Datenzentrierte Sicherheit

Transkript

1 Datenzentrierte Sicherheit Raus aus der PKI Sackgasse - Data Centric Encryption macht echte end-to-end Security erst möglich Peter Hansel Rolf Wichter bizcon AG 1stmarkets GmbH Peter.Hansel@bizcon.de rolfw@1stmarkets.com it-sa Nürnberg, 20. Oktober 2016

2 Fünf innovative Technologien Format Preserving Encryption (FPE), Secure Stateless Tokenization (SST), Identity Based Encryption (IBE), Page Integrated Encryption (PIE) und Stateless Key Management

3 Probleme bei traditionellem Datenschutz und -verschlüsselung Notwendigkeit Datenstrukturen und Applikationen zu ändern? Vollständig verschlüsselte Daten sind unbenutzbar wenn sie verschlüsselt sind AES 8juYE%Uks&dDFa2345^WFLERG Ija&3k24kQotugDF2390^320OWioNu2(*872weWaasIUahjw2%quiFIBw3tug^5a Key management ist schwierig Erfordert viele, fragmentierte Lösungen und erzeugt so weitere Sicherheitslücken

4 Vorteile der HPE SecureData Lösung Minimale Änderungen an Datenstrukturen und Applikationen? AES Geschützte Daten verhalten versus sich in Applikationen und Analysen sinnvoll 8juYE%Uks&dDFa2345^WFLE Ija&3k24kQotugDF2390^320OWioNu2(*872weWaasIUahjw2%quiFIBw3tug^5a RG Vereinfachter Betrieb mit Stateless Key Management versus Name SS# Salary Address Enroll Date 2890 Ykzbpoi Kwfdv Cqvzgk Clpppn, CA 10/17/2005 End-to-end Security mit einem konsistenten Preserve format, versus structure and behavior Data Protection Framework Policy controlled, dynamically generated Keys Key Database FPE

5 Data security coverage End-to-end Protection Data-centric Encryption und End-to-End Security Threats to Data Traditional IT Infrastructure Security Data Ecosystem Security Gaps HPE SecureData Data-centric Security Credential Compromise Authentication Management Data and applications Security gap Traffic Interceptors SSL/TLS/ firewalls Middleware Security gap SQL injection, Malware Database encryption Databases Security gap Malware, Insiders SSL/TLS/ firewalls File systems Security gap Malware, Insiders Disk encryption Storage 5 5

6 Datenzentrierte Sicherheit Was bietet FPE? Neue Antworten auf aktuelle Bedrohungen: Format preserving encryption (FPE) - Format-erhaltende Verschlüsselung Peter Hansel, bizcon AG

7 HPE Format-Preserving Encryption (FPE) Tax ID FPE First Name Gunther Last Name Robertson SSN DOB First Name Uywjlqo Last Name: Muwruwwbp SSN DOB AES 8juYE%Uks&dDFa2345^WFLERG Ija&3k24kQotugDF2390^32 0OWioNu2(*872weW Unterstützung für Daten beliebiger Formate (name, address, dates, numbers, etc.) Beibehaltung der referentiellen Integrität Minimale Änderungen in bestimmten Applikationen notwendig Schützt die Produktivdaten und ermöglicht Datenmaskierung (z.b. Testdaten) 7

8 Vorher Alle Applikationen und Anwender haben Zugriff auf die Daten HR Application ETL Tool Mainframe App Malware Name SS# Credit Card # Street Address Customer ID State Score James Potter Farland Avenue G NY 100 Ryan Johnson Grant Street S NY 200 Carrie Young Cambridge Court B CA 120 Brent Warner Middleville Road G CA 120 Anna Berman Hamilton Drive S KY 160 Analysts Help Desk DBAs Malicious User 8

9 Nachher Sensible Daten sind bereits in der Quelle auf Feldebene geschützt HR Application ETL Tool Payments App Malware Name SS# Credit Card # Street Address Customer ID State Score Kwfdv Cqvzgk Ykzbpoi Clpppn G NY 100 Veks Iounrfo Cmxto Osfalu S NY 200 Pdnme Wntob Zejojtbbx Pqkag B CA 120 Eskfw Gzhqlv Saicbmeayqw Yotv G CA 120 Jsfk Tbluhm Wbbhalhs Ueyzg S KY 160 Analysts Help Desk DBAs Malicious User 9

10 Malicious Users, DBAs und Malware Sehen nur die geschützten Daten Malware Name SS# Credit Card # Street Address Customer ID State Score Kwfdv Cqvzgk Ykzbpoi Clpppn G NY 100 Veks Iounrfo Cmxto Osfalu S NY 200 Pdnme Wntob Zejojtbbx Pqkag B CA 120 Eskfw Gzhqlv Saicbmeayqw Yotv G CA 120 Jsfk Tbluhm Wbbhalhs Ueyzg S KY 160 DBAs Malicious User 10

11 Help Desk und Payment Applikationen Arbeiten mit teilverschlüsselten Daten Payments App Name SS# Credit Card # Street Address Customer ID State Score Kwfdv Cqvzgk Ykzbpoi Clpppn G NY 100 Veks Iounrfo Cmxto Osfalu S NY 200 Pdnme Wntob Zejojtbbx Pqkag B CA 120 Eskfw Gzhqlv Saicbmeayqw Yotv G CA 120 Jsfk Tbluhm Wbbhalhs Ueyzg S KY 160 Help Desk 11

