Downloaded 14 times
Uploaded byВалерий Коржов
презентация по услугам
Документ описывает комплексные услуги и решения в области информационной безопасности (ИБ), акцентируя внимание на современных технологиях и тенденциях, таких как облачные сервисы и интернет вещей. Он также подчеркивает необходимость интеграции стратегии ИБ в бизнес-стратегию клиентов для повышения эффективности и снижения рисков. Основной акцент сделан на проактивном подходе к управлению информационной безопасностью и удовлетворению новых потребностей бизнеса.
презентация по услугам
- 1. Автор должность Услугии решения по обеспечению комплексной системы ИБ Название мероприятия
- 2. Контекст, в котором работает служба ИБ
- 3. Требования со стороныбизнеса The Ernst & Young Business Risk Report 2010 « The top 10 risk for business »
- 4. Новые технологические трендыРасширение применения планшетов Изменение интерфейса приложений для работы с мобильных устройств Учет поведения пользователей в Internet и в социальных сетях « Internet of Things » App Stores и Marketplaces как новая модель продаж Бизнес-аналитика нового поколения, способная работать с разными форматами данных (графика, голос, видео, …) Big Data как новая технология управления данными Встраивание процессоров в флэш-память для переноса части приложения в нее Революционное снижение энергопотребления серверов «Облака» Gartner « The Top 10 Strategic Technologies for 201 2»
- 5.
- 6.
- 7.
- 8. Выводы Обеспечение снижениярисков бизнеса Повышение эффективности работы службы ИБ Своевременное реагирование на появление новых технологий, способствующих развитию бизнеса и поддержка их безопасного использования Перевод корпоративной ИБ на сервисную модель с гарантированным качеством облуживания Адекватное реагирование на появление новых угроз В современных условиях служба ИБ должна обеспечить решение нескольких связанных задач:
- 9.
- 10. Миссия компании Мыобеспечиваем своим клиентам безопасное ведение бизнеса с использованием преимуществ современных информационных технологий
- 11. «Традиционный» набор услугОценка защищенности Аудит на соответствие требованиям регуляторов Анализ рисков ИБ и разработка планов обработки рисков Разработка корпоративных стандартов и политик ИБ Построение и внедрение процессов СУИБ Проектирование и внедрение подсистем ИБ Внедрение средств защиты Сопровождение
- 12. Полный охват проблематикиИБ Обеспечение безопасности бизнеса за счет выстраивания оптимальных взаимосвязей всех компонентов ИБ: Политика безопасности ( Security policy) Организация информационной безопасности ( Organization of information security) Управление ресурсами ( Asset management) Безопасность персонала ( Human resources security) Физическая безопасность и безопасность окружения ( Physical and environmental security) Управление коммуникациями и операциями ( Communications and operations management) Управление доступом ( Access control) Приобретение, разработка и поддержка систем ( Information systems acquisition, development and maintenance) Управление инцидентами информационной безопасности ( Information security incident management) Управление бесперебойной работой организации ( Business continuity management) Соответствие нормативным требованиям ( Compliance)
- 13. Применение современных технологийИБ Опыт интеграции и внедрения большого числа технологий ИБ: контроль доступа к информационным ресурсам межсетевое экранирование и VPN обнаружение вторжений и анализ защищенности антивирусная защита защита базы данных защита почтовых систем защита web -приложений защита виртуальных сред контроль доступа к сетевой среде сбор, обработка и хранение событий ИБ управление учетными записями ( IDM ) инфраструктуры открытых ключей (ИОК) однократная регистрация пользователей в приложениях (SSO) управление электронными правами (IRM)
- 14. Широкая отраслевая экспертизаОпыт работы с крупнейшими заказчиками: Государственные организации Финансовые организации Нефтегазовые компании Телекоммуникационные компании Предприятия ТЭК Промышленность Транспорт Более 2500 клиентов
- 15. Бизнес-ориентированный подход Построениестратегии ИБ на основе бизнес-стратегии заказчика: Изучение бизнес-стратегии заказчика и определение таких областей, где изменение в ИБ может принести дополнительные плюсы для бизнес-стратегии заказчика Помощь заказчику во встраивании стратегии ИБ в ИТ-стратегию и бизнес-стратегию Идентификация ключевых проблем в существующей системе ИБ и представление рекомендаций по их устранению Построении бизнес-плана по развитию ИБ заказчика, включающего основные направления по улучшению и приоритезированный перечень проектов, обеспечивающих максимально эффективное достижение требований бизнес-стратегии Проактивное участие ИБ в продвижении новых сервисов и возможностей для бизнеса Построение систем ИБ заказчиков на основе лучших практик и рекомендаций стандартов ( ISO 2700X, PCI DSS, СТО БР)
- 16. Проактивный подход Постояннаяработа с клиентами для своевременной идентификации новых потребностей бизнеса Обеспечение поступательного развития корпоративных систем ИБ для максимального соответствия текущим и ближайшим потребностям Непрерывный процесс R&D для своевременного выявления и проработки новых технологий Регулярное обновление предложения (продуктов и услуг)
- 17. Планомерное повышение зрелостиИБ Целостная архитектура ИБ Поддержка новых технологий и сервисов ИТ Управление соответствием требованиям регуляторов Измерение эффективности ИБ и непрерывное улучшение Рост зрелости ИБ компании Возможности системы ИБ
- 18. Основные группы новыхуслуг Защита бизнеса Защита от внутреннего мошенничества Защита бизнес-систем Защита АСУ ТП Обеспечение поддержки бизнес-инициатив Стратегическое развитие систем ИБ Оценка уровня зрелости Долгосрочное планирование развития Обеспечение безопасного использования новых технологий Безопасность облачных технологий Безопасность мобильных устройств Облачные сервисы ИБ
- 19.
