Sustainable Compliance Ovvero. Come rispettare le regole nell era del taglio costante dei costi

Transcript

1 1 Sustainable Compliance Ovvero Come rispettare le regole nell era del taglio costante dei costi Paolo Da Ros, Partner CryptoNet 2011 Copyright(C) CryptoNet Srl

2 2 Tre idee. 1. Ridurre il perimetro della compliance (aka lavorare di meno ) 2. Mettere a fattor comune gli sforzi (aka intervenire sul processo ) 3. Aumentare la produttivita del lavoro (aka fare lo stesso lavoro con meno risorse ) 2010 Copyright(C) CryptoNet Srl

3 3 1. Ridurre il perimetro della compliance (aka lavorare di meno ) (Un esempio concreto: Il Payment Card Industry Data Security Standard) 2010 Copyright(C) CryptoNet Srl

4 4 La protezione dei dati: perché farla? 1. Tutele di legge (i.e.: dati sensibili ai fini dlgs 196/03) 2. Tutele di business vs. concorrenza (brevetti, anagrafiche clienti, condizioni commerciali) 3. Protezione della riservatezza dei dati a fini reputazionali 4. Protezione di dati altrui per evitare l Identity Theft 5. Protezione dei dati altrui per evitare i furti (PCI-DSS) Copyright(C) CryptoNet Srl

5 5 I dati sensibili dal punto di vista PCI 3.4. Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on strong cryptography (hash must be of the entire PAN) Truncation (hashing cannot be used to replace the truncated segment of PAN) Index tokens and pads (pads must be securely stored) Strong cryptography with associated key-management processes and procedures 2011 Copyright(C) CryptoNet Srl

6 6 La protezione dei dati: come farla? 1. Cifrare tutti i dati 2. Cifrare i dati personali che consentono di individuare i dati sensibili 3. Evitare tout court di usare i dati sensibili (a poterlo fare ) 4. Evitare di usare i dati sensibili 5. Facendoli utilizzare ad altri tutte le volte che e possibile Utilizzando qualcosa che assomiglia a un dato sensibile e non è un dato sensibile, ma solo un puntatore in corrispondenza biunivoca ad un dato sensibile 2011 Copyright(C) CryptoNet Srl

7 7 Quello che dice VISA Tokenization can be implemented in isolation or in concert with data field encryption to help merchants eliminate the need to store sensitive cardholder data after authorization. Entities that properly implement and execute a tokenization process to support their payment functions may be able to reduce the scope, risks and costs associated with ongoing compliance with the Payment Card Industry Data Security Standards (PCI DSS). Visa Best Practices for Tokenization Version Copyright(C) CryptoNet Srl

8 8 Quello che dice VISA (2) Tokenization defines a process through which PAN data is replaced with a surrogate value known as a token. The security of an individual token relies on properties of uniqueness and the infeasibility to determine the original PAN knowing only the surrogate value. As a reference or surrogate value for the original PAN, a token can be used freely by systems and applications within a merchant environment. Where properly implemented, tokenization allows merchants to limit the storage of cardholder data to within the tokenization system, potentially simplifying an entity s assessment against the PCI DSS. As a reference or surrogate value for the original PAN, a token can be used by systems and applications within a merchant environment without having to consider the security implications associated with the use of cardholder data. Visa Best Practices for Tokenization Version Copyright(C) CryptoNet Srl

9 Scenario: GDO (e PAN protetti con encryption) autorizzazione Negozi Negozi Negozi Negozi Hhs76832js002m9PPPPPPPPPPPPPPPP Enterprise Security Administrator Policy Audit Payment Gateway Va gestito a fini di compliance e sottoposto ad audit Archi viazione Hhs76832js002m9PPPPPPPPPPPPPPPP Hhs76832js002m9PPPPPPPPPPPPPPPP Hhs76832js002m9PPPPPPPPPPPPPPPP Hhs76832js002m9PPPPPPPPPPPPPPPP Hhs76832js002m9PPPPPPPPPPPPPPPP Settlement Loss Prevention Analysis - EDW ERP Settlement 2011 Copyright(C) CryptoNet Srl

10 Che cos e la tokenization, e cosa ha di interessante? Tokenization: La Tokenization e il processo con cui si sostituiscono dati sensibili con valori inerti chiamati tokens, che non presentano alcun interesse per un ladro I Token assomigliano ai dati originali per lunghezza e tipo di dati (A/N, N, A ) Tokens Dati sensibili = relazioni 1:1 (rapporti biunivoci) Benefici: Migliora la trasparenza Diminuiscono gli sforzi necessari all adeguamento alle normative Diminuisce la criticita del key management Diminuiscono I punti d attacco Diminuiscono I costi per l audit PCI DSS 2011 Copyright(C) CryptoNet Srl

11 Scenario: GDO (e PAN protetti con Tokenization) Authorization Negozi Negozi Negozi Negozi Enterprise Security Administrator Policy Audit Token Servers Aggregating PCI Hub Out of for Scope Store Channel Va gestito a fini di compliance e sottoposto ad audit Archiving PCI Out of Scope Settlement Loss Prevention PCI Out of Scope Analysis - EDW PCI Out of Scope ERP PCI Out of Scope Settlement 2011 Copyright(C) CryptoNet Srl

