Trusted Cloud
•
0 likes•211 views
Cloud Computing markedet er præget af både mange myter og mange forskellige definitioner – i sessionen gives et indblik i de overordnede elementer set fra Microsofts vinkel. Hvordan håndterer Microsoft cyberkriminalitet, beskyttelse af privacy, overholdelse af gældende lovgivning, internationale standarder etc. Der gives også gode råd om, hvad man bør overveje i sin vurdering af hvad Cloud evt kan hjælpe virksomheden med og ikke mindst hvordan man i mange tilfælde kan opnå et markant højere sikkerhedsniveau gennem implementeringen af rene eller hybride cloud løsninger.
More Related Content
What's hot
What's hot (17)
Viewers also liked
Viewers also liked (20)
Similar to Trusted Cloud
Similar to Trusted Cloud (20)
Recently uploaded
Recently uploaded (20)
Trusted Cloud
- 3. • Cloud Computing • Definitioner & eksempler • Myter, Fakta & Tillid • Microsoft principper & actions • Sikkerhed • Privatlivsbeskyttelse • Compliance (love & standarder) • Gennemsigtighed • Digital Crimes Unit
- 5. ( …med global rækkevidde & regional lagring)
- 6. STRATEGI
- 7. 1 minut på internettet 7 © Intel STRATEGI – i 2013
- 10. “Businesses and users are going to embrace technology only if they can trust it.” – Satya Nadella SIKKERHED
- 15. SIKKERHED
- 18. Cybersikkerhed & overvågning – Microsoft …. giver ikke blanco adgang til hverken egne eller kunders data udleverer ikke krypteringsnøgler og assisterer ikke myndigheder med at bryde krypteringer udleverer ikke data på baggrund af ‘bulk’ forespørgsler bruger ikke & tillader ikke bagdøre i vores software eller software vi anvender er ikke en del af nogen form for overvågnings- eller efterretnings- netværk i USA eller andre lande Øger konstant kryptering af data både i transport og i lagring & driver derudover alle vores Datacentre med bl.a. ISO27001 certificering og tjenester i overensstemmelse med ISO27018 Fortsætter juridisk arbejde. Udfordrer bl.a.lovligheden i forespørgsler med såkaldte ‘gag orders’ og brud på data suverænitet Fortsætter lovligt & reguleret efterforskningssamarbejde rettet mod pirateri, pædofili, ID tyveri etc. Øger gennemsigtigheden ved at • involvere ejeren af data som myndighed eftersp • oprette flere code Review Centers • udgive Law Enforcement Request Reports • dele guidance baseret på sikker drift udviklingserfaringer Tager initiativ til industrisamarbejde på området for at sikre bedst muligt fundament for ‘Cloud Trust’
- 20. Hvad Microsoft gør: • vore datacentre er udstyret med ‘state-of-the-art’ fysiske sikkerheds- tiltag. • vi opererer med 24x7 incident response team for at mitigere trusler og angreb. • vi krypterer data overførsler på alle niveauer både i transport og i hvile. • vi beskytter dine data med indbyggede værktøjer og giver adgang for kunder til yderligere krypteringsmuligheder hvis ønsket. Kunden kan med rette forvente: • dine data vil være beskyttet med ‘state-of- the industry’ sikkerheds- teknologi og processer. • dine data vil være krypterede i transit og I hvile. Microsoft investerer i kundens sikkerhed
- 21. Via personlige enheder 24 x 7 samarbejde På ‘vejene’ På kontoret Hjemme gennem social media Offentlige Data Interne Data Konfidentielle Data On Premise Cloud Applikationer Netværk Enheder ‘Ting’ Infrastruktur
- 22. Offentlige Data Interne Data Konfidentielle Data On-premise Cloud Applikationer Netværk Enheder ‘Ting’ Infrastruktur Via personlige enheder 24 x 7 samarbejde På ‘vejene’ På kontoret Hjemme gennem social media
