENTS Customer requests assurances from Cloud vendor 3 Customer demonstrates compliance.6 CUSTOM(ER) CONTROLS & PROCESSES Customer evaluates claims and adds additional controls5 CLOUD PROVIDER CLAIMS RISKS GOVERNANCE, RISK & COMPLIANCE Customer continuous assessment2 MITIGATING CONTROLS Monitoring Investigation Examination REAL TIME INSIGHTS Microsoft provides attestations, certifications and legal commitments 4CONTRACTING INDEPENDENTLY VERIFIED DESCRIPTIVE INFORMATION INTEGRATED CONTROLS CUSTOMER OR EMPLOYEE OF CLOUD CONSUMER AS DATA SUBJECT Assurance process The coverage reports help customers to map and evaluate Microsoft’s assurances to local frameworks (NEN7510 / BIR)
- 39. CLOUD CONSUMER AS DATA CONTROLLER Information security, privacy, compliance, legal, policy requirements 1 CLOUD PROVIDER AS DATA PROCESSOR MICROSOFT COMMITMENTS Customer requests assurances from Cloud vendor 3 Customer demonstrates compliance.6 CUSTOM(ER) CONTROLS & PROCESSES Customer evaluates claims and adds additional controls5 CLOUD PROVIDER CLAIMS RISKS GOVERNANCE, RISK & COMPLIANCE Customer continuous assessment2 MITIGATING CONTROLS Monitoring Investigation Examination REAL TIME INSIGHTS Microsoft provides attestations, certifications and legal commitments 4CONTRACTING INDEPENDENTLY VERIFIED DESCRIPTIVE INFORMATION INTEGRATED CONTROLS CUSTOMER OR EMPLOYEE OF CLOUD CONSUMER AS DATA SUBJECT Assurance process Online Service Terms | SLA ISO 27001/2/17/18 | ISAE 3000 SOC2-II | FEDRamp NIST 800-53r4 Trustcenter | white papers | verbal discussions EDISCOVERY AND ANALYTICS ARCHIVING AND RETENTION AUDITING Activity API/LOG COMPLIANCE STANDARDS
- 47. Het moment om naar de cloud te gaan… Wanneer • Bij vernieuwing van software • Bij verouderde hardware • Extra functionaliteiten • Capaciteit binnen de ICT-afdeling • Workloads met piektijden Wat • Omzetten naar SaaS / Verplaatsen naar cloud / Toch traditioneel datacenter Bij een goede business case Waarom • Snelle implementatie • Flexibiliteit • Disaster recovery • Automatische software updates • Minder/geen Capital-expenditure • Verhoogde samenwerking • Locatie onafhankelijk • Controle over documenten • Security • Beter omgaan met resources/energie
- 48. Infastructuur Stack Housing Netwerk Compute & Storage (Compute, Storage en Netwerk) Virtualisatie Windows Servers MiddleWare Applicaties IT-afdeling Housing Netwerk Compute & Storage Housing Netwerk Compute & Storage (Compute, Storage en Netwerk) Virtualisatie (Compute, Storage en Netwerk) Virtualisatie Windows Servers MiddleWare Housing Netwerk Compute & Storage (Compute, Storage en Netwerk) Virtualisatie Windows Servers MiddleWare Applicaties SaaS Diensten & applicaties IaaS PaaS Use-Case scenario
- 49. Naar de cloud… Voorbereidende stappen nemen • Rationaliseer processen en bijbehorende applicaties • Standaardiseer waar het kan • Differentieer waar het waarde toevoegt • Draagvlak creëren Plannen • Passend plan • Gefaseerd / naast elkaar draaien • Houd applicaties en data bij elkaar • Lage risico apps eerst Testen • Testplan opstellen • Scenario uitwerken • Dummy testen
- 50. Use-Case 1: Microsoft Exchange Aanleiding Verouderde Exchange, te weinig opslagcapaciteit, ontbreken redundantie.
- 51. Migratie • Technisch Ontwerp • Planning • Cut-over / Staged / IMAP of Hybrid migratie • Dummy gebruikerstest • Keyuser test (hybride test) • Eindgebruikers overzetten Voordelen • Geen infrastructuur beheer meer • Flexibele storage • Archivering • Geen Exchange migraties meer • Ingebouwde back-up Overige • Je behoudt volledige controle • Tenant aanvraag / subscription • Beheren via GUI en Commandline (scripts) • Afbouwen oude omgeving • Gebruikers opleiden • Latency / wachttijden
- 52. Use-Case 2: Azure Backup & Site Recovery Aanleiding Verouderde back-upomgeving, tape drive defect, extra functionaliteiten.
