Data security strategies and drivers
Download as PPTX, PDF1 like2,329 views
The document discusses current trends and challenges in data security and encryption, highlighting the importance of addressing risks associated with data management and the need for a cohesive security culture within organizations. It emphasizes the necessity of recognizing and managing security responsibilities, implementing effective encryption and key management strategies, and educating staff on security practices. The future of encryption is projected to involve broader adoption across various platforms, while the importance of established standards and best practices is acknowledged for successful implementation.
Data security strategies and drivers
- 1. Data Security Trends and ObservationsTony LockFreeform Dynamics Ltdtony@freeformdynamics.comApril, 2010www.freeformdynamics.com
- 2. AgendaBusiness Drivers Influencing IT SecurityProtecting DataThe Future of Encryption
- 3. Today, business want to…Reduce costsLeverage existing investmentsRationalise infrastructure / Reduce power consumption ‘Optimise everything’!Increase agilityAccess information on demandSupport new business initiatives quickly & effectivelyManage riskLegal & regulatory / Security and privacyContinuity / resilienceProtect brandBe good corporate citizensGovernance / External obligationsRetain Customer trust and satisfaction
- 4. Encryption and Key Management 4043372030755980512726843227940121734585012 7154539691420762 597242857594404736383206 864822559884522781272859586310783041215189039722995842274740595660911438608619370523665877168914807728150100036532892988233489229168412298957399856995916007784076516717934157958922080355531822072807338276962545494762362555017379346840089604010135260723134336771684303126571878448235124194684200289197340444389979954931395248708578295236216355137975564230921803957049782011111357
- 5. Why is security important?
- 6. New risksExternal annoyances (Spam, virus, Drive by web infections, general Phishing, etc.)Targeted crime (Hackers, Targeted phishing etc.)Third parties inside the firewall breaching securityStaff breaching security by designStaff / Third parties breaching security by accident – Information leakage
- 8. To what degree do you consider these specific risks during business planning?
- 9. Has regulatory compliance been a specific driver in the following areas?
- 10. Generally speaking, when you add everything up, how is your spending on IT risk related investments such as security and information management changing?
- 11. AgendaBusiness Drivers Influencing IT SecurityProtecting DataThe Future of Encryption
- 13. How easy is it to control the potential security risk arising from the proliferation of confidential data across different machines and locations?
- 14. How important are the following when considering the need to secure confidential information?
- 15. What is holding “Data Security” back?Link to lack of accurate knowledge
- 16. Mixed IT infrastructure deployed
- 17. Who has “access” to data, especially those with escalated privileges
- 18. Who is using each service and who should be?
- 19. Encryption. where used, is deployed piecemeal not across all systems
- 20. Lack of process to manage solutions
- 21. Lack of awareness that solutions are now available for a wide range of challengesThe role of Encryption and Key ManagementToday encryption has been implemented in a piecemeal fashionBit by bitNo central management or strategyKey management left to individuals or groupsEncryption will, ultimately, be rolled out to address all of the highlighted risk areasKey desktops and laptopsStorage arraysMobile DevicesProblems will occurAnd very, very visibly
- 22. AgendaBusiness Drivers Influencing IT SecurityProtecting DataThe Future of Encryption
- 23. Moving “Data Security” and encryption Forward? Define who is responsible for security
- 24. How should policy be set?
- 25. IT, The Businessand Security partners
- 26. Set how to create / handle security Procedures?
- 28. Encryption and key management
- 29. Make as transparent as possible to users
- 30. Ensure staff know what is permitted in data security management
- 31. Until these are addressed, change will be difficult and risks will not be managedProcess, process, processProcessDefine Processes for securityTry to standardise on solutionsMake sure everyone understands security threats and the consequencesMake sure that routines / procedures are in place to manage all aspects of securityEspecially for mobile / home workers.Create a feeling of responsibility for securityTrain / Train / Train / Communicate
- 32. Overall mix of concerns relating to adoption of latest technologies and working practicesEncryption can help address these issues
- 33. The Future of EncryptionUse of Encryption will spread, and soon
- 34. Silo by Silo
- 35. Storage, Desktops, Mobile Devices, Applications
- 36. Data at Rest, Data in Motion
- 37. Ultimately encryption will become “expected”
- 38. The importance of key management will be recognised
- 39. But not to begin with
- 40. Education will be required or “incidents will happen”
- 41. Standards (ISO 7498-2, ISO 17799 etc.) are important
- 42. But customers will need to move before all standards are finalised and in place.
- 43. Best practice / experience is valued along with advice on where to start.Where to start with Securing Enterprise Data?Know where data is stored, who is using it and why
- 44. Storage platforms / Desktops / Applications / Networks
- 45. Combine asset management / identity / encryption and key management
- 46. Define roles and responsibilities for data governance
- 47. Create policies for data management and security
- 49. And make sure everyone understands and follows them
- 50. Audit data access and alteration
- 52. Personal / Device / Service / Application
- 53. Get good Management Procedures in place, especially for encryption key managementThank You!Any Questions?Tony LockFreeform Dynamics Ltdtony@freeformdynamics.comApril, 2010www.freeformdynamics.com
Editor's Notes
- #8: RM – this slides covers the same topics as slide 6, should they be together?
- #13: RM – starting to get statistic overload by this point!
- #16: RM – this overlaps with slide 16, maybe rephrase the two as one focused on the goal and the other on barriers to deployment
- #17: RM – I like the first bullet, but it feels like a sweeping statement, are you going to provide more context – seems we have jumped from fairly generic stats to very specific predictions
- #22: RM – This is an important messaging slide, need to make sure these points get across. The best practices point is important and the fact that experience with early (high security) adopters like banks sets Thales and it’s partners up very well to take crypto to the mainstream. Is it possible to say more about timing and ordering of technology adoption – like storage before application level protection. What about role of standards and other critical success factors?