- 24. Cloud drevet med operationel excellence Investeringer $15mia+ investeret til dato i cloud Infrastruktur State-of-the-art datacentre Eet af de største netværk globalt Geo-replikerede kunde data – med geo- location @rest HR siden 2,000+ medarbejdere i cloud infrastruktur 30,000+ software udviklere og supportere involverede i Cloud-baserede aktiviteter Sepererer fx. HW & SW support for at fjerne ‘2-man collaborations’ trussel Office 365 Windows Azure Intune & CRM SIKKERHED
- 25. Lockbox procedure Microsoft Engineer Microsoft Manager Microsoft Approval Microsoft EngineerLockbox system Submits request Revisionslogs for al adgang Just-in-time adgang med begrænset varighed Fastsat Scope, ‘least privileged’ adgang
- 26. Customer Lockbox Nu udvider vi Lockbox godkendelsen til kunden for at kontrollere adgang til kundens data Microsoft Engineer Microsoft Manager Microsoft Approved Lockbox system Submits request 100101 011010 100011 Kunde godkendt Kunde Kunden kontrollerer autorisation af Microsoft personales adgang
- 27. Microsoft beskytter kunders data privacy Hvad Microsoft gør: • giver fleksibilitet, valgfrihed og transparens omkring hvor data lagres. • vi bruger ikke kundens data til salg af reklame eller andre kommercielle formål. • Vi vil ikke dele kundens data med 3. part uden kundens accept eller når påkrævet af loven. • Vi stiller en række værktøjer til data adgang til rådighed for kunden. • Vi sletter data <180 dage efter at kundens abonnement afsluttes. Kunden kan med rette forvente: • At have kontrol med hvem der har adgang til dine data. • Lock box controller kræver kundens godkendelse for at Microsoft personale og evt, underleverandører kan tilgå. • at kunne slette og/eller tage sine data med I tilfælde af at man forlader tjenesten.
- 28. “Many of our customers have serious concerns about government surveillance of the Internet. We share their concerns. That’s why we are taking steps to ensure governments use legal process rather than technological brute force to access customer data.” Brad Smith General Counsel, EVP Legal and Corporate Affairs Microsoft
- 29. PRIVACY
- 30. Vi er & VIL være på forkant med compliance Hvad Microsoft gør: • Vi er ledende i industrien I at forfølge compliance med de seneste standarder for data privacy og security, som fx. ISO 27018. • Vi gennemgår uafhængige audits for at certificere vores compliance. • Vi arbejder med kunder og regulators for at hjælpe dem med at overholde deres compliance krav. Kunden kan med rette forvente: • At vi muliggør deres compliance ved at implementere og overholde relevante internationale standarder, certificeringer og relevant regulering. • At man kan få adgang til certification beviser for hver Microsoft service.
- 31. Første Cloud Standard Uddybning i officielt dokument via dette link!
- 32. Fuld gennemsigtighed Hvad Microsoft gør: • Vi stiller læsbare, forståelige og strenge policy for hvad vi gør— og IKKE gør—med jeres data. • Når vi håndterer ‘law enforcement’ forespørgsler, sker det under hensyn til dine rettigheder og generel privacybeskyttelse og vi sikrer at process følger retsikkerheds- principper. • For hver af vore services, giver vi dig information om hvor dine data lagres og behandles. Kunden kan med rette forvente: • At man har en klar, plain- language forklaring af hvordan Microsoft håndterer og beskytter din organisation’s data. • At Microsoft vil være transparente omkring law enforcement forespørgsler.
