Upload
others
View
0
Download
0
Embed Size (px)
Citation preview
Joseph Lee
9th Apr. 2013
Data protection and Server security challenges of PCI DSS2.0
Source: Trend Micro
Source: Trend Micro, openclipart.org
Zero-day / APT Advanced Persistence Threat
Source: Trend Micro
CLOUD
VIRTUAL / CLOUD New Architecture
Physical 》 Virtual 》 Cloud
Virtual Server 50% - 71% Virtual Desktop 40% - 64%
Private Cloud 39% - 57% Public Cloud 38% - 53%
Source: Trend Micro, Gartner
72 % Servers will all be virtualized at 2014.
2011 Data Breach
96% of victims NOT PCI DSS compliant
• PCI DSS 2.0
84% of victim had Log of breach evidence
• Data Protection
94% of victim data comprised with Servers • Server Security
Compliant ? High Cost
Today’s Challenges -
High Risks
• Separate Data • Keep Arming • One Policy Fits All
Source: Trend Micro, PCI
• PCI DSS 2.0
–96% of victims NOT PCI DSS compliant
• Data Protection
• Server Security
PCI DSS Data Security Standard
Source: PCI, iStockPhoto
PCI DSS Data Security Standard
My company
Affiliates
Service Providers
Outsourcers
High Risk!
Source: PCI, iStockPhoto
PCI DSS 2.0 Requirement
1. Build & Maintain Secure Network
1) Install and maintain a Firewall configuration to protect cardholder data
2) Do not use vendor-supplied Defaults for system passwords and other security parameters
2. Protect Cardholder Data
3) Protect Stored cardholder data 4) Encrypt Transmission of cardholder data across open,
public networks 3. Maintain
Vulnerability mgmt. Program
5) Use and regularly Update Anti-Virus software or Programs
6) Develop and maintain Secure systems and applications
4. Implement Strong Access Control Measures
7) Restrict Access to cardholder data by business need to know
8) Assign a Unique ID to each person with computer access 9) Restrict Physical Access to cardholder data
5. Regular Monitor & Test Networks
10) Track and Monitor all access to network resources and cardholder data
11) Regularly Test security systems and processes 6. Maintain Info.
Security Policy 12) Maintain a Policy that addresses information security for
All Personnel
Source: Requirements and Security Assessment Procedures
PCI DSS 2.0 Requiremen
t Requirements Data Protection
(Data Life-Cycle) Server Security
(Virtual/Cloud) 1. Build & Maintain Secure Network Firewall, No default password/setting
1.2*, 1.4, 2.2, 2.4 1.x, 2.2.1, 2.2.2, 2.4,A.1*
2. Protect Cardholder Data Protect storage, Encrypt transmission
3.1, 3.2, 3.4, 3.5, 3.6, 4.1, 4.2
3. Maintain Vulnerability Management Program Patching for Anti-virus, System, and Apps
5.1, 5.2, 6.1, 6.2, 6.3*, 6.5*, 6.6
5.1*, 5.2*, 6.1*, 6.2*, 6.5*, 6.6
4. Implement Strong Access Control Measures Restrict (physical) access, Unique ID
9.7*, 9.9*
5. Regular Monitor & Test Networks Audit trial, File integrity
11.2 10.2*, 10.3*, 10.5, 10.6*, 11.2*, 11.4, 11.5
6. Maintain Information Security Policy Policy control, Intrusion
12.6, 12.9 12.6, 12.9*
* compensating controls http://apac.trendmicro.com/apac/solutions/enterprise/security-solutions/server-security/payment-card/requirements/index.html
Trend Micro Enterprise Security
PCI DSS 2.0 Requiremen
t Requirements Data Protection
(Data Life-Cycle) Server Security
(Virtual/Cloud) 1. Build & Maintain Secure Network Firewall, No default password/setting
1.2*, 1.4, 2.2, 2.4 1.x, 2.2.1, 2.2.2, 2.4,A.1*
2. Protect Cardholder Data Protect storage, Encrypt transmission
3.1, 3.2, 3.4, 3.5, 3.6, 4.1, 4.2
3. Maintain Vulnerability Management Program Patching for Anti-virus, System, and Apps
5.1, 5.2, 6.1, 6.2, 6.3*, 6.5*, 6.6
5.1*, 5.2*, 6.1*, 6.2*, 6.5*, 6.6
4. Implement Strong Access Control Measures Restrict (physical) access, Unique ID
9.7*, 9.9*
5. Regular Monitor & Test Networks Audit trial, File integrity
11.2 10.2*, 10.3*, 10.5, 10.6*, 11.2*, 11.4, 11.5
6. Maintain Information Security Policy Policy control, Intrusion
12.6, 12.9 12.6, 12.9*
http://apac.trendmicro.com/apac/solutions/enterprise/security-solutions/server-security/payment-card/requirements/index.html