- 53. Voordelen • Geen infrastructuur beheer meer • Geen tape handeling meer • Lange termijn archivering • Automatisch schalen • Goedkope storage • Redundantie in storage • Noodscenario in de cloud Overige • Azure subscription • Geen tape support • Je behoudt volledige controle • Beheer via Azure Backup Server • Beheerders opleiden • Backup, Restore en Site Recovery • Latency / wachttijden • Windows en Linux
- 54. Migratie • Technisch Ontwerp • Planning • Migratie • Data/vm/Exchange/SQL • Backup en restore test • Eerst kleine workload • Volledig overzetten • Afbouwen oude omgeving
- 55. Vragen
- 57. Deel II - Security ‘Hoe veilig is uw ICT-omgeving?’ Door Henri Vierhoven, ICT-Partners / Sjoerd de Jong, Exclusive Networks
- 59. Onze oplossingen ICT-Partners helpt u succesvol te zijn met uw ICT. Wij ontwerpen, implementeren en optimaliseren ICT-omgevingen met de nieuwste technologieën, die bijdragen aan continuïteit, stabiliteit en kostenbesparing.
- 60. Inhoud • Geschiedenis security • Wetgeving • Bewustwording • Quickscan • Next-Generation Endpoint Security
- 61. ICT-security in het nieuws
- 62. Veranderingen binnen security domein • Rechten • Virus • Internet • Devices • Websites • Applicaties • Wetgeving
- 63. Waarom anti-virus niet langer afdoende is 01100111 01010110 10101010 10100101 10001010 11010011 00101101 Wrappers Veranderende ‘verschijning’ van een bestand Variations / Obfuscators Veranderende inhoudelijke code om uniek over te komen Packers Bedoeld om enkel op een echte machine te draaien (anti-VM, sleepers, interactions, anti- debug) Targeting Bedoeld om enkel op een specifieke machine of configuratie te draaien Malicious Code De daadwerkelijke onderliggende code met als doelstelling informatie te stelen of te bewerken
- 64. Toenemend aantal aanvalskanalen MALWARE EXPLOITS File-less • Memory-only malware Executables • Ransomware • Trojans • Worms • Backdoors Browser • Drive-by Downloads • Flash, Java • iframe/html5, plug-ins Documents • Office Doc Exploits • Adobe Macros • SpearPhishing e-mails LIVE/INSIDER Scripts • Powershell • PowerSploit • WMI, VBS Credentials • Credential Scraping • Mimikatz • Tokens
- 65. Wetgeving/richtlijnen • Wet Meldplicht Datalekken 01-01-2016 • General Data Protection Regulation 25-05-2018 • BIG / BIR 2012 (Gemeenten) • NEN7510 (Zorg) • ISO27001 (Algemeen)
- 66. Quickscan ICT-Partners • Inzicht – Bewustwording – Actie • Pragmatische aanpak • Leidraad van 9 punten + klantspecifieke vraagstelling • Vooraf doornemen van aanwezige documentatie • Interviews op verschillende organisatieniveaus • Heldere rapportage • Concrete vervolgstappen • Quick wins
- 68. Toegepaste technologieën Bron: 2017 Cyberthreat Defense Report
- 70. Succesvolle aanvallen Bron: 2017 Cyberthreat Defense Report
- 71. Aanvallen in het komende jaar Bron: 2017 Cyberthreat Defense Report
- 72. Schade
- 73. Waarom Next-Generation Endpoint Security? • Geschikt voor alle besturingssystemen • Geschikt voor alle devices • Trigger op niet toegestane gedragingen • Toekomstbestendig • Bewijslast t.b.v. wetgevingen datalekken (WMD, GDPR) • Voorkomt dataverlies • Voorkomt reputatieschade (WMD) • Voorkomt downtime
- 75. Cybercrime
- 78. Bestaansrecht Cybercrime 1: Geld 2: Oorlogsvoering / Hacktivisme Makkelijk geld verdienen Weinig risico --------------------------------- + Veel gegadigden Online oorlog land tegen land Doel: schade aanrichten, spionage en onderbreken systemen. à Cyber Warfare onderdeel van strategie Hacktivisme: Organisaties tegen landen of andere organisaties. Doel: Statement of onderbreking systemen
- 79. Huidige Status
- 80. What’s Happening in Today’s Threat Landscape In the past 12 months: 52% compromised 1 to 5 times by cyber attacks Top 3 most difficult to secure (along with mobile devices, social media apps) 2014 2015 2016 56% 67% 86% % of org’s to augment/replace existing endpoint protection
- 81. Today’s Enterprises Face 3 BILLION Attacks Legacy Threats BLOCKED Advanced Threats DETECTED Advanced Threats UNDETECTED 50% 25% 25% Traditional, AV-based Protection Sandboxing Solutions “Next-Generation” Endpoint Security