- 34. Gennemsigtighed for den enkelte kunde
- 35. Country Cloud Service Provider Cloud Regional Cloud Unique CloudCustomer Cloud Deployed på resource hos kunden selv, med Microsoft produkter og teknologier Kunden selv Microsoft Partner Deployed på Microsoft public cloud ressourcer på lande- specifike lokationer for at tilfredsstille lokale krav om data tilhør/lagring Deployed på dedikerede ressourcer hosted og drevet af en Microsoft partner; tilbyder en højere grad af mulig customisering for at imødekomme specifikke krav Deployed på Microsoft’s globale/regionale ressourcer, muliggør hurtig skallering, automatiseret software updateringer, og forbrugs- baseret afregning. Sjældnere, ikke-standard deployment af Microsoft cloud ressourcer som overholder unikke krav i enkelte markeder. Deployed i meget begrænsede tilfælde Holland (Middenmeer) og Irland (Dublin) Microsoft Cloud leveret fra Datacentre i UK Microsoft Cloud med en Tysk Data Trustee (Deutsche Telecom) Microsoft Cloud platform tilbyder flere valgmuligheder Adresserer unikke nationale, geografiske, industri og kundespecifikke muligheder. Microsoft Confidential
- 38. DCU Botnet Takedowns og Malware Disruption b49 Waledac February 2010 First MS takedown operation, proving the model of industry-led efforts Disconnected70,000- 90,000 infected devices from the botnet Botnet Worm sending SPAM (1,5B ) b107 Rustock March 2011 Supported by stakeholders across industry sectors Involved US and Dutch law enforcement, and CN-CERT SPAM, in average 192 spam messages per compromised machine per minute b79 Kelihos September 2011 Partnership between Microsoft and security software vendors First operation with named defendant SPAM, Bitcoin Mining, Distributed Denial of Service Attacks b71 Zeus March 2012 Cross-sector partnership with financial services Focused on disruption because of technical complexity Identity Theft / Financial Fraud b70 Nitol b58 Bamital b54 Citadel September 2012 Nitol was introduced in the supply chain relied on by Chinese consumers Settled with operator of malicious domain Malware Spreading, Distributed Denial of Service Attacks February 2013 Bamital hijacked people’s search results, took victims to dangerous sites Takedown in collaboration with Symantec, proactive notification and cleanup process Advertising Click Fraud June 2013 Citadel committed online financial fraud responsible for more than $500Min losses Coordinated disruption with public-private sector Identity Theft / Financial Fraud b68 ZeroAccess December 2013 ZeroAccess hijacked search results, taking victims to dangerous sites It cost online advertisers upwards of $2.7 million each month Advertising Click Fraud b157 Game over Zeus June 2014 Malware using Dynamic DNS for command. It involved password and identity theft, webcam, etc. Over 200 different types of malware impacted. Identity Theft / Financial Fraud / Privacy Invasion b106 Bladabindi & Jenxcus June 2014 GameoverZeus (GOZ) was a banking Trojan Worked in partnership with LE providing Technical Remediation Identity Theft / Financial Fraud b93 Caphaw July 2014 Caphaw was focused on online financial fraud responsible for more than $250M in losses Coordinated disruption with public-private sector Identity Theft / Financial Fraud Conficker February 2010 Microsoft-lead model of industry-wide efforts to counter the threat Botnet Worm sending SPAM andattempting to steal confidential data and passwords b75 Ramnit February 2015 Module-based malware, stealing credential information from banking websites. Configured to hide itself. Credential Information Theft/Disable Security Defenses b46 Simda April 2015 Theft of personal details, including banking passwords, as well as to install and spread other malicious malware. Theft personal data/Install and spread other malware
- 40. Microsoft PhotoDNA • Skaber digital signatur af de værste kendte børnepornografiske billeder • Kan digitalt lokalisere disse billeder mellem millioner online • Deles med myndigheder og gratis licensieret til over 50 organisationer • Industri standard – bruges fx af Facebook, Twitter, Google
- 41. Microsoft Confidential Microsoft Telefon SCAM - modkampagne