12 Risk Adjusted Data Protection Data Protection Methods Performance Storage Security Transparency System without data protection Monitoring + Blocking + Masking Format Controlling Encryption Strong Encryption Tokenization Hashing Best Worst 2011 Copyright(C) CryptoNet Srl

13 13 2. Mettere a fattor comune gli sforzi (aka intervenire sul processo ) 2010 Copyright(C) CryptoNet Srl

14 14 Top-Down Governance Approach Business Process Applications Technologies Physical Environments Processes People Assets

15 Top-Down Governance Approach Human Resources Operations Finance IT Department Information Security Office Sales BUSINESS PROCESSES Payroll System ERP Fixed Assets System Risk Management System IT Infrastructure Order Entry System SYSTEMS Payroll Application Server ERP CFO Datacenter Change Management IT Manager Router Firewall Workstation ASSETS

16 Top-Down Governance Approach Human Resources Operations Finance IT Department Information Security Office Sales BUSINESS PROCESSES Payroll System ERP Fixed Assets System Risk Management System IT Infrastructure Order Entry System SYSTEMS SI: 08.3 % Payroll Application Server SI: 90.8 % SI: 78.1 % SI: 48.9 % SI: 67.7 % ERP CFO Datacenter Change Management SI: 13.6 % SI: 44.7 % SI: 14.1 % SI: 11.6 % IT Manager Router Firewall Workstation ASSETS

17 The Asset-level Approach Ignores the Business View Human Resources Operations Finance IT Department Information Security Office Business Language Sales BUSINESS PROCESSES Payroll System ERP Fixed Assets System Risk Management System IT Infrastructure Order Entry System 30 High 20 Medium 300 Low 400 High 600 Medium 2000 Low D Technical Language 45% B Compliant Gap List Vulnerabilities 57 Ports Open 30 High 20 Medium 300 Low Payroll Application Server ERP CFO Datacenter Change Management IT Manager Router Firewall Workstation ASSETS

18 Windows Router Web Server Oracle Unix Access Control Change Management Physical Controls Aperti e sicuri Un Meta-Framework 18 SOX HIPAA BITS PCI FISMA CobIT ISO PCI-DSS NIST Normative Standards & Frameworks Migliaia di Controlli mappati su Decine di migliaia di Controlli Atomici Centinaia di Automatic Collectors (integrazione con Vulnerability Scanners) Automatic Collectors Web Interview or Off-line Collection Centinaia di Checklists 2010 Copyright(C) CryptoNet Srl 18

19 Risk Calculation (PSR Risk Index) Relevance (1-5) Risk Busines s- related (Get from Mgmt) 19 Probability (1-5) Severity (1-5) Control-related (Defaults from Security Lab) 2010 Copyright(C) CryptoNet Srl

20 Quick Charts Copyright(C) CryptoNet Srl

21 Mitigation Cost $ Aperti e sicuri Events x Mitigation Cost Opportunities to accept or create an exception E26 E28 E17 E19 E4 Should be evaluated carefully E22 E18 E9 E14 E12 E01 E6 E2 E8 E11 E5 E7 E30 E1 High priority on the treatment Opportunities for remediation and reduce the overall risk Risk

22 Mitigation Cost $ Aperti e sicuri Events x Compliance Opportunities to accept or create an exception E28 E26 E17 E19 E4 Should be evaluated carefully E22 E18 E9 E14 E12 E8 E11 E01 E5 E6 E7 E2 E30 E1 High priority on the treatment Opportunities for remediation and reduce the overall risk GLBA GLBA HIPAA PCI GLBA HIPAA # Compliance Requirements FISMA GLBA PCI HIPAA

23 Workflow Manager Charts provided to enable a better view of Workflow events Provides a quick snap-shot of various event statuses in Workflow Manager

24 Risk Management: Processo manuale 25% 15% 25% 35%

25 Processo Automatizzato (primo anno) 15% 45% 5% 35%

26 Processo Automatizzato (anni successivi) 5% 65% 25% 5%

27 27 3. Aumentare la produttivita del lavoro (aka fare lo stesso lavoro con meno risorse ) 2010 Copyright(C) CryptoNet Srl

28 Gli utilizzatori Auditors Compliance Officers Fraud Investigators Visual replay Google like search Reports Google like search Alerts Cases Profiles Le Funzionalita della tecnologia Search Engine Visual Audit Trail Analytic Engine Analyzed Data Investigation Center & Case Manager Data Collector & Consolidator Ambienti monitorati Network Switch Altre fonti informative External Users Clienti ebusiness Utenti interni Business User Amministratori di sistema Mainframe Web Server AS 400 Client/ Server Database Server Log Files Databases Reference tables

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52 Alert# per Week Aperti e sicuri Il fattore deterrenza degli Alert in tempo reale. Un case study di una Compagnia di Carte di Credito 100 Gli Alerts dei curiosi sui Celebrity Accounts Settimane Viene implementata la regola I responsabili della sicurezza contattano I sospetti Il primo dipendente viene licenziato

53 53 Grazie per l ascolto Paolo Da Ros Paolo.daros@Cryptonet.it Copyright(C) CryptoNet Srl