- 82. Today’s Threats Easily Evade Detection by AV-based Solutions 01100111 01010110 10101010 10100101 10001010 11010011 00101101 Wrappers Designed to turn known code into a new binary Variations / Obfuscators Designed to slightly alter code to make known code appear new/different Packers Designed to make sure code runs only on a real machine (anti-VM, sleepers, interactions, anti-debug) Targeting Designed to allow code to run only on a specific target machine/configuration Malicious Code The attack code that runs with the goal of persisting, stealing, spying, or exfiltrating data
- 83. Endpoints are Vulnerable to Multiple Attack Vectors MALWARE EXPLOITS File-less • Memory-only malware Executables • Ransomware • Trojans • Worms • Backdoors Browser • Drive-by Downloads • Flash, Java • iframe/html5, plug-ins Documents • Office Doc Exploits • Adobe Macros • SpearPhishing e- mails LIVE/INSIDER Scripts • Powershell • PowerSploit • WMI, VBS Credentials • Credential Scraping • Mimikatz • Tokens
- 84. Het antwoord
- 85. Endpoint Protection Essentials FORENSICS MITIGATION REMEDIATION DYNAMIC MALWARE DETECTION DYNAMIC EXPLOIT DETECTION PREVENTION Whitelisting Blacklisting DFI
- 86. The SentinelOne Endpoint Protection Platform Dynamic Whitelisting / Blacklisting Cloud Intelligence PREVENTION DETECTION RESPONSE 360-degree Attack View Forensics Mitigation Remediation Rollback Auto-immunize Advanced Static Analysis PRE-EXECUTION POST-EXECUTIONON-EXECUTION STATIC PROTECTION DYNAMIC PROTECTION Dynamic Behavior Detection Single Autonomous Agent 70MB Memory Footprint Single Management Console Supports up to 25,000 Endpoints Cloud or On-Premise Deployment
- 87. Advanced Static Prevention § Major breakthrough in signature-less detection, based on machine learning § Deep File Inspection (DFI) engine prevents advanced malware-- on access § Supported on all endpoint platforms: Windows / MacOS / Linux § Engine supports all mitigation actions 31,000 Unique file characteristics defined and referenced Known and unknown file-based malware
- 88. Detection: Distinguishing Malicious Behavior from Benign Behavior is Complicated Benign Behavior Malicious Behavior ¹
- 89. Detection: Dynamic Behavior Tracking: A Machine Learning Approach SentinelOne Agent § Monitors all system- level activity: § System calls § Network calls § I/O transactions § Memory transactions § Builds full context of endpoint’s application behavior 001101 010100 110111 010000 101100 100101 010001 000101 110101 101010 101100 101011 110101 010110 101000 100101 011011 101001 001010 001110 001010 111011 001011 101011 011001 110101 110001 010111 001101 010100 110111 010000 101010 111010 110001 001100 000001 001110 101001 011101 101010 100111 110101 110110 101110 101101 101011 001001 111011 010101 011011 101110 110111 101010 001010 011010 110110 101100 101001 010010 100100 101010 110100 100100 100111 101101 010101 101110 111011 011110
- 90. Detection: Dynamic Behavior Tracking: A Machine Learning Approach SentinelOne Agent 101000 100101 011011 101001 001010 001110 001010 111011 001011 101011 011001 110101 110001 010111 File creates a copy of itself Opens up cmd.exe and deletes the original file Creates an autorun registry key Encrypts other files / connects to outbound network / logs keystrokes MALWARE DETECTED .exe
- 91. Response: Deep Endpoint Visibility and 360o View of Attacks Lightweight, autonomous agent ▪ Continuously monitors all user/kernel activity on the user endpoint or server, online or offline ▪ Server agents sit out-of-band, preserving performance Full-context forensics in real time ▪ 360-degree view of threats, from inception to termination
- 92. Accreditatie
- 93. Gartner Jan 2017 “SentinelOne Most Visionary” “SentinelOne is the only vendor in this analysis that includes full EDR-type functionality in the core platform. SentinelOne is a good prospect to replace or augment existing EPP solutions for any company looking for a fresh approach and integrated EDR…”
- 94. NSS Labs Jan 2017 “SentinelOne offers Best ROI”
- 95. Certified Replacement for Anti-Virus § SentinelOne outperforms and replaces traditional AV-based solutions § Lightweight, fully-autonomous agent monitors endpoints constantly § Dynamic Behavior Tracking identifies threats across all vectors– not just malware § Product excellence recognized across the IT industry
- 96. Demonstratie
- 98. Vragen
- 99. Afsluiting
- 100. Bedankt!
- 101. ICT-Partners PWA-laan 210 7311 SZ Apeldoorn T 055 528 22 22 E Connect@ict-partners.nl Hoofdweg 290 9765 CN Paterswolde T 050 364 31 02 E Connect@ict-partners.nl