- 45. Overvejelser man bør have …… ved valg af cloud løsning & leverandør Afkræv gennemsigtighed i sikkerheds-policy og driftsprocedurer Sikre en klar forståelse for sikkerheds, privacy og compliance- roller og ansvar for de leverede tjenester Sikre at data og den enkelte tjeneste kan bringes tilbage in-house om nødvendigt Kend klassifikation af dine data, processer og de sikkerheds og compliance krav som de er underlagt Overvej leverandørens mulighed for håndtering af fremtidige ændringer i sikkerheds- og compliance krav Kræve at leverandør har 3.parts certificeringer og revision, fx., ISO/IEC 27001:2005
- 46. 10 gode skridt til vurdering af & udnyttelse af cloud: Fem interne …. 1. Kend dine data, deres klassifikation og gennemfør (simpel) Privacy Impact Assessment og risikoanalyse? 2. Start så med et simplere workload – backup, arkiv, CRM, Office, Disaster Recovery etc. 3. Se derefter på din kerneforretning og overvej en strategi for at cloud kan hjælpe med at gøre det billigere, hurtigere, mere fleksibelt, bedre? 4. Se endelig på dine vækstplaner og hvordan CC kan hjælpe dig nå nye markeder o.lign.? 5. Har du processer eller transaktioner som matcher nogle af de klassiske forbrugsmønstre? Og fem eksterne rettet mod din cloud service provider 6. Er din CSP transparent omkring drift, certificeringer, kontraktuelle forpligtelser etc. 7. Hvordan håndterer din CSP incidents og henvendelser fra myndigheder? 8. Hvordan behandles personfølsomme data? 9. Hvordan ser økosystemet omkring din CSP ud – er der et (stort nok) udbud af partnere som kan hjælpe med implementering, videreudvikling og optimering 10. Gå all-in! CC er fremtiden og tilbyder dig både top & bund-linie fordele, samt et mere omstillingsparat IT miljø. Kan din CSP hjælpe dig med at gøre det, før dine (nye) konkurrenter det?
- 47. Microsoft Trusted Cloud Ufravigelige principper Sikkerhed by Design Privacy by Design Compliance Gennemsigtighed På tværs af platforme Vi er tilstede på alle platforme Kundecases 25år+ erfaring med globale intensive cloud tjenester Private & offentlige cases indenfor alle ‘domæner’ og i alle geografier 24x7 Udvikler konstant på vores anvendelse af krypteringsteknologier, processer etc. for at imødegå trusler Red Teaming Operational Excellence @Scale Digital Crimes Unit Compliance & Gennemsigtighed ALTID fuldt på højde med nyeste standarder og strengeste lovgivning OG vi udfordrer myndigheder Globalt! OPSUMMERING
- 48. Ekstra ressourcer http://aka.ms/danmark-skyen Microsoft Datacenters Web Site & Team Blogs microsoft.com/datacenters Data Governance: http://bit.ly/MSDataGovernance CSAMatrix: http://bit.ly/CSAMatrix Windows Azure Trust Center windowsazure.com/trustcenter Office 365 Trust Center trustoffice365.com/ Cloud Jura Overblik http://bit.ly/CloudJuraOverblik Online Academy http://bit.ly/w10_sikkerhed
- 49. MICROSOFT ER FULDT ENGAGERET I DATA PRIVACY & SIKKERHED Cybersikkerhed Privacy Compliance Gennemsigtighed Samfundsansvar Risikostyring Governance OPSUMMERING
- 51. Overførsel af persondata ud af EU/EEA http://export.gov/safeharbor/ Overførsel af PII kun til lande der sikrer tilstrækkelig data beskyttelse ifht loven under data beskyttelsesdirektivet A model agreement to be agreed between a data controller in EU/EEA and a data processor outside of EU/EEA No Danish law requirement to notify to the DPA http://www.datatilsynet.dk/nyheder/seneste-nyheder/artikel/naermere-orientering-fra-datatilsynet-om-safe-harbor-dommen/ http://blogs.microsoft.com/on-the-issues/2015/10/06/a-message-to-our-customers-about-eu-us-safe-harbor/ http://europa.eu/rapid/press-release_IP-16-216_en.htm?utm_content=buffer32bdb&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer
- 52. THE COURT (GRAND CHAMBER) HEREBY RULES: 1. Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data as amended by Regulation (EC) No 1882/2003 of the European Parliament and of the Council of 29 September 2003, read in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a decision adopted pursuant to that provision, such as Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46 on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce, by which the European Commission finds that a third country ensures an adequate level of protection, does not prevent a supervisory authority of a Member State, within the meaning of Article 28 of that directive as amended, from examining the claim of a person concerning the protection of his rights and freedoms in regard to the processing of personal data relating to him which has been transferred from a Member State to that third country when that person contends that the law and practices in force in the third country do not ensure an adequate level of protection. 2. Decision 2000/520 is invalid. SOURCE: INFOCURIA - JURISPRUDENTIE VAN HET HOF VAN JUSTITIE; HTTP://CURIA.EUROPA.EU/JURIS/DOCUMENTS.JSF?NUM=C-362/14