Trend Micro Enterprise Security
Trend Micro 27%
Worldwide Corporate Endpoint Server Security Revenue Share by Vendor, 2011 Source: IDC,
2012
PCI Compliant Low Cost
Our Mission -
Low Risks
• Separate Data • Keep Arming • One Policy Fits All
X X
Source: Trend Micro, PCI
PCI DSS 2.0
• Data Protection
–84% of victim had Log of breach evidence
• Server Security
PCI DSS 2.0 Requirement Challenge - Keep Arming
1. Build & Maintain Secure Network
1) Install and maintain a firewall configuration to protect cardholder data 2) Do not use vendor-supplied defaults for system passwords and other security parameters
2. Protect Cardholder Data
3) Protect stored cardholder data 4) Encrypt transmission of cardholder data across open, public networks
3. Maintain Vulnerability mgmt. Program
5) Use and regularly update anti-virus software
or programs 6) Develop and maintain secure systems & applications
4. Implement Strong Access Control Measures
7) Restrict access to cardholder data by business need to know 8) Assign a unique ID to each person with computer access 9) Restrict physical access to cardholder data
5. Regular Monitor & Test Networks
10) Track and monitor all access to network resources and cardholder data
11) Regularly test security systems and processes
6. Maintain Info. Security Policy
12) Maintain a policy that addresses information security for all personnel
Source: Requirements and Security Assessment Procedures
http://apac.trendmicro.com/apac/about/news/pr/
Data Protection on Cloud
Trend Micro Great 2012 win!
77M users
800M users
10M users
94M users
Customers 》 Their Customers
Global Threat Intelligence
• Smart Protection Network™
• Web Security Service
• Mobile App Reputation
Data Encryption
• SecureCloud™
• SafeSync™
Trend Micro Smart Protection Network™
http://cloudsecurity.trendmicro.com/us/technology-innovation/our-technology/smart-protection-network/index.html http://www.trendmicro.com/cloud-content/us/pdfs/business/case-studies/cs_dubex_officescan-mobile-security-dlp.pdf
Cloud Security 》
6 TB / day threat data analyzed
16 B / day URL, Email, & File queries correlated
200 M / day threats blocked
Trend Micro Smart Protection Network™
http://cloudsecurity.trendmicro.com/us/technology-innovation/our-technology/smart-protection-network/index.html http://www.trendmicro.com/cloud-content/us/pdfs/business/case-studies/cs_dubex_officescan-mobile-security-dlp.pdf
New patterns Previous: 24 hrs Now: 20 min
Trend Micro Smart Protection Network™
•40% Management Cost Saved (by Osterman Research, Inc.)
• Self-Learning
http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_tmes_cc_impact.pdf http://cloudsecurity.trendmicro.com/us/technology-innovation/our-technology/smart-protection-network/index.html
http://www.trendmicro.com/cloud-content/us/pdfs/business/case-studies/cs_dubex_officescan-mobile-security-dlp.pdf
PCI DSS 2.0 Requirement Challenge - Separate Data
1. Build & Maintain Secure Network
1) Install and maintain a firewall configuration to protect cardholder data 2) Do not use vendor-supplied defaults for system passwords and other security
parameters
2. Protect Cardholder Data
3) Protect stored cardholder data
4) Encrypt transmission of cardholder data across open, public networks
3. Maintain Vulnerability mgmt. Program
5) Use and regularly update anti-virus software or programs 6) Develop and maintain secure systems and applications
4. Implement Strong Access Control Measures
7) Restrict access to cardholder data by business need to know
8) Assign a unique ID to each person with computer access
9) Restrict physical access to cardholder data
5. Regular Monitor & Test Networks
10) Track and monitor all access to network resources and cardholder data
11) Regularly test security systems and processes
6. Maintain Info. Security Policy
12) Maintain a policy that addresses information security for all personnel
Source: Requirements and Security Assessment Procedures
Separate Data?
