Security Risk Management:

Transcript

1 Security Risk Management: How to mitigate risks and protect data Security Managed Services 11/11/2015 Denis Cassinerio Security BU Director & Sales Director North Italy

2 Agenda 1. Hitachi Ltd. & Hitachi ITSG 2. Hitachi Systems CBT 3. Risk Management Scenario 4. Managed Security Services 1

3 1. Hitachi Ltd. & Hitachi ITSG

4 1. Hitachi Ltd. (as of end of Mar. 2015) Information & Telecommunication Systems 19% Power Systems 4% Social Infrastructure & Industrial Systems 15% Financial Services 3% Others (Logistics & Other services) 11% billion Electronics Systems & Equipment 11% Construction Machinery 7% Smart Life & Ecofriendly Systems 7% Automotive Systems 9% High Functional Materials & Components 14%

5 INDIA 2013 SOUTHEAST ASIA CANADA ITALY CHINA 2012 NORTH AMERICA 1.2 Hitachi Systems Global Hitachi Systems Italy CBT Hitachi Systems (Guangzhou) Cumulus Systems STRATEGY 1. Establish a base of operation in Italy 2. Contribution to the social infrastructure business of Hitachi 3. Expand into greater Europe Hitachi Systems Micro Clinic Hitachi Sunway Information Systems Above Security

6 2. Hitachi Systems CBT Italy

7 2.1 Vision & Mission Cloud, Service, Application & Technology Integrator Assist organizations in their strategic path to Business Transformation through outsourcing of infrastructure, services and applications MISSION VISION Over the last 35 years we have been supporting medium and large enterprises, both in the private and public sector, by implementing and improving their infrastructure, integrating them with services and application solutions with high technological content. Transfer the complexity and start focusing on your business only

8 BUSINESS AREAS 2.2 Business Areas MANAGED SERVICES Engineering Projects & Services (2014: Revenues 22,3M ) APPLICATIONS (2014: Revenues 3,7M ) TECHNOLOGY Data Center, Networking, Devices, Middleware (2014: Revenues 31,1M )

9 2.3 Highlights +300 TEAM 6 LOCATIONS 57MIO REVENUE +7% FY % SECURITY & COMPLIANCE /7 SERVICES All our customers will be free to focus on their core business only BRANCHES Milano Venezia Torino Novara DATA CENTERS SOFTWARE FACTORY HEADQUARTER Bologna Roma Roma Milano OVER CERTIFICATIONS OVER 100 PARTNERS LONG EXPERIENCE >35 YEARS 2 DATA CENTER

10 3. Risk Management Scenario

11 ATTACK SURFACE

12 Vulnerability & Threats

13 DATA BREACH SNAPSHOT 12

14 CLUSIT Report

15 3.1 Compliance changes 14

16 NORMATIVE : Regolamento Europeo La Commissione europea ha proposto una riforma globale della normativa UE sulla protezione dei dati delle persone fisiche. Il nuovo Regolamento ha lo scopo di fissare delle regole chiare e uniformi sulla privacy online e offline Una volta approvato dal Parlamento e dal Consiglio UE, varrà per tutti i Paesi europei. Principali novità del Regolamento 1. Obbligo di «Data Protection Impact Analysis» in caso di trattamenti rischiosi 2. Obbligo di «Privacy by Design and Default» nella progettazione e nell architettura di Infrastrutture ICT e nelle Pratiche Commerciali 3. Obbligo di «Data Breach Notification» entro 24 ore dall evento al Garante Privacy 4. Obbligo per le aziende con più di 250 dipendenti e per gli enti pubblici di nominare un «Data Protection Officer» 5. Diritto all'oblio, per cui ogni interessato potrà richiedere la rimozione di propri dati personali. 15

17 SANZIONI Previste dal NUOVO Regolamento Europeo 16

18 3.2 Risk Management Maturity 17

19 Crisis = Opportunity 18

20 The Opportunity : Skills Gap DATA PROTECTION SECURITY RISK MANAGEMENT SKILLS GAP Legal & Compliance Threats Vulnerabilities DLGS. 196/2003 e s.m.i. DLGS. 231/01 e s.m.i. Legge 547/93 e s.m.i. ISO/IEC 27001:2013 COBIT ITIL Virus Worm Trojan Payloads Man in te Middle Brute Force Authentication.. APT CVE MS CVE ISO NIST OWASP OSST Vectors of Attack Technical Impacts Business Impacts 19

21 Information Security Risk Management Fundamentals AVAILABILITY INTEGRITY CONFIDENTIALI TY 20

22 Information Security Risk Management Fundamentals VULNERABILI TY Processes Systems Network Applications Continuous check Continuos remediation Data Assets VALUATION THREATS New threats every 1.5 seconds Variants Exploit kits Botnets APT Penalties ANALYSIS Qualitative Quantitative COUNTERMEASURES Processes Checks AV IPS FW APT WAF HIPS APP CTRL. Consultancy 21

