Baixar para ler offline
Carregado porStenio Ferreira
Lgpd webinar hashitalks brasil 2020
A LGPD exige que empresas mapeiem dados pessoais, estabeleçam uma base jurídica para protegê-los e implementem governança interna nomeando um DPO. O documento discute como o Vault da HashiCorp pode ajudar empresas a atender aos requisitos da LGPD em três casos: privacidade por design, separação de responsabilidades e transferência internacional de dados.
Lgpd webinar hashitalks brasil 2020
- 1. Copyright © 2019HashiCorp LGPD e Desafios de Segurança na Época de Transformação Digital Stenio Ferreira– SE @ Hashicorp
- 2. Copyright © 2020HashiCorp ∕ Agenda LGPD em 30 segundos Contexto “Transformação Digital” e visão Hashicorp Vault em 30 segundos Casos de Uso LGPD - Privacy by Design - Separação de Responsabilidades - Transferência Internacional
- 3. Copyright © 2019HashiCorp LGPD Lei Geral de Proteção de Dados
- 4. Copyright © 2020HashiCorp ∕ Sumario LGPD Requerimentos para empresas: - Mapear os dados, seu fluxo e tratamento; - Estabelecer uma base jurídica para proteger a organização; - Implementar a governança interna, definindo um DPO (Data Protection Officer) Objetivo: Estabelecer estrutura regulatoria para os requerimentos de segurança e governança de dados pessoais de cidadãos brasileiros, e as responsabilidades legais de empresas que utilizam ou tem acesso a esses dados.
- 5. Copyright © 2020HashiCorp ∕ Referencias Lei http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709.htm EBook - Lei comentada https://www.livrariart.com.br/ebook-lgpd-lei-geral-de-protecao-de-dados-comentada-2-edicao/p Infograficos https://opiceblum.com.br/wp-content/uploads/2019/07/LGPD_16infograficos_31.08.2020.pdf
- 6. Copyright © 2020HashiCorp ∕ Webinar https://www.hashicorp.com/events/webinars/lgpd-e-desafios-de-seguranca-na-epoca-de-transformacao-digital Conteudo: • Sumario da LGPD • Situação atual (Outubro 2020) • Referências
- 7. Copyright © 2019HashiCorp Transformação Digital
- 8. Copyright © 2020HashiCorp ∕ Transição para Multi-Nuvem Copyright © 2020 HashiCorp ∕ 8 Datacenter Tradicional “Estático” Infraestrutura Dedicada Datacenter Moderno “Dinâmico” AWS Azure GCP+ + +Private Cloud + SYSTEMS OF RECORD SYSTEMS OF ENGAGEMENT “Ticket-based” “Self-service”
- 9. ∕Copyright © 2019HashiCorpCopyright © 2018 HashiCorp ∕ 9 Modelo Operacional Unificado Para Cargas de Trabalho Distribuídas C++ Provision Operations Secure Security Run Development Connect Networking Private Cloud AWS Azure GCP
- 10. Copyright © 2020HashiCorp ∕ Transição para Multi-Nuvem Copyright © 2020 HashiCorp ∕ 10
- 11. Copyright © 2020HashiCorp ∕ Transição para Multi-Nuvem Copyright © 2020 HashiCorp ∕ 11
- 12. Copyright © 2019HashiCorp Hashicorp Vault
- 13. Copyright © 2020HashiCorp ∕ Como Vault Funciona 13∕ Autenticação: Vault controla o acesso a segredos e chaves de criptografia por meio da autenticação em fontes confiáveis de identidade, como Active Directory, LDAP e identidade em nuvem. Autorização: Vault permite a autorização granular de quais usuários e aplicativos têm permissão para acessar segredos e chaves. Arquitetura: Vault possui arquitetura modular, podendo ser executado em modo de alta disponibilidade, sendo ideal para cargas de trabalho distribuídas e automatizadas
- 14. Copyright © 2019HashiCorp Casos de Uso LGPD
- 15. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 15 Privacy By Design Exemplo: • Informações sensíveis em Banco de Dados. • Banco de Dados encriptado • Acesso ao Banco de Dados restrito Desafios: • O que ocorre se a chave de criptografia do Banco de Dados for comprometida? • Como permitir acesso a usuários porem protegendo confidencialidade de dados? • Como implementar cyber shredding/ direito de ser esquecido?
