INFORMATION STEWARDSHIP: AVOIDING DATA BREACHES AND MANAGING BIG DATA

Transcription

1 INFORMATION STEWARDSHIP: AVOIDING DATA BREACHES AND MANAGING BIG DATA Mike Small Session ID: GRC- T06 Session Classification: Intermediate

2 ABSTRACT Information security continues to be a problem and this problem is increasing because of the volume, velocity and variety associated with big data. Given the amount of attention to this area and the wealth of standards and technology available why do does this problem still exist? This presentation will look at the nature of information security risks and describe how better information stewardship based on information centric security is essential to manage these risks.

3 What is Information Worth? Some6mes it seems that the only people who value informa6on are those who want to steal it.

4 Anti-Terrorist Plans? Mistake Accidental Disclosure Britain's most senior antiterrorist policeman resigns. Telegraph.co.uk 9 th April 2009 Corner Cutting Carelessness

5 Medical Records? Misuse Abuse of privilege A record monetary penalty of 325,000 for a hospital: library/data_protection/notices/ bsuh_monetary_penalty_notice.ashx May 2012 Curiosity Negligence

6 Customer Data? Misuse Data theft Mobile phone customer contract renewal data stolen. Data_Protection/Notices/tmobile_summary.pdf December 2008 Disclosure Recklessness

7 Intellectual Property? Malice Open Letter to RSA Customers. March, 2011 Co-ordinated attacks Social Engineering Blackmail

8 More and More Data! Just as oil was likened to black gold, data takes on a new importance and value in the digital age. Neelie Kroes Vice- President of the European Commission responsible for the Digital Agenda December 2011

9 Big Data Explosion Volume According to IDC, 2.8ExaBytes (10 18 ) of data will have been created and replicated in 2012 Velocity LHC at CERN generates 600 million events per second Variety Text, voice, photo and video as well as instrumentation.

10 New Technologies Volume Velocity Variety Hadoop - MapReduce Elastic Map Reduce IBM InfoSphere Streams Twitter Storm Yahoo S4 NoSQL - databases Natural Language processing XML stores Graph stores

11 Smart Information Smart information is Big Data Analysed to create value Big Data Symbols without context processed or stored by a computer Smart Informa6on Big Data with interpreta6on and context that provides answers to ques6ons Millions of events in log files A pavern of events indica6ng fraudulent ac6vity

12 Big Data Risks and Threats Informa6on security risks for Big Data have similar root causes as for tradi6onal informa6on.

13 Big Data makes it harder! Big Data techniques make it harder to keep a secret Commoditization of techniques already used by intelligence agencies Inference drawn from many small pieces of data Big Data Techniques can also be used by the bad guys Facilitate Identity theft Refine exploits and malware Analyse data breaches

14 Top Big Data Challenges Insecure Infrastructure Secure distributed computing framework Improper Analysis Data provenance Assuring Compliance Trust in data sources Secure non SQL stores Granular access control Scalable Privacy Control access to multi level stores and logs Detect misuse and unauthorized access Auditing

15 Information Stewardship Taking care to look after property that is not your own is called stewardship

16 What is Information Stewardship? Information Lifecycle Security Business Value Information Stewardship Privacy and Compliance Data Architecture Information Quality Larry P. English, Improving Data Warehouse and Business Information Quality, John Wiley & Sons, 1999

17 Achieving Information Stewardship Informa6on stewardship uses good governance techniques to implement informa6on centric security.

18 Pillars of Information Stewardship Implement Information Governance Manage Information Lifecycle Information Security Culture Information Security Organization Understand Business need and implement best practice. Know what you have and control what happens to it Change the perception of security Everyone is responsible for information security

19 Information Governance Define Business Needs Get Executive Sponsorship Assess Current State/Define Action Plan Risk Assessment Classify Information and Data Organization and Culture Implement Best Practice Secure infrastructure and systems Monitor and improve

20 Information Lifecycle Own Acquire Delete Classical Data Classify Refine Big Data Analyse Access Create Use Discover

21 Security Culture Changing the percep6on of security Crea6ng Informa6on Stewardship Champions Educa6on, Teaching and Mentoring Rewards and Sanc6ons

22 Organization IT Functions IT Governance Stewardship Information Governance Business Functions Business Governance IT Management Organization & Culture Lines of Business Business Service Delivery Information Security Information Creation and Use

23 Information Centric Security IT organiza6ons have not been well connected to the business. This has led to lines of business bypassing the disciplines involved in securely delivering IT services.

24 Information Centric Security Security Objectives Supporting Processes Essential Elements Confidentiality, Integrity and Availability Policies, classification, access control, auditing Procedures and Technologies

25 Information Security Processes Classical Processes Big Data Processes Information Classification Access Policies and Controls Business Continuity Planning Auditing Data purpose, ownership and compliance Analysis verification, access control and disposal Big Data Auditing

26 Information Security Elements Classical Elements Identity and Access Management Privilege Management Secure Storage Flow Control Infrastructure Security Information Loss Resilience Monitoring and review Big Data Elements Data provenance verification Privilege Management Secure Big Data Storage Secure Big Data Flow Identity and Access Management Monitoring and review

27 Meeting the Challenges with Information Stewardship

28 Managing Classical Risks Data Centre Risks End User Device Risks Human Interface Risks Secure Storage Privilege Management Information Flow Control Infrastructure Security Identity and Access Management DLP Technology Mobile Device Management tools Culture Policies Training

29 Meeting Big Data Challenges Secured Infrastructure Verification Secured Analysis Provenance Verification Assured Compliance Defined purpose Change Control Secured data flows Informed consent Privilege management Access Governance Control of use Secured Storage Secured Disposal Auditing

30 Summary The con6nuing problem of data leakage, data loss and data they show that current approaches have proven inadequate. What is needed is bever informa6on stewardship

31 Summary New Challenges Big data, unstructured data, new technology threats Human Factors Informa6on Stewardship Informa6on Centric Security Malice, Misuse and Mistake Governance, culture, organiza6on Best prac6ce processes and technologies

32 Thank you! Mike Small

33 Information Sources #1 Cloud Security Alliance Top Ten Big Data Security and Privacy Challenges v1 ENISA ENISA Threat Landscape ( ) ENISA_Threat_Landscape/at_download/fullReport Larry P. English, Improving Data Warehouse and Business Information Quality, John Wiley & Sons,1999

34 Information Sources #2 ISACA Big Data: Impacts and Benefits Impacts-and-Benefits.aspx Creating a Culture of Security WCCS_Creating_a_Culture_of_Security_31Mar2011_Research.pdf Data Leak Prevention Prevention.aspx

35 Information Sources #2 KuppingerCole From Data Leakage Prevention (DLP) to Information Stewardship From Big Data to Smart Information Big Data and Information Stewardship