Dawn of the Intelligence Age by Dr. Anton Ravindran

www.rapidstart.com.sg www.globalstf.org
1
Dawn of the
Intelligence Age
Dr. Anton Ravindran
MENA Conference, Jordan

2
PEOPLE - THINGSPEOPLE - PEOPLE THINGS - THINGS

3
DIKW
SOURCE : CHAIM ZINS THEORY OF DIKW

4
SOURCE: BI INTELLIGENCE

5

6
TECHNOLOGIES

7
HISTORY OF CLOUD

8
FIVE KEY CLOUD ATTRIBUTES
 Shared / pooled resources
 Broad network access
 On-demand self-service
 Scalable and elastic
 Metered by use

9
IOT – AIRLINE ERA

10

11

12
CYBER SECURITY ISSUES
- DUE TO CLOUD, BIG
DATA ANALYTICS & IOT

13
WHY IS CLOUD SECURITY IMPORTANT
 Increasing Usage of Cloud Services in Non-traditional Sectors
 Growing Adoption of Cloud Services in Government Departments
 Rise in Cloud Service-specific Attacks
 Growing Usage of Cloud Services for Critical Data Storage
 Rise in Employee Mobility

14
WHY SECURITY?
 A survey commissioned by Microsoft on ‘Cloud computing
among business leaders and the general population’ states that:
 58% of the general population and 86% of senior business leaders
are excited about the potential of cloud computing.
 But, more than 90% of these same people are concerned about
the security, access and privacy of their own data in the cloud.
Source: Microsoft

15
Source: IBM

16
MARKET ANALYSIS
Market Size:
2012 : US $425.4 Million
2013 : US $629.6 Million
2014 : US $963.4 Million
WHAT MARKET SIZE ARE WE TALKING ABOUT

17
GLOBAL CLOUD SECURITY MARKET GROWTH
ANALYSIS 2012-2014 (US$ MILLION)
425.4
629.6
963.4
0
200
400
600
800
1000
1200
2012 2013 2014
41.4% Compound annual

18
GLOBAL CLOUD SECURITY MARKET BY
END-USER SEGMENTATION
38
31
17
9
5
Large Enterprises
Government Agencies
Cloud Service Providers
Medium Enterprises

19
WHAT IS CLOUD SECURITY?
Cloud
 Agility
 Self-service
 Scale
 Automation
Security
 Gate-keeper
 Standards
 Control
 Centralized
Cloud Security is security principles applied to protect data, applications and
infrastructure associated within the Cloud Computing technology.

20
CLOUD COMPUTING PROBLEMS
 Most security problems stem from:
 Loss of control
 Lack of trust
 Multi-tenancy
 These problems exist mainly in 3rd party management
models
 Self-managed clouds still have security issues, but not
related to above

21
DEFINING SECURITY IN CLOUD
Confidentiality
Integrity
Audited code, Access
control and distributed
systems
Availability/
Assurance
Accountability
Identity, authentication
& access control
Resilience
Redundancy,
diversification, forensic
capacity
Source: NIST

22
DATA SECURITY AND STORAGE
Data-in-transit
(secure protocols & Encryption, TLS)
Data-at-rest
(Homomorphic encryption)
Processing of Data
(Multi-tenancy)

23
PRIVATE CLOUD VS. PUBLIC CLOUD

24
CLOUD-BASED ATTACKS AND OUTAGES

25
SONY’S ATTACK
 The Sony Pictures Entertainment hack was a release of confidential data
belonging to Sony Pictures Entertainment on November 24, 2014
 On September 1, 2015, plaintiffs and Sony reached an agreement in principle
to settle all of the claims of the putative class against SPE (Sony Pictures
Entertainment)

26
VERIZON CLOUD OUTAGE
 Verizon (VZ) shut down its cloud infrastructure-as-a-service (IaaS) for roughly
40 hours in January 2015.
 While a cloud provider's worst fear is a prolonged outage, Verizon
Communications stunned customers by scheduling to take its cloud offline
for some 40 hours over the weekend to implement a comprehensive system
maintenance project.
 One reason for the upgrade of its cloud infrastructure, ironically, was to
prevent future outages.
 While many customers were peeved their provider intentionally cut their
cloud service, some took solace knowing Verizon spent those 40 hours
adding seamless upgrade capabilities that would enable future upgrades to
be executed on live systems without disruptions, or even the need to be
reboot servers.