- 53. Om dataoverførsler mens Safe Harbour aftalen er erklæret ugyldig: “In the meantime, transatlantic data flows between companies CAN CONTINUE USING OTHER MECHANISMS for international transfers of personal data available under EU data protection law.” EU First Vice-President Timmermans Commissioner Jourová
- 57. Sikkerhedsdesign og drift Microsoft fastholder sikkerhed som en prioritet i hvert skridt fra design, over udvikling & drift, frem til incident håndtering. Security Development Lifecycle (SDL) Company-wide, mandatory development process that embeds security into every phase of development process. Assume breach simulation Dedicated security expert “red team” that simulate real-world attacks at network, platform, and application layers, testing the ability of Azure to detect, protect against, and recover from breaches. Global, 24x7 incident response service that works to mitigate the effects of attacks and malicious activity. Incident response 58 SIKKERHED
- 58. Data protection Microsoft Cloud provides customers with strong data protections – both by default and as customer options 59 Data isolation Logical isolation segregates each customer’s data from that of others is enabled by default. In-transit data protection Industry-standard protocols encrypt data in transit to/from outside components, as well as data in transit internally by default. Data redundancy Customers have multiple options for replicating data, including number of copies and number and location of replication data centers. At-rest data protection Customers can implement a range of encryption options for virtual machines and storage. Encryption Data encryption in storage or in transit can be deployed by the customer to align with best practices for ensuring confidentiality and integrity of data. Data destruction Strict standards for overwriting storage resources before reuse and the physical destruction of decommissioned hardware are by default.
- 59. Adgangskontroler verificeres af uafhængig revision og certificering. Restriktioner på dataadgang 60 Kundedata tilgåes kun når nødvendigt for at gennemfør kundeinitieret support på tjenesten, eller hvis krævet af lovgivning. Når adgang gives, sker det kontrolleret og med fuldt logningsspor som er tilgængeligt for dataejeren. Stærk authentication, inclusive MFA, hjælper med at begrænse adgangen til ‘kun’ at være for det autoriserede personale. Adgang tildeles fra ‘Zero-Standing’ og fjernes så snart den ikke længere er nødvendig – INGEN stående admin adgang udenfor kundens kontrol. PRIVACY
- 60. ISO/IEC 27018 Prevents use of customer data for purposes unrelated to providing the cloud service. Prohibits use of customer data for advertising and marketing purposes without customer’s express consent. Microsoft is the first major cloud provider to adopt the first international code of practice for governing the processing of personal information by cloud service providers. 61
- 62. Datacenter evolution Server Kapacitet 20årsTeknologi 2.0+PUE Co-lokation Generation 1 Tæthed Rack Density&Deployment Minimérressourceforbrug 1.4–1.6PUE Generation 2 201220091989-2005 2007 Inddæmning 1.2–1.5PUE Containere,PODs Skallerbarhed &Økonomi Sustainability(luft&vand) DifferentieredeSLA’er Generation 3 Modular 1.12–1.20PUE ITPACs&Co-lokationer ReduceretCarbon Right-Sized KortereTime-to-Market Køletmedluftudefra Generation 4 Integreret 1.07–1.19PUE IntegreretSystem ModstandsdygtigSoftware Fællesinfrastruktur Operationelsimplicitet Fleksibelt&Skallerbart Generation 5 Fremtidig
- 64. One converged Windows platform
- 65. Protection against modern security threats
- 66. Hardware based security for better malware protection. Secure Boot Enterprise credential protection via hardware-based isolation Secure corporate identity to protect against modern threats. Microsoft Passport Windows Hello Protect your corporate data, wherever the data is. Enterprise data protection Eliminate malware on your devices. Device Guard More secure per-app connection for mobile workers. Secure Remote Connection
- 67. Be more productive An experience users will love
