O slideshow foi denunciado.

Securing the Cloud



Carregando em…3
1 de 19
1 de 19

Mais Conteúdo rRelacionado

Audiolivros relacionados

Gratuito durante 14 dias do Scribd

Ver tudo

Securing the Cloud

  1. Securing the Cloud Glenn Solomon Feb 2016
  2. • 1 team in the US and China • $2.6 billion under management • 6 funds | 150+ investments • 15 years | 27 IPOs GLEN N SOLOMON • Managing Partner • 10 years at GGV Capital • Enterprise, SaaS, Cloud, Security, Mobile • goinglongblog.com | @glennsolomon
  3. Cybercrime is a Growth Industry Source: 2015 Verizon DBIR Report; ITRC ; HP 2015 Cost of Cyber Crime Study; The Global State of Information Security Survey 2015; McAfee Net Losses – Estimating the Cost of Cybercrime 42.8M Security Incidents 5,810 Confirmed Data Breaches 61 Countries $445B Annual Cost to the Global Economy
  4. Data Breaches by the Numbers Data Records Lost or Stolen in 2014 2,803,306 records lost or stolen every day 116,793 records every hour 1,947 records every minute 32 records every second Source: SafeNet – The Art of Data Protection, Feb 2015 Only 4% of breaches were “Secure Breaches” where encryption was used and the stolen data was rendered useless
  5. Data Breaches are across all Industries Source: WSJ
  6. Hackers & Their Weapons Participants Hackers Hacktivists Criminal Organizations Commercial Vendors State Sponsored Terror Groups Available to Purchase Hacking Tools Zero-day Exploits Credit Card Data eCommerce/Social- Media Credentials Key Participants Eastern Europe Russia China US Latin America Source: RAND National Security Research Division
  7. The Cybersecurity Landscape is Vast Source: Momentum Partners
  8. Common Threats & Victims Identity Theft Phishing Social Engineering Cyber AttackCyber Extortion When you protect your company, you need to focus on all possible weaknesses. Hackers only need to find one way in…
  9. The Corporate Challenge Source: 2015 Verizon DBIR Report; BTIG Security Report – Attack of the Clones Cloud-based Applications Social Networking Virtualization BYOD 83 million software applications today; 141 million by 2017 Stolen or weak credentials involved in 76% of cyber attacks 14% of attacks or exploits are on cloud services, applications, or storage systems Mobile security breaches have affected 65% of global organizations in the last 12 months
  10. The Next Generation of Cyber Security Source: BTIG Security Report – Attack of the Clones Legacy Security Companies Next Generation Equivalent Firewall/Intrusion Prevention System Next Generation Network Security Antivirus Next Generation Endpoint/Malicious Detection Web Gateway/URL Filtering Cloud Security & Data Protection Authentication, Authorization & Accounting Identity & Access Management – The New Perimeter Secure Event Management Security Intelligence & Analytics Data Security Data Security, Discovery, Clarification, Control & Intel Data Loss Prevention Inside Threat Protection Governance, Risk Management & Compliance Compliance Automation and Data Governance
  11. New Threat Vectors Source: Immuniweb, Symantec Internet Security Threat Report 2015; Crowd Research Partners – Insider Threat Report Social Media Protection While email remains a significant attack vector, 70% of social media scams were manually shared. Advanced Persistent Threats Zero-day exploits are almost impossible to detect and will work 9 out of 10 cases because they have legal, financial and banking industry experts, psychologists, and even ex-law enforcement officers behind them. Insider Threats Privileged users, such as managers with access to sensitive information, pose the biggest insider threat to organizations. This is followed by contractors, consultants, and regular employees. Compromised account credentials, or when someone’s account is hijacked, are also a big part of this risk.
  12. New Threat Vectors Internet of Things These hubs, switches, and router are increasingly used to target the network. They have processing, storage, and internet connectivity. Mobile Security & Protection As more users rely on their mobile devices, more spam, scams, and threats are tailored to these devices. Mobile malware such as bootkits will become harder to remove. Critical Infrastructure The most significant trend is the use of malware to compromise supervisory control and data acquisition (SCADA) systems, including Homeless Management Information System (HMIS), historians, and other connected devices. Source: Symantec Internet Security Threat Report 2015; Crowd Research Partners – Insider Threat Report
  13. Approaches Over Time 1987-2009 2009-2014 2014 onward 2015 onward Signatures Sandboxes Anomaly Detection Zero-Trust APT Attack Sophistication Level Hammertoss, Black Energy, etc Endpoint Content Network Source: Based on Agari presentation material
  14. Modern Security Challenges in the Cloud Challenge: Corporate services are migrating to the cloud Secure Application Access Privileged Access Management Multi-Factor Authentication FirewallsNetwork Access Control SSO Challenge: Dynamic workloads due to multi-tiered apps & virtualization, containers, micro-services, etc. Protect Server to Server Interactions Cloud Workload ManagementMachine Firewalls
  15. Modern Security Challenges in the Cloud (cont) Challenge: Employees on websites via HTTP and mail –some malicious Securing Employee to Internet Cloud Policy ManagementCloud Access Security Brokers SaaS Data Encryption Challenge: Rapid development cycles leave little room for security checks Web App Security RASPsWAFs CDNs
  16. Emerging Protection for Emerging Threats Insider Threat Detection Machine Learning to Spot Attacks Industrial & Connected Device Security
  17. Security Startups Raised $10.9B across 1074 Deals since 2010 Source: Momentum Partners, CB Insights
  18. Additional Resources Books Blogs http://goinglongblog.com/ https://krebsonsecurity.com/
  19. Q&A