27
GOOGLE COMPUTE ENGINE OUTAGE
 Multiple zones of Google's IaaS offering went down just before midnight of
Feb 18th, 2015. After about an hour of downtime, service for most affected
customers returned around 1 a.m. the next morning.
 While some connectivity issues lasted almost three hours, there were roughly
40 minutes during which most outbound data packets being sent by Google
Compute Engine virtual machines were ending up in the wind.
 Google said the problem was "unacceptable" and apologized to users who
were affected.

28
AOL OUTAGE
 On 2015 February 19, apparently some people were actually affected when
AOL’s email service suffered a widespread outage beginning around 4 a.m.
Eastern.
 The problem, which started in the U.K. and spread to the U.S., made it
impossible for many AOL users to log in to their accounts.
 While the AOL jokes come easy, there were real complaints online from
people still using the vintage email addresses. AOL said a network issue was
at fault.

29
AMAZON OUTAGE #1
 In April 2011, Amazon EC2 went offline due to a network configuration
problem.
 Companies such as Foursquare, Quora, Reddit were offline for 12-48 hrs.
 Companies that had invested in multiple availability zones were less affected
(e.g. Netflix).
 Amazon provided 10 days credit to the companies as compensation.

30
AMAZON OUTAGE #2
 In August 2011, a lightning strike in Dublin caused a datacenter blackout for
24-48 hrs.
 Due to the sudden failure, data in many servers was in an inconsistent state.
 EBS (Elastic Block Storage) services were affected; but EC2 remained online so
this did not count as downtime under the SLA.
 These incidents raised serious doubts about the future of cloud.

31
LESSONS LEARNED
 Manage risks and prepare for failure just as you would with traditional IT.
 Utilize multiple availability zones and multiple regions.
 Design the SLAs carefully.
 Do not take your provider’s assurances for granted.
 Design for the cloud computing model and supplement the resilience of the
cloud provider.

32
At Broad Level,
Three major question are:
 How secure is the data?
 How secure is the code?
 How secure is the infrastructure?
RESEARCH QUESTION

33
TRENDS ASSOCIATED WITH CLOUD
SECURITY
 Increasing Partnerships between CSPs and Security Solution Providers
Expected
 Increasing Emergence of Cloud Service-specific Security Solution Providers
 Identity Management and Encryption to Remain the Top Cloud Security
Solutions Offered
 Increasing Availability of Cloud Security Solutions for Small and Medium-
sized Businesses (SMBs)
 Emergence of Strong Cloud Security Standard and Guidelines

34
GARTNER FORECAST

35
GLOBAL CLOUD SECURITY SOFTWARE MARKET AS
A PERCENTAGE OF GLOBAL IT
SECURITY SOFTWARE MARKET 2010 AND 2014
Source: TechNavio Analysis

36
CSA ENTERPRISE ARCHITECTURE
 The Trusted Cloud Initiative Reference Architecture is both a methodology
and a set of tools that enables security architects, and risk management
professionals to leverage a common set of solutions.
 These solutions fulfill a set of common requirements that risk managers must
assess regarding the operational status of internal IT security and cloud
provider controls.

37
CSA ENTERPRISE ARCHITECTURE

38
COMMERCIAL VENDOR SOLUTIONS
 Trend Micro SecureCloud
 AppRiver SaaS-based e-mail and Web security tools
 Awareness Technologies
 Barracuda Web Security Flex
 CloudPassage Halo SVM and Halo Firewall
 M86 Security - Secure Web Service Hybrid
 Panda Cloud Protection
 SafeNet's Trusted Cloud Fabric
 Symantec. Cloud Services

39
TREND MICRO - SECURITY AS A
SERVICE
 Cloud-hosted security solutions from Trend Micro
 With cloud-based security, you eliminate the cost and hassle of provisioning, managing, and
scaling security hardware and software. And you ensure fast, consistent delivery of the
newest security technologies and updates, helping you stay compliant and reduce risk.
 Key Features:
 Hosted Email Security
 Intrusion Detection and Prevention
 Firewall
 Anti-Malware
 Web Reputation
 Log Inspection
 Integrity Monitoring
 Deep Security as a Service