Editor's Notes
- #4 Общие риски бизнеса определяют общие требования к ИТ и ИБ
- #5 Gartner, Inc. today highlighted the top 10 technologies and trends that will be strategic for most organizations in 2012. The analysts presented their findings during Gartner Symposium/ITxpo, being held here through October 20. Gartner defines a strategic technology as one with the potential for significant impact on the enterprise in the next three years. Factors that denote significant impact include a high potential for disruption to IT or the business, the need for a major dollar investment, or the risk of being late to adopt. A strategic technology may be an existing technology that has matured and/or become suitable for a wider range of uses. It may also be an emerging technology that offers an opportunity for strategic business advantage for early adopters or with potential for significant market disruption in the next five years. These technologies impact the organization's long-term plans, programs and initiatives. The top 10 strategic technologies for 2012 include: Media Tablets and Beyond. Users can choose between various form factors when it comes to mobile computing. No single platform, form factor or technology will dominate and companies should expect to manage a diverse environment with two to four intelligent clients through 2015. IT leaders need a managed diversity program to address multiple form factors, as well as employees bringing their own smartphones and tablet devices into the workplace. Enterprises will have to come up with two mobile strategies – one to address the business to employee (B2E) scenario and one to address the business to consumer (B2C) scenario. On the B2E front, IT must consider social goals, business goals, financial goals, and risk management goals. On the B2C front, which includes business to business (B2B) activities to support consumers, IT needs to address a number of additional issues such as surfacing and managing APIs to access enterprise information and systems, integration with third-party applications, integration with various partners for capabilities such as search and social networking, and delivery through app stores. Mobile-Centric Applications and Interfaces . The user interface (IU) paradigm in place for more than 20 years is changing. UIs with windows, icons, menus, and pointers will be replaced by mobile-centric interfaces emphasizing touch, gesture, search, voice and video. Applications themselves are likely to shift to more focused and simple apps that can be assembled into more complex solutions. These changes will drive the need for new user interface design skills. Building application user interfaces that span a variety of device types, potentially from many vendors, requires an understanding of fragmented building blocks and an adaptable programming structure that assembles them into optimized content for each device. Mobile consumer application platform tools and mobile enterprise platform tools are emerging to make it easier to develop in this cross-platform environment. HTML5 will also provide a long term model to address some of the cross-platform issues. By 2015, mobile Web technologies will have advanced sufficiently, so that half the applications that would be written as native apps in 2011 will instead be delivered as Web apps. Contextual and Social User Experience . Context-aware computing uses information about an end-user or objects environment, activities, connections and preferences to improve the quality of interaction with that end-user or object. A contextually aware system anticipates the user’s needs and proactively serves up the most appropriate and customized content, product or service. Context can be used to link mobile, social, location, payment and commerce. It can help build skills in augmented reality, model-driven security and ensemble applications. Through 2013, context aware applications will appear in targeted areas such as location-based services, augmented reality on mobile devices, and mobile commerce. On the social front, the interfaces for applications are taking on the characteristics of social networks. Social information is also becoming a key source of contextual information to enhance delivery of search results or the operation of applications. Internet of Things . The Internet of Things (IoT) is a concept that describes how the Internet will expand as sensors and intelligence are added to physical items such as consumer devices or physical assets and these objects are connected to the Internet. The vision and concept have existed for years, however, there has been an acceleration in the number and types of things that are being connected and in the technologies for identifying, sensing and communicating. These technologies are reaching critical mass and an economic tipping point over the next few years. Key elements of the IoT include: Embedded sensors: Sensors that detect and communicate changes are being embedded, not just in mobile devices, but in an increasing number of places and objects. Image Recognition: Image recognition technologies strive to identify objects, people, buildings, places logos, and anything else that has value to consumers and enterprises. Smartphones and tablets equipped with cameras have pushed this technology from mainly industrial applications to broad consumer and enterprise applications. Near Field Communication (NFC) payment: NFC allows users to make payments by waving their mobile phone in front of a compatible reader. Once NFC is embedded in a critical mass of phones for payment, industries such as public transportation, airlines, retail and healthcare can explore other areas in which NFC technology can improve efficiency and customer service. App Stores and Marketplaces. Application stores by Apple and Android provide marketplaces where hundreds of thousands of applications are available to mobile users. Gartner forecasts that by 