23 Situational Awareness Security 22

24 4. Managed Security Services 23

25 Security Business Unit 24

26 EasyShield: Vision EasyShield Legal & Compliance Architectural Design Security Engineers Security Analysts VISION Integrated Services Manage the Security IT Complexity Managed Security Services

27 EasyShield: Keywords and Benefits Keywords & Benefits COMPLIANCE TECHNOLOGY MANAGED SERVICES CYBERSECURITY Reduction & Cost Control Security Posture Improvement Ad hoc Installation & Configuration Up to date Certification

28 EasyShield: Security Risk Management «Security Partner» Identify assets and their value to the organization. Identify vulnerabilities and threats Quantify the probability and business impact of these potential threats. Provide an economic balance between the impact of the threat and the cost of the countermeasure. Shon Harris, CISSP Identify & Analiyze Exposures Monitor Results Implement Techniques Examine Risk Management Select Risk Management

29 4. EasyShield Offering Structure

30 Security BU Offering Compliance SKILLS EXTENDED PORTFOLIO SRM CYCLE COST EFFECTIVE Technology Professional Services Managed Security Services Cyber Security

31 MANAGED SERVICES 3.4 Offering: EasyShield EasyShield represents a 360 security approach, from Compliance to Cloud services, through the best technology solutions via Managed Services Technology Professional Services Managed Services Compliance Cyber Security Managed Security Services Anti Malware policy Management Mobile Security Firewall Configuration and policies IPS / IDS Management Wireless Assessm Compliance Management Penetration Test Privileged Account Management Web Application Protection Vulnerability Assessment Virtual Patching Patch Management Professional Services Penetration Test Vulnerabiility,Mobile Web Application, Wireless PCI DSS (/ Scan & compliance) Content security Datacenter & Cloud Security Network Security Security Management Vulnerability Management Security & Compliance Risk Assessment Risk Management, Governance & Certification Business Continuity & Disaster Recovery Regulatory Compliance Management Business Process Reengineering Security Awareness Training Security & Compliance Audit APT Assessment Multi Protocol Network Detection Spear Phishing Mitigation Anti Bot Net Sandboxing and behavioral monitor Forensic Analysis Intrusion Detection / Prevention Ethical Hacking Penetration Test Web Application Protection Zero Day Protection TECHNOLOGY COMPLIANCE CYBER SECURITY

32 4.2 Global SOC

33 Global SOC: Security Strategy Global SOC Protection of Critical Infrastructure (Social Infrastructure) SHIELD SecurityOperationCenter Cyber Security (Anti-Phishing, Anti- Malware) Proactive Defense with Real-time Analytics and Global Intelligence Service WAF: Web Application Firewall; NGFW: Next Generation Fire Wall ; SIEM: Security Incident and Event Management

34 ABOVE SECURITY Integration 33

35 ARKANGEL Platform 34

36 Conclusion It is better to look ahead and prepare than to look back and regret. Jackie Joyner Kersee, athlete and olympic medails Thanks!! 35

37 Security BU Offering: Main Technologies CONTENT SECURITY NETWORK SECURITY SECURITY MANAGEMENT APT IOC DETECTION IAM / PAM

38 Contacts HEADQUARTER ROME Via Francesco P. Da Cherso, TOLL FREE (WebRainbow) MAIN SITES MILAN Via Dei Gracchi, VENICE - QUARTO D ALTINO Via L. Mazzon, TURIN Via Gian Domenico Cassini, NOVARA Via Biandrate, BOLOGNA - CASALECCHIO DI RENO Via Ettore Cristoni,

39 END Security Risk Management: How mitigate and handle the data through the Managed Services ICT Festival Milano 11/11/2015 Denis Cassinerio Security Business Unit & Sales Director - DirectSecurity 38

40

41 CYBERCRIME TRICHOTOMY 40

42

43 References: Case Studies Security HDI Assicurazioni - Log Management Installazione, configurazione e gestione sistema di tracciatura dei log di accesso degli Amministratori di Sistema a norma privacy G.Matica Certificazione integrata ISO Realizzazione e certificazione del Sistema di Gestione Integrato Qualità e Sicurezza delle Informazioni aziendali, LND Security & Privacy Risk Assessement Realizzazione di una attività Assessment di sicurezza rispetto alla normativa sulla privacy ed ai Provvedimenti del Garante. RFI Corso Privacy Progettazione ed erogazione di due moduli didattici sui temi della sicurezza informatica e della protezione dei dati;. Formazione dei formatori. Consorzio ATR Adeguamento Privacy Assessment di Sicurezza. Elaborazione sistema documentale privacy.integrazione dei contratti. Erogazione della formazione. IntesaBCI Processi di Gestione della Sicurezza Disegno dei processi di Gestione della Sicurezza ISO e valutazione degli impatti organizzativi sulla Banca. IUAV - Privacy Risk Assessement Verifica dello stato di conformità del modello organizzativo, gestionale e tecnologico adottato dall Ateneo rispetto alle misure di sicurezza privacy. RM ASL B - AV IPS IDS Installazione e configurazione di una piattaforma di protezione degli ambienti virtuali da violazione dei dati e interruzioni dell attività, FIP Data Loss Prevent Installazione e configurazione di un sistema di protezione dei dati su PC e Mobile a sostegno della conformità e prevenzione della perdita di dati. Poste Italiane Risk Management AgID Security Audit Telecom Politiche di Log Retention Definizione del processo di Risk Management ISO e della metodologia di Risk Assessment secondo ISO Audit di sicurezza ISO/IEC 27001, Dlgs.196/2003 e Dlgs 231/2001 condotto sulla RIPA (Rete Internazionale della Pubblica Amministrazione). Definizione delle politiche di sicurezza per la raccolta, la conservazione e l utilizzo dei log a norma ai fini del monitoraggio dell utilizzo dei sistemi informatici. SHIELD: The Brand Name for Hitachi Systems Security Solution