40
SYMANTEC PROTECTED CLOUDS
 Symantec protects the cloud and gives you the confidence you need
in your cloud initiatives – whether you are directly consuming cloud
services, building your own cloud, or extending your IT operations to
include other clouds.
 Key Features:
 Symantec™ Email Security.cloud
 Symantec™ Email Encryption.cloud
 Symantec™ Instant Messaging Security.cloud
 Symantec Enterprise Vault.cloud™
 Symantec™ Email Continuity.cloud
 Symantec Backup Exec.cloud™

41
CLOUDPASSAGE HALO SVM
AND HALO FIREWALL
 The industry's first server security and compliance products purpose-built for
elastic cloud environments. These products deliver fast, easy and highly accurate
server exposure assessment, configuration compliance monitoring and network
access control - automating the three most fundamental practices for securing
servers in public and hybrid clouds.
 Key Features:
 Configuration security monitoring
 Multi-factor Authentication
 Software Vulnerability Assessment
 Workload Firewall Management
 Server Access Management
 File Integrity Monitoring
 Event Logging & Alerting

42
CLOUDPASSAGE HALO SVM
AND HALO FIREWALL

43
BARRACUDA WEB SECURITY
FLEX
 Cloud-Based Web Content Filtering and Malware Protection
 As a cloud-based service, Barracuda Web Security Service provides a
convenient option to deploy Barracuda's powerful web security
technology for organizations looking to leverage the scalability and
flexibility of the cloud. Ideal for safeguarding users on and off the
network, the solution unites award-winning spyware, malware, and virus
protection with a powerful policy and reporting engine.
 Key Features:
 Spyware and Virus Protection
 Barracuda Central
 Application Control

44
 There are undoubtedly risks associated with the use of
Cloud-based services, just as there are risks associated
other delivery models.
Source: Capgemini

45
WHAT IS “CYBERSECURITY?”

46
“No foreign nation, no hacker, should be able to shut down our networks, steal our
trade secrets, or invade the privacy of American families, especially our kids. We
are making sure our government integrates intelligence to combat cyber threats,
just as we have done to combat terrorism, and tonight, I urge this Congress to
finally pass the legislation we need to better meet the evolving threat of cyber-
attacks, combat identity theft, and protect our children’s information. If we don’t
act, we’ll leave our nation and our economy vulnerable. If we do, we can continue
to protect the technologies that have unleashed untold opportunities for people
around the globe”

47
WEAPONS OF MASS
DISRUPTION?

48
Date (2014) Company Number of records
exposed
Types of records
25 Jan Michael’s 2,600,000 Payment cards
6 Feb Home Depot 20,000 Employee info
14 Mar Sally Beauty Supply 25,000 Credit/debit card
17 Apr Aaron Brothers 400,000 Payment cards
22 Apr Lowa state University 48,729 Student social security
numbers
30 May Home depot 30,000 Credit/debit card
22 Jul Goodwill Industries 868,000 Payment systems
18 Aug Community Health Systems 4,500,000 Patient data
21 Aug United Postal Service 105,000 Credit/debit card
28 Aug JP Morgan Chase 1,000,000 Financial information
2 Sep Home Depot 56,000,000 Credit/debit card
2 Sep Viator/Trip Advisor 880,000 Payment cards
25 Sep Central Dermatology 76,258 Patient data
7 Nov Home Depot 53,000,000 Email addresses
10 Nov US Postal service 800,000 Personal data
18 Nov Staples 1.200,000 Credit/debit card

49
Source: Scalar

50
Source: Scalar

51
CATEGORIES OF CYBERCRIME
 The Computer as a Target : using a computer to attack other computers.
 The computer as a weapon : using a computer to commit real world crimes.