http://cloud.trendmicro.com/building-a-truly-secure-cloud-with-dell-and-trend-micro/
Dell Cloud Service
http://cloud.trendmicro.com/building-a-truly-secure-cloud-with-dell-and-trend-micro/
AES 256 Encryption
Secure Key Exchange
Offsite Key Storage
Encrypted Data
Customer Support +
SecureCloud
Dell Cloud Service
Trend Micro SecureCloud
Separate Cardholder Data
Source: Trend Micro
vCloud®
Enterprise Key
Cloud Service Provider
Trend Micro SecureCloud
Console
Shared Storage
VM Corporate
App VM VM VM
Hypervisor
My Data
ESX, vSphere
Trend Micro SecureCloud Security Policies
1. Access Management
2. Device for Encryption
3. Running Instances
4. Policies & Rules: for Access & Protection
Source: Trend Micro
PCI DSS 2.0 Requirement Challenge - One Policy Fits All
1. Build & Maintain Secure Network
1) Install and maintain a firewall configuration to protect cardholder data 2) Do not use vendor-supplied defaults for system passwords and other security
parameters
2. Protect Cardholder Data
3) Protect stored cardholder data
4) Encrypt transmission of cardholder data across open, public networks
3. Maintain Vulnerability mgmt. Program
5) Use and regularly update anti-virus software or programs
6) Develop and maintain secure systems and applications
4. Implement Strong Access Control Measures
7) Restrict access to cardholder data by business need to know 8) Assign a unique ID to each person with computer access
9) Restrict physical access to cardholder data
5. Regular Monitor & Test Networks
10) Track and monitor all access to network resources and cardholder data
11) Regularly test security systems and processes
6. Maintain Info. Security Policy
12) Maintain a policy that addresses information security
for all personnel Source: Requirements and Security Assessment Procedures
Data Life-Cycle
Data Protection on Cloud
Encryption Device Control DLP
Source: Trend Micro
Gateway & Server DLP
Gateway Encryption
• DLP Network Monitor • Interscan Messaging Security
• ScanMail for Exchange/Lotus Domino • Threat Management Services
• Worry-Free Business Security Adv*
• Email Encryption Gateway • Interscan Messaging Security
• Hosted Email Encryption
Source: Trend Micro
Transmit Data
Life-Cycle of Data Protection
Secure Cloud
Gateway & Server DLP
Gateway Encryption
• DLP Network Monitor • Interscan Messaging Security
• ScanMail for Exchange/Lotus Domino • Threat Management Services
• Worry-Free Business Security Adv*
• Email Encryption Gateway • Interscan Messaging Security
• Hosted Email Encryption
• Deep Security – Deep Packet Inspection
• Vulnerability Management Services
Data Discovery
Web Site Protection
DLP
Integrity Monitoring
DLP Endpoint PortalProtect
Deep Security – Integrity Monitoring
SecureCloud™ SafeSync™
Source: Trend Micro
Transmit Data Store Data
Store Data
Life-Cycle of Data Protection
Secure Cloud
Gateway & Server DLP
Gateway Encryption
• DLP Network Monitor • Interscan Messaging Security
• ScanMail for Exchange/Lotus Domino • Threat Management Services
• Worry-Free Business Security Adv*
• Email Encryption Gateway • Interscan Messaging Security
• Hosted Email Encryption
• DLP Endpoint • OfficeScan
• Worry-Free Business Security Adv*
Media Encryption (File/Folder, Disk, Email,
Removable Media)
DLP & Device Control
• Endpoint Encryption • Email Encryption Client
• Deep Security – Deep Packet Inspection
• Vulnerability Management Services
Data Discovery
Web Site Protection
DLP
Integrity Monitoring
DLP Endpoint PortalProtect
Deep Security – Integrity Monitoring
SecureCloud™ SafeSync™
Source: Trend Micro
Process Data (Endpoint) Transmit Data Store Data
Store Data
Life-Cycle of Data Protection
Secure Cloud
Process Data (Endpoint) Transmit Data
Gateway & Server DLP
Gateway Encryption
• DLP Network Monitor • Interscan Messaging Security
• ScanMail for Exchange/Lotus Domino • Threat Management Services
• Worry-Free Business Security Adv*
• Email Encryption Gateway • Interscan Messaging Security
• Hosted Email Encryption
Store Data
Store Data
