SpringOne Platform 2019 Session Title: Securing Pivotal Platform at Prime Therapeutics Speakers: Daniel May, IT Security Architect, Prime Therapeutics and I-Sung Chao, Security Architect, Prime Therapeutics Youtube: Coming Soon

1. Securing Pivotal Platform at
Prime Therapeutics
I-Sung Chao, IT Security Architect Craig Erdmann, Pivotal Platform Architect
Prime Therapeutics Pivotal
October 7–10, 2019
Austin Convention Center

2. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Prime’s purpose is to help people get the medicine they need to feel better and live
well
Prime is defining what’s next in total drug management
Prime manages pharmacy claims for millions of people
Prime Therapeutics (“Prime”)
2

3. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Prime’s IT Security Organization
3
Architecture
Engineering
Access Management
Incident Response
Controls Assurance
Security Awareness
Data Distribution
CISO

4. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
On-prem in multiple Data Center
• Active-Active
Dell EMC VxRail Appliance Pivotal Ready Architecture (“PRA”)
New to Prime
1. Pivotal Platform (PaaS)
2. NSX-T SDN for PaaS
3. Dell EMC’s Hyper Converged Infrastructure (IaaS)
4. Cisco ACI SDN in Data Center
Prime’s Pivotal Platform
4

5. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Approaching Security Requirements & Designs
5
White Paper
?

6. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Approaching Security Requirements & Designs
6
Reference Architecture

7. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Approaching Security Requirements & Designs
7
Prime’s
Cloud Security
Requirements
Prime’s
Cloud Security
Strategy
Pivotal Platform Dell EMC
VxRail
NSX-T
Prime’s PaaS Security
Requirements & Designs
Prime’s IaaS Security
Requirements & Designs

8. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Require
ments
Designs
Detailed
Designs
Evidence
IaaS 36 36 37
PaaS 33 33 45
The Process of Security Requirements, HL &
Detailed Designs
8
IT Security
Architect
Pivotal Platform
Architect
160 hours 160 hours
50
Security
User Stories
Product
Owner
Enterprise
Architect
Many other teams

9. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
50 Security user stories ready on day one
Accelerated Dojo
Pivotal Platform Dojo
9

10. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Secure network path
Secure controls between network zones
Micro-segmentation
Firewall deployment
Logging and monitoring
Patch management & hardening standard
Some of Security Requirements
1
0

11. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Platform Engineer access control
Developer access control
Privileged account management
Static code scan prior to app deployment to platform
Web app vulnerability dynamic scan
Secure deployment pipeline
Secure platform configurations
File integrity monitoring & Anti-virus
Some of Security Requirements (Continued)
1
1

12. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Many Teams Completed Security Work
12
IT Security
Architect
Pivotal Platform
Architect
Platform
Team
Security Identity
Management
Security Access
Management
Security
Engineering
Security
Incident
Response
Security
GRC
Network
Team
Hosting
Team
Application
Developer
IT
Middleware
BSA Java
Build Support
Scrum
Masters
NSX-T
SME
VxRail
SME
Other Pivotal
Platform
SME
Require
ments
Designs
Detailed
Designs
Evidence
IaaS 36 36 37 Captured
PaaS 33 33 45 Captured
Require
ments
Designs
Detailed
Designs
Evidence
IaaS 36 36 37 Captured
PaaS 33 33 45 Captured
Product
Owner
Enterprise
Architect

13. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Prime is in early stage of DevOps and CICD
• Prime has a long history of CI
DevOps & CICD
13

14. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Schedule  Priorities
Project oriented  Product model
Weekly meetings  Daily stand-ups
… … …  Kanban
Project Managers  Scrum Masters
Easily appreciate each team
Transforming to Agile
14

15. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Product model enables continuous improvement of Security
Security controls implemented by Platform team and many other teams outside
Security
Platform Engineer Effort in Story Points (complexity & risk):
93 points for Security stories/ 220 points all stories= 41% for Security control
implementation
We have Platform Security
Collaboration and partnership
Conclusion
15

16. CL | CC:
Continuous Learning &
Continuous Conversation
with your partners
THANK YOU!!!
Extended Q&A Immediately outside the session room
for a short while
i-sung.chao@primetherapeutics.com
cerdmann@pivotal.io
#springone@s1p