12 Analyse mit geschützten Daten möglich Card Average Score Amex 100 M/C 160 Visa 140 Analysts Name SS# Credit Card # Street Address Customer ID State Score Kwfdv Cqvzgk Ykzbpoi Clpppn G NY 100 Veks Iounrfo Cmxto Osfalu S NY 200 Pdnme Wntob Zejojtbbx Pqkag B CA 120 Eskfw Gzhqlv Saicbmeayqw Yotv G CA 120 Jsfk Tbluhm Wbbhalhs Ueyzg S KY 160 Class # of states G 2 S 2 B 1 Analysts State Average Score NY 150 CA 120 KY 160 Analysts 12

13 Authorisierte Applikationen und Benutzer mit Zugriff auf Echtdaten Authorized HR Application HPE SecureData Tools Name James Potter Ryan Johnson Carrie Young Brent Warner Anna Berman Name SS# Credit Card # Street Address Customer ID State Score Kwfdv Cqvzgk Ykzbpoi Clpppn G NY 100 Veks Iounrfo Cmxto Osfalu S NY 200 Pdnme Wntob Zejojtbbx Pqkag B CA 120 Eskfw Gzhqlv Saicbmeayqw Yotv G CA 120 Jsfk Tbluhm Wbbhalhs Ueyzg S KY 160 Authorized Fraud Analysts HPE SecureData Tools SS#

14 Ein typischer Datenfluss Incoming data sets (FTP, NDM, ) Enterprise Perimeter Transmit Data feeds Mainframe Flat Files Business logic Batch archive files (Files) Remittance Files (QSAM) Payments Warehouse (DB2) Aggregator Individual recipients Transmit Reports, statements, etc. Batch image copies (Tables) Teradata Payment detail data (Teradata) Batch archive Teradata to tape Payment Processors Transmit Settlement files Flat VSAM Files Files Payments processing Batch archive files (Files) Transmit Payment authorization requests Load data to VSAM history file History File (VSAM) CICS Analytics (Big data) MQ Order input, update, confirmation, etc. MQ Teradata Batch Load payment data from Teradata to DB2 (Teradata) File-AID Search accounts using CICS panels Web Account inquiry, new orders, etc. Reports Web front-end Web reporting interface Order and customer data Enter account and display report Web back-end Batch archive Teradata to tape Batch archive file data Batch daily image copy (Files) (Tables) Load/Update data to DB2 payment tables Payment Tables (DB2) DB utlities File-AID (file search DB utilities to search tables 14

15 Data Protection ohne HPE SecureData Incoming data sets (FTP, NDM, ) Enterprise Perimeter Transmit Data feeds Mainframe Flat Files Business logic Batch archive files (Files) Remittance Files (QSAM) Payments Warehouse (DB2) Aggregator Key Protect Inbound Deprotect outbound Individual recipients Transmit Reports, statements, etc. Batch image copies (Tables) Protect in, deprotect out Teradata Payment detail data (Teradata) Batch archive Teradata to tape Payment Processors Transmit Settlement files Flat VSAM Files Files Payments processing Batch archive files (Files) Transmit Payment authorization requests Load data to VSAM history file History File (VSAM) CICS Analytics (Big data) MQ Order input, update, confirmation, etc. MQ Teradata Batch Load payment data from Teradata to DB2 (Teradata) File-AID Search accounts using CICS panels Web Account inquiry, new orders, etc. Reports Web front-end Web reporting interface Order and customer data Enter account and display report Web back-end Batch archive Teradata to tape Batch archive file data Batch daily image copy (Files) (Tables) Load/Update data to DB2 payment tables Payment Tables (DB2) DB utlities File-AID (file search DB utilities to search tables 15

16 Data Protection mit HPE SecureData Incoming data sets (FTP, NDM, ) Enterprise Perimeter Transmit Data feeds Mainframe Flat Files Business logic Batch archive files (Files) Remittance Files (QSAM) Payments Warehouse (DB2) Aggregator Key Protect Inbound Deprotect outbound Individual recipients Transmit Reports, statements, etc. Batch image copies (Tables) Partially deprotect Teradata Payment detail data (Teradata) Batch archive Teradata to tape Payment Processors Transmit Settlement files Flat VSAM Files Files Payments processing Batch archive files (Files) Transmit Payment authorization requests Load data to VSAM history file History File (VSAM) CICS Analytics (Big data) MQ Order input, update, confirmation, etc. MQ Teradata Batch Load payment data from Teradata to DB2 (Teradata) File-AID Search accounts using CICS panels Web Account inquiry, new orders, etc. Reports Web front-end Web reporting interface Order and customer data Enter account and display report Web back-end Batch archive Teradata to tape Batch archive file data Batch daily image copy (Files) (Tables) Load/Update data to DB2 payment tables Payment Tables (DB2) DB utlities File-AID (file search DB utilities to search tables 16

17 HPE SecureData HPE Stateless Key Management Keine Schlüsseldatenbank notwendig Hochperformant und extrem skalierbar Keine komplexe PKI Infrastruktur notwendig Encryption UND Tokenization Technologien Standardisierte Verschlüsselungstechnologien Breiter Plattform Support On-premise/Cloud/Big Data/Mobile Structured/Unstructured Linux, Hadoop, Windows, AWS, IBM z/os, HPE NonStop, HPE Vertica, Teradata, etc. Quick time-to-value Kompletter End-to-End Schutz mit einer Plattform FPE reduziert Implementierunsaufwand drastisch HPE SecureData Management Console HPE SecureData Web Services API HPE SecureData Command Lines and Automated File Parsers HPE SecureData API HPE SecureData native APIs (C, Java, C#,.NET) API HPE SecureData File Processor 17

18 Weitere Informationen? it-sa: Stand 360 bayern-innovativ bizcon AG Buchen Sie Ihren PoC unter big-data-security.de 18