• DLP Endpoint • OfficeScan
• Worry-Free Business Security Adv*
Media Encryption (File/Folder, Disk, Email,
Removable Media)
DLP & Device Control
• Endpoint Encryption • Email Encryption Client
• Deep Security – Deep Packet Inspection
• Vulnerability Management Services
Data Discovery
Web Site Protection
DLP
Integrity Monitoring
DLP Endpoint PortalProtect
Deep Security – Integrity Monitoring
Threat Information, Policy Management
SIEM • SNMP • SYSLOG
Enterprise Security Manager
SecureCloud™ SafeSync™
Source: Trend Micro
Life-Cycle of Data Protection
ROI of Data Protection
http://www.trendmicro.com/us/marketing/roi-calculator/virtual-appliance/roi-calculator/index.html http://go.trendmicro.com/tco-calculator/
http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_tmes_cc_impact.pdf http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_osterman-virtualization.pdf
Benefits of Data Protection
Low Cost Centralized Administration
Performance Savings by Cloud Integration
Low Risks Persistent Data Protection
Latest Updated
PCI Compliant Separate Data
Maintain a Policy for all
PCI DSS 2.0
• Data Protection
• Server Security
–94% of victim data comprised with Servers
PCI DSS 2.0 Virtualization Guidelines
Source: PCI
PCI DSS 2.0 Virtualization Guidelines
Area of Responsibility Type of Cloud Service
IaaS PaaS SaaS
Data
Software, User applications
O/S, Databases Virtual Infrastructure
(hypervisor, virtual appliances, VMs, virtual networks etc)
Computer and Network Hardware (processor, memory, storage, cabling, etc.)
Data Center (physical facility)
Example of how scope and responsibility may differ by type of cloud service:
Cloud Service Provider
Cloud Customer
Source: PCI
Amazon Web Services™ Customer Agreement
4.2 Other Security and Backup. You are responsible for properly configuring and using the Service Offerings and taking your own
steps to maintain appropriate security, protection and backup of Your Content, which may include the use of encryption technology to
protect Your Content from unauthorized access and routine archiving Your Content.
http://aws.amazon.com/agreement/#4 (30 March 2011)
The cloud Customer has responsibility for Security and needs to plan for Protection.
Source: Amazon
PCI DSS 2.0 Requirement Challenge - One Policy Fits All
1. Build & Maintain Secure Network
1) Install and maintain a firewall configuration to protect cardholder data 2) Do not use vendor-supplied defaults for system passwords and other security
parameters
2. Protect Cardholder Data
3) Protect stored cardholder data 4) Encrypt transmission of cardholder data across open, public networks
3. Maintain Vulnerability mgmt. Program
5) Use and regularly update anti-virus software or programs
6) Develop and maintain secure systems and applications
4. Implement Strong Access Control Measures
7) Restrict access to cardholder data by business need to know 8) Assign a unique ID to each person with computer access 9) Restrict physical access to cardholder data
5. Regular Monitor & Test Networks
10) Track and monitor all access to network resources and cardholder data
11) Regularly test security systems and processes
6. Maintain Info. Security Policy
12) Maintain a policy that addresses information security
for all personnel
Source: Requirements and Security Assessment Procedures
Physical + Virtual + Cloud
Trend Micro Deep Security
Deep Packet Inspection
IDS / IPS Web App. Protection
Application Control
Firewall Integrity Monitoring
Anti- malware
Log Inspection
Source: Trend Micro
7 PCI Regulations, 20+ Sub-Controls
(1.) Network Segmentation
(1.x) Firewall
(5.x) Anti-virus
(6.1) Virtual Patching*
(6.6) Web App. Protection
(10.5) Daily Log Review
(11.4) IDS / IPS
(11.5) File Integrity Monitoring * Compensating Control
Source: Trend Micro
Deep Security for PCI compliance High Security & Low Management Cost
Source: Trend Micro
PCI DSS 2.0 Requirement Challenge - Keep Arming
1. Build & Maintain Secure Network