- 68. A familiar user experience that adapts to your device. Start menu Continuum Continuum for Phone Apps that can run on any Windows device. Windows Universal Apps The best productivity experience across all Windows devices. Office for Windows Modernize your web experience, stay compatible. Microsoft Edge Internet Explorer 11
- 69. Innovative devices for your business
- 70. Latest Windows innovations on your existing PC fleet. Great mouse & keyboard support Hardware compatibility Granular UX Control Choose from the range of innovative Windows devices. Broad industry innovation 2-in-1 devices Surface Lumia Redefine productivity with revolutionary Windows devices. Surface Hub HoloLens
- 71. Private, secure social network for your business Inline social experiences across Office makes posting updates, docs, and emails easy SharePoint-based file storage provides a single place to manage your content INTEGRATED SOCIAL NETWORKING
- 72. Groups help users collaborate more effectively by providing a shared inbox, calendar, document library, site, and Yammer feed Public Groups enable users to discover new information and meet new people within their organization Membership for Groups is integrated across Exchange, SharePoint, and Yammer to deliver a unified collaboration experience GROUPS
- 73. Collaborate on Office documents in real time Get started with file, sync and share in the cloud quickly and easily Securely store, sync, and share work files from any device or platform ONE DRIVE FOR BUSINESS
- 74. Create, manage, and subscribe to various channels Secure cloud based video upload, storage and optimized playback Capture, share, and discover videos from any device OFFICE 365 VIDEO
- 76. Apps designed specifically for touch-first use on tablets and phones Familiar, consistent experience across phone, tablet, and desktop On-the-go document review, creation, and collaboration Document fidelity remains priority OFFICE ACROSS DEVICES
- 77. Seamless integration with Office 365, OneDrive and SharePoint Similar look & feel of Office on Windows New & improved features for easy collaboration OFFICE FOR THE MAC
- 79. Discover new information tailored to you from your network Stay connected and informed on topics that matter the most A natural new way to navigate, discover, and search across your organization OFFICE GRAPH
- 80. Insights derived from each users behavior, their relationships to content, topics and one-another. Smart connections between people, content and conversations across Office An extensible intelligence fabric that delivers a new era of information experiences DELVE
- 81. Search and connectivity to public and corporate data all within Excel Filter, shape, and merge queries from multiple data sources BI FOR EVERYONE
- 82. Add predictive analytics to your reports for forecasting and population plotting Interactively visualize data to uncover insights & share in the cloud Access touch-first reports across devices, anywhere for Mobile BI VISUALIZATION & MOBILITY
- 84. Improved Compliance Customer controls expanding these technologies across various services (Archiving, Auditing, Data Loss Prevention, E-discovery) Authenticated customer-specific Customer Trust Center TRUST CENTER Access to Office 365 compliance controls and customer dashboard for compliance View customer-relevant reports – ISO, SOC Audit reports, notifications about updates, regulatory changes, etc.
- 85. Advanced encryption with RMS helps to improve security Office 365 provides built-in capabilities and customer controls CONTROL ON YOUR TERMS
- 86. All compliance tasks in one place Built into Exchange and SharePoint in the cloud or on-premises COMPLIANCE CENTER
- 87. In-Place Hold: protect content in-place in real time Query: find up to date and relevant content quickly Export: transfer content for review and production eDISCOVERY Across: SharePoint, Exchange, Lync, and file shares on-premises and Office 365
- 88. New security features like DLP Policy Tips Greatly enhanced security capabilities DATA LOSS PREVENTION
- 89. S/MIME Encryption (Q1 CY 2014) Uses client side encryption keys Office 365 Messaging Encryption; send secure, encrypted emails to anyone! ENCRYPTION Strengthening encryption to protect your data; data encrypted at rest and in motion Security Risk Scenarios Risk Mitigation Technology Rogue Admin RMS, BitLocker Data Loss Prevention (DLP) DLP Policies Stolen/Lost Laptop BitLocker Stolen/Lost Mobile Device BitLocker, Mobile Device Management Send encrypted email outside the organization Office 365 Message Encryption B2B S/MIME