52
TYPES OF CYBER CRIME
 HACKING
 CHILD PORNOGRAPHY
 DENIAL OF SERVICE ATTACK
 COMPUTER VANDALISM
 CYBER TERRORISM
 CYBER ESPIONAGE
 CYBER FRAUD AND RANSON
 SOFTWARE PIRACY

53
TYPES OF CYBER ATTACKS
 Financial fraud: 11%
 Sabotage of data/networks: 17%
 Theft of proprietary information: 20%
 System penetration from the outside: 25%
 Denial of service: 27%
 Unauthorized access by insiders: 71%
 Employee abuse of internet privileges: 79%
 Viruses: 85%
Source: FBI

54
 cybersecurity = security of cyberspace
information systems
and networks
ONE WAY TO THINK ABOUT IT

55
 cybersecurity = security of information systems and
networks
+ with the goal of
protecting
operations and
assets

56
networks with the goal of protecting operations and
assets
security in the face of
attacks, accidents and
failures

57
networks in the face of attacks, accidents and failures with
the goal of protecting operations and assets
availability, integrity
and secrecy

58
IN CONTEXT
 corporate cybersecurity = availability, integrity and secrecy
of information systems and networks in the face of attacks,
accidents and failures with the goal of protecting a
corporation’s operations and assets
 national cybersecurity = availability, integrity and secrecy of
the information systems and networks in the face of attacks,
accidents and failures with the goal of protecting a nation’s
operations and assets

59
WHAT IS
HAPPENING…

60
INCREASING DEPENDENCE
 We are increasingly dependent on the Internet:
 Directly
 Communication (Email, IM, VoIP)
 Commerce (business, banking, e-commerce, etc)
 Control systems (public utilities, etc)
 Information and entertainment
 Sensitive data stored on the Internet
 Indirectly
 Biz, Edu, Gov have permanently replaced physical/manual
processes with Internet-based processes
Source: CalTech

61
SECURITY NOT A PRIORITY
 Other design priorities often trump security:
Cost
Speed
Convenience
Open Architecture
Backwards Compatibility

62
CYBERSECURITY ROADBLOCKS
 Not enough metrics to measure security
 Internet is inherently international
 Private sector owns most of the infrastructure
 “Cybersecurity Gap”: a cost/incentive disconnect?
 Businesses will pay to meet business imperatives
 Who’s going to pay to meet national security imperatives?

63
THE CHALLENGE
 A solution to this problem will require both the right
technology and the right public policy.
 This is the cybersecurity challenge.

64
IOT - EVERYTHING CAN BE
HACKED!
 Any device with an operating system can
be hacked, be it a thermostat, TV or even
a toilet.
 In recent years, consumers have generally
been wise enough to protect their
computers from cybercriminals and
harmful software.
 But their household electronics are
woefully unprepared for the next wave of
cyber attacks.
 Consumers are inviting whole new wave
of security risks into their homes even
without realizing it.

65
RISKS ARE CONTEXT-AWARE
AND SITUATIONAL
 Concerning the identification of privacy, data protection and
security risks, it depends on the context and the purpose of
the objects that are considered (E.g. Health, Geo Location).
 The more the individuals are involved in the process, the
more it becomes difficult to identify and assess.
 For example, in Smart Home and Smart Grid applications,
how to ensure that some principles of privacy and data
protection, like informed consent and data minimization,
can survive in an automated and open environment.

66
TRACEABILITY, PROFILING OR
UNLAWFUL PROCESSING
 The increased collection of data may raise issues of
authentication and trust in the objects.
 By using information collected about and from multiple
objects related to a single person, that person may become
more easily identifiable and better known.

67
HEALTH RELATED IMPLICATIONS
 High dependability on the cloud, big data technologies in eHealth creates
significant security and privacy risks.
 There are risks with respect to patient identification and reliability of
collected information.
 The information gathered from the cloud system/database used in a health
application could also reveal that the person suffers from specific diseases
and this could be used for physically attacking this person.

68
2035?
Each person to be surrounded by
3,000 to 5,000 connected everyday things?

69
OPERATIONAL INTELLIGENCE - IOT

70
IT WILL CHANGE OUR LIVES

71
THANK YOU

Dawn of the Intelligence Age by Dr. Anton Ravindran

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Dawn of the Intelligence Age by Dr. Anton Ravindran

Semelhante a Dawn of the Intelligence Age by Dr. Anton Ravindran (20)

Mais de GSTF

Mais de GSTF (8)

Último

Último (20)

Dawn of the Intelligence Age by Dr. Anton Ravindran