1) Install and maintain a firewall configuration to protect cardholder data 2) Do not use vendor-supplied defaults for system passwords and other security parameters
2. Protect Cardholder Data
3) Protect stored cardholder data 4) Encrypt transmission of cardholder data across open, public networks
3. Maintain Vulnerability mgmt. Program
5) Use and regularly update anti-virus software or programs
6) Develop and maintain secure systems & applications
4. Implement Strong Access Control Measures
7) Restrict access to cardholder data by business need to know 8) Assign a unique ID to each person with computer access 9) Restrict physical access to cardholder data
5. Regular Monitor & Test Networks
10) Track and monitor all access to network resources and cardholder data 11) Regularly test security systems and processes
6. Maintain Info. Security Policy
12) Maintain a policy that addresses information security
for all personnel
Source: Requirements and Security Assessment Procedures
09 AUG 2011… 7 important updates… 13.2MB… REBOOT REQUIRED
23 AUG 2011… 1 important update… 3.6MB… NO REBOOT
13 SEP 2011… 3 important updates… 65.4MB… NO REBOOT
11 OCT 2011… 4 important updates… 34.6MB… REBOOT REQUIRED
25 OCT 2011… 1 important update… 36K… NO REBOOT
08 NOV 2011… 2 important updates… 2.4MB… REBOOT REQUIRED
13 DEC 2011… 5 important updates… 26.1MB… REBOOT REQUIRED
29 DEC 2011… 3 important updates… 14.3MB… NO REBOOT
10 JAN 2012… 5 important updates… 19.1MB… REBOOT REQUIRED
Virtual Patching
DPI Rules
Addressing 7 PCI Regulations and 20+ Sub-Controls Including:
(1.) Network Segmentation
(1.x) Firewall
(5.x) Anti-virus
(6.1) Virtual Patching*
* Compensating Control
Source: Trend Micro, IT-Harvest, IDC, http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/virtual-patching-roi-calculator/index.html http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/virtual-patching-roi-calculator/index.html
Virtual Patching for PCI compliance High Productivity & Low Management Cost
Emergency patch Desktops Emergency patch Servers
Loss of Productivity
USD 2,340 USD 39,000 USD 65,000
USD 65 USD 65 USD 0
2,000 desktops, 150 servers, multiple apps. from vendors and self-development * Compensating Control
Agentless Protection
Virtual Patching Protection
Deep Security
VM VM VM
Previously - Agent
VM VM VM
Now - Agentless
VM
Source: Trend Micro
VM VM VM
Out-of-date
Secure Virtual
Appliance
Copyright 2009 Trend Micro Inc.
• SYMC/MFE consume 3x –12x more resources in sch. scans & could not handle more than 25 desktop VMs/host • DS supports 2-3 times no. of desktop VMs/host than traditional AV
• DS supports 40-60% more server VMs/host than traditional AV
Scheduled scan resource usage over baseline – 50 VMs per host
300% VM densities enabled by Deep Security
Source: Trend Micro, Tolly
273%
81%
307%
SYMC Trend MFE
MFE
2143%
692%
2053%
SYMC Trend MFE
MFE CPU IOPS
SYMC Trend SYMC Trend
Deep Security All-in-one Dashboard
Secure Virtual
Appliance VM VM
SVA & Protected Guests
VM VM VM
Antivirus
Trend Micro Deep Security
Integrity Monitoring
Log Inspection
Deep Packet Inspection
Agentless
Source: Trend Micro
Source: Trend Micro
ROI of Deep Security
Procedure Cost Savings Benefit
Initial Install/Setup 71% Faster deployment on new VMs. Very fast: as little as 2-3 minutes per VM
Ongoing Management 87% Patching is significantly easier. Very fast: can be accomplished with no downtime.
VM Density Improvement for VDI Efforts 35% Improved VM
density
http://www.computerlinks.co.uk/FMS/20685.new_research_from_osterman_research.pdf http://www.techdata.com/(S(i1afov45rbaolgu4ictxt5y5))/trendmicro/files/TREND%20MICRO_TCO%20WP03_DSAM_110302US.pdf
Benefits of Server Security
Low Cost Simplified Administration & Deployment
Higher VM Density & Performance Savings
Low Risks All-in-One
Latest Updated
PCI Compliant Maintain a Policy for all
Keep Arming
“Choosing solutions from a vendor like Trend Micro that understands cloud computing and helps us take advantage of it
— that just makes sense.”
Taylor Simpson, Co-owner, Good Harbor Vineyards
Source: Trend Micro