44 1.3 Hitachi ITSG & HISYS Organization HITACHI Ltd. Information & Telecommunication Systems Group (ITSG) Research & Development Group Healthcare Group Power & Infrastructure Systems Group Hitachi System Systems Solution Ltd. & Services System Solutions and Services Cumulus Systems Hitachi Sunway Information Systems Hitachi Systems Micro Clinic Hitachi Systems (Guangzhou) Hitachi Systems CBT Above Security Hitachi Solutions Ltd. Products and System Development Hitachi Data Systems Corporation Platforms (Storage Systems, Server, Platform Software) Hitachi Consulting Corporation IT Consulting

45 History of Hitachi ITSG Automated switchboard Train seat reservation system Online Banking System Digital switch board Work Station Outsourcing solution EDI system Blade Server Hitachi cloud solution/ Environment -conscious data center Smart information related products and services intelligent Operations 1910 TODAY Electric computer Super computer Beijing meteorological central system for Chinese Central Meteorological Agency RAID disk Array Hitachi virtualization technology Virtage IoT (Internet of Things), M2M (Machine to Machine) Establishment of Totsuka factory (produced telephones & switchboards ) Mainframe Integrated system management middleware Finger vein authentication system Big data related services

46 Security Risk Management ERRORS/ OMISSIONS INTRODUCTION OF ILLEGAL SW USERS NOT AUTHORIZED VANDALISM LOGICAL ACCESS PHYSICAL ACCESS TAMPERING PHYSICAL ORGANIZATION DATA DOCUMENTATIONS APPLICATIONS SYSTEMS DISTRIBUTED ARCHITECTURE CHANGE OR COPY OF DATA ARIAL BUSINESS - OPERATIONS CONTINUITY UNAUTHORIZED SOFTWARE EXECUTION THEFTS NATURAL EVENTS 45

47 Misure Minime - Misure Idonee Costo TOTAL complessivo COST Punto di ottimo economico Costo Security della cost sicurezza Costo COST Costo di Esposizione Cost exposure Livello Security di Level sicurezza 46

48 KEY STRENGTHS 2.4 How do we do it Strategic transformation of business and organizational processes with high experience in Outsourcing and Cloud Computing BUSINESS TRANSFORMATION Manage the customer s technological complexities, leaving them free to focus exclusively on their core business COMPLEXITY TRANSFER CUSTOMISED SOLUTIONS More than 1,200 hardware and software technology certifications to design tailor-made solutions also in Private and Public Cloud infrastructure, already available in our Data Centers TIME AND COST SAVINGS Speed of delivery and Pay-per-use logic of EasyCloud, EasyWare and WebRainbow and EasySHIELD Solutions to generate economic efficiency switching from investments to fee

49 48

50 PROVVEDIMENTI 28/10/2015 Trasferimento dati personali verso gli USA: caducazione provvedimento del Garante del di riconoscimento dell'accordo sul c.d. "Safe Harbor" - 22 ottobre 2015 TUTTO CIÒ PREMESSO IL GARANTE 1) dispone la caducazione dell'autorizzazione adottata dal Garante in data 10 ottobre 2001 con deliberazione n. 36 e per l'effetto vieta, ai sensi degli artt. 154, comma 1, lett. d) e 45 del Codice, ai soggetti esportatori di trasferire, sulla base di tale delibera e dei presupposti indicati nella medesima, i dati personali dal territorio dello Stato verso gli Stati Uniti d'america; 2) si riserva, ai sensi dell'art. 154, comma 1, lettere da a) a d) del Codice, di svolgere in qualsiasi momento i necessari controlli sulla liceità e correttezza del trasferimento dei dati e, comunque, su ogni operazione di trattamento ad essi inerente, nonché di adottare, se necessario, i provvedimenti previsti dal Codice; 3) dispone la trasmissione del presente provvedimento all'ufficio pubblicazione leggi e decreti del Ministero della giustizia per la sua pubblicazione nella Gazzetta Ufficiale della Repubblica Italiana. 49

51 Corporate Data at Risk Network Credentials Intellectual Property Calls Employee Location Privileged Communication 50

52 Superior service empowered by combining the strength of our people and information technology.