- 16. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 16 Privacy By Design Solução: • Não somente Banco de Dados criptografado, porem dados também criptografados • Chaves de criptografia gerenciadas centralmente utilizando Hashicorp Vault • Suporta criação de chaves derivadas, que permitem criação de chaves de criptografia distintas para cada usuário Funcionalidades Vault: • Transit Secret Engine • Transform Secret Engine • KMIP Secret Engine
- 17. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 17 Privacy By Design Exemplo • Transit Secret Engine demo: https://learn.hashicorp.com/tutorials/vault/eaas-transit • Mostra funcionalidade encryption as a service • Em um exemplo prático, um cliente pode usar Vault para encriptar dados antes de armazenar em um banco de dados
- 18. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 18 Separação de Responsabilidades Exemplo: • Necessário garantir que usuários tenham mínimo acesso possível. • Habilidade de descrever hierarquias de aprovação de acesso entre Operador e Controlador • Permitir separação de dados sensíveis entre diferentes áreas da empresa Desafios: • Como gerenciar permissões de acesso de maneira centralizada? • Como implementar workflows de aprovação de acesso? • Como permitir multitenancy de maneira segura?
- 19. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 19 Solução: • Cada usuário ou grupo de Vault tem politicas de acesso claramente definidas • É possível definir workflows de aprovação para acesso a segredos • Suporta criação de Namespaces para segregar grupos de usuários, projetos ou departamentos dentro de uma organização Funcionalidades Vault: • ACL Policies • Control Groups • Namespaces Separação de Responsabilidades
- 20. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 20 Exemplo 1 • ACL Policies demo: https://learn.hashicorp.com/tutorials/vault/policies?in=vault/interactive • Em um caso real, permite implementar politica de minimo acesso possivel Exemplo 2 • Referencia Control Groups: https://learn.hashicorp.com/tutorials/vault/control-groups?in=vault/policies • Em um caso real, poderia ser utilizado para descrever fluxo de aprovação para que um cliente tenha acesso a um segredo mais restrito Separação de Responsabilidades (Requer Vault Enterprise)
- 21. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 21 Transferência Internacional Exemplo: • Necessário garantir que certos segredos não deixem território nacional • Ao mesmo tempo, deve suportar gerenciamento centralizado de arquiteturas distribuídas • Deve armazenar informações sensíveis de maneira segura em transito e em repouso Desafios: • Como especificar quais grupos de segredos necessitam controles especiais? • Como gerenciar uma arquitetura de larga escala cloud? • Como garantir segurança de informações sensíveis?
- 22. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 22 Solução: • Identificar grupos de segredos que não serão replicados a datacenter ou plataformas cloud externas • Permitir visão e gerenciamento centralizado de workflows de segurança independente da localização do datacenter ou plataforma cloud • Oferecer encriptação em repouso e em transito Funcionalidades Vault: • Performance Replication • Mount Filters • Encriptação AES 256 GCM-96, com TLS default Transferência Internacional
- 23. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 23 Exemplo • Vault Performance Replication/ Mount Filter demo: https://github.com/hashicorp/vault-guides/tree/master/operations/local-replication • Exemplo: Tem um cluster Vault em AWS sa-east-1 e outro em us-east-1, quer garantir que algum PII (personable identified information) nao deixa o territorio nacional do Brasil Transferência Internacional (Requer Vault Enterprise)
- 24. Copyright © 2020HashiCorp ∕Copyright © 2020 HashiCorp ∕ 24 • LPGPD é uma realidade, e somente formaliza boas praticas de mercado • Eventuais custos de conformidade serão menores que custos com incidentes de segurança • Hashicorp Vault permite cumprir com requerimentos de segurança em workflows de automação/devops • Planejamento de adequação a LGPD posicionará empresas para se tornarem mais competitivas no mercado moderno Conclusão
- 25. ∕Copyright © 2019HashiCorp 25 www.hashicorp.com stenio@hashicorp.com Obrigado!
Notas do Editor
- #3 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #5 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #6 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #7 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #9 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #11 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #12 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #14 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #16 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #17 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #18 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #19 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #20 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #21 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #22 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #23 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #24 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- #25 Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.