2014, there will be more than 70 billion mobile application downloads from app stores every year. This will grow from a consumer-only phenomena to an enterprise focus. With enterprise app stores, the role of IT shifts from that of a centralized planner to a market manager providing governance and brokerage services to users and potentially an ecosystem to support entrepreneurs. Enterprises should use a managed diversity approach to focus on app store efforts and segment apps by risk and value. Next-Generation Analytics. Analytics is growing along three key dimensions: From traditional offline analytics to in-line embedded analytics. This has been the focus for many efforts in the past and will continue to be an important focus for analytics. From analyzing historical data to explain what happened to analyzing historical and real-time data from multiple systems to simulate and predict the future. Over the next three years, analytics will mature along a third dimension, from structured and simple data analyzed by individuals to analysis of complex information of many types (text, video, etc…) from many systems supporting a collaborative decision process that brings multiple people together to analyze, brainstorm and make decisions. Analytics is also beginning to shift to the cloud and exploit cloud resources for high performance and grid computing. In 2011 and 2012, analytics will increasingly focus on decisions and collaboration. The new step is to provide simulation, prediction, optimization and other analytics, not simply information, to empower even more decision flexibility at the time and place of every business process action. Big Data . The size, complexity of formats and speed of delivery exceeds the capabilities of traditional data management technologies; it requires the use of new or exotic technologies simply to manage the volume alone. Many new technologies are emerging, with the potential to be disruptive (e.g., in-memory DBMS). Analytics has become a major driving application for data warehousing, with the use of MapReduce outside and inside the DBMS, and the use of self-service data marts. One major implication of big data is that in the future users will not be able to put all useful information into a single data warehouse. Logical data warehouses bringing together information from multiple sources as needed will replace the single data warehouse model. In-Memory Computing. Gartner sees huge use of flash memory in consumer devices, entertainment equipment and other embedded IT systems. In addition, it offers a new layer of the memory hierarchy in servers that has key advantages — space, heat, performance and ruggedness among them. Besides delivering a new storage tier, the availability of large amounts of memory is driving new application models. In-memory applications platforms include in-memory analytics, event processing platforms, in-memory application servers, in-memory data management and in-memory messaging. Running existing applications in-memory or refactoring these applications to exploit in-memory approaches can result in improved transactional application performance and scalability, lower latency (less than one microsecond) application messaging, dramatically faster batch execution and faster response time in analytical applications. As cost and availability of memory intensive hardware platforms reach tipping points in 2012 and 2013, the in-memory approach will enter the mainstream. Extreme Low-Energy Servers. The adoption of low-energy servers — the radical new systems being proposed, announced and marketed by mostly new entrants to the server business —will take the buyer on a trip backward in time. These systems are built on low-power processors typically used in mobile devices. The potential advantage is delivering 30 times or more processors in a particular server unit with lower power consumption vs. current server approaches. The new approach is well suited for certain non-compute intensive tasks such as map/reduce workloads or delivery of static objects to a website. However, most applications will require more processing power, and the low-energy server model potentially increases management costs, undercutting broader use of the approach. Cloud Computing. Cloud is a disruptive force and has the potential for broad long-term impact in most industries. While the market remains in its early stages in 2011 and 2012, it will see the full range of large enterprise providers fully engaged in delivering a range of offerings to build cloud environments and deliver cloud services. Oracle, IBM and SAP all have major initiatives to deliver a broader range of cloud services over the next two years. As Microsoft continues to expand its cloud offering, and these traditional enterprise players expand offerings, users will see competition heat up and enterprise-level cloud services increase. Enterprises are moving from trying to understand the cloud to making decisions on selected workloads to implement on cloud services and where they need to build out private clouds. Hybrid cloud computing which brings together external public cloud services and internal private cloud services, as well as the capabilities to secure, manage and govern the entire cloud spectrum will be a major focus for 2012. From a security perspective new certification programs including FedRAMP and CAMM will be ready for initial trial, setting the stage for more secure cloud computing. On the private cloud front, IT will be challenged to bring operations and development groups closer together using “DevOps” concepts in order to approach the speed and efficiencies of public cloud service providers.
- #6 ИТ отходят от модели зрелости, предложенной в COBIT , которая до сих пор используется ИБ. Они уже говорят в терминах бизнеса.
- #7 Сервисный подход в ИТ требует пересмотра подходов к ИБ
- #8 Новые угрозы для бизнеса требуют адекватного реагирования на них со стороны ИБ