sf safe journey to the cloud netuse · 2018-09-24 · what used to take weeks takes minutes with...

Stephan FritscheCloud SecurityCloud Guard IaaS Sales Manager Central Europe

SAFE JOURNEY TO THE CLOUD

Stephan FritscheCloud Guard IaaS Sales Manager Central Europe

Check Point Software Technologies GmbHZeppelinstr. 1, D-85399 Hallbergmoos

Phone: +49 151 4221 4988E-Mail: sfritsche@checkpoint.com

Times are changing

“The illiterate of the 21st century will not be those who cannot read and write, but those who cannot learn, unlearn, and relearn. ”

Alvin Toffler

FROM DATA CENTER TO CLOUD

DATA CENTER WHAT USED TO TAKE WEEKS TAKES MINUTES WITH CLOUD

WELCOME TO THE CLOUD

Revenues Continue to ClimbIaaSSaaSPaaS

https://www.skyhighnetworks.com/cloud-security-blog/microsoft-azure-closes-iaas-adoption-gap-with-amazon-aws/

Cloud Market

CLOUD DIVERSITY67% OF ENTERPRISES ARE IN HYBRID CLOUD MODEL. MULTI CLOUD BECOMING THE NORMRightScaleSECURITY40% OF ENTERPRISES RATE CLOUD SECURITY AS SIGNIFICANTCHALLENGERightScale 2017

THE CLOUD IS HERE

ADOPTION GROWTH80% OF ENTERPRISES ARE COMMITTED TO CLOUD STRATEGY BY 2017IDCCLOUD COMPUTING MARKET TO REACH $170B BY 2020Gartner

NEW TECHCONTAINERS MARKET TO REACH $3.5B AND SERVERLESS $8B BY 2021Gartner and 451 Research

THE CLOUD IS HERE

Infrastructure DiversityIOT

XaaS – “X” As a Service

The Global Risks Report 2018

STATE OF CLOUD CYBER SECURITY

esecurityplanet.com, September 19, 2017 pcmag.com, July 7, 2017

Lightreading.com – September 5, 2017Gizmodo.com – September 19, 2017 Scmagazine.com, September 5, 2017

ZDNet.com, August 16, 2017

WHO’S RESPONSIBLE FOR CLOUD SECURITY?WHO’S RESPONSIBLE FOR CLOUD SECURITY?[PROTECTED] Distribution or Modification is subject to approval

Traditional Security Not Designed FOR CLOUDStatic workloadsManually intensiveDevOps don't know SecurityIT Security doesn't know Cloud

Customer responsible for security in the cloudCloud vendor responsible for security of the cloud

Cloud = Shared Responsibility

Cloud Global Infrastructure RegionsAvailability Zones Edge LocationsCompute Storage Database Networking

Customer DataPlatform, Applications, IAMOperating System, Network and FW ConfigsClient-side Data Encryption & Data Integrity Authentication Server-side Encryption (File System / Data) Network Traffic Protection (Encryption, Integrity, Identity)

NO Threat Prevention in real time (L4-L7 protections)NO unified management for all Clouds & Traditional Data CenterNO Identity based authentication access to applicationsNO URL FilteringNO Threat Extraction and Zero-day Sanboxing

WHERE CLOUD NATIVE SECURITY FALLS SHORT

Generations of Attacks and ProtectionsGen I Late 1980s –PC attacks - standaloneVirusGen II Mid 1990s –Attacks from the internetNetworksGen III Early 2000s -Exploiting vulnerabilities in applicationsApplications

The Anti Virus The Anti Virus The FirewallThe FirewallIntrusion Prevention (IPS) Intrusion Prevention (IPS)

Gen IV 2010 -Polymorphic ContentPayload SandBoxingand Anti-BotSandBoxingand Anti-Bot

Where are we ?

1990 2000 2010 2015 2017

THREATS

PROTECTIONSNetworksGen II Applications

Gen III PayloadGen IV

GRADE IGRADE IIGRADE IIIGRADE VGRADE IV

VirusGen I Enterprises are between Gen 2-32.8

MegaGen V

Lateral threat movements Data breach due to misconfiguration Abuse of cloud services API hacking Malicious insiders

THIS MIGHT EXPOSE YOU TO…

4 STEPS TO SECURE YOUR CLOUD

STEP #1: CONTROL THE CLOUD PERIMETER •Use advanced threat prevention at the cloud perimeter•Securely connect your cloud with your on-premise environment

ON-PREMISE

STEP #2: SECURE THE CLOUD FROM THE INSIDE•Micro-segment your cloud to control inside communication •Prevent lateral threats movement between applications

STEP #3: MANAGE CONSISTENT SECURITY FOR HYBRID ENVIRONMENTS• Deploy unified security management for your hybrid cloud (On-Premise and Cloud)• Ensure policy consistency• Reduce operation cost

CLOUD ON-PREMISE

STEP #4: AUTOMATE YOUR SECURITY Security should be as elastic and dynamic as your cloud• Auto-provisioning via templates and APIs • Auto-scale security with Pay-as-you-Go• Adaptive to changes

ADAPTIVE SECURITYReduce Firewall Tickets by 60%

Telefonica: “vSEC adaptive security is a game changer.”

Check Point Access Policy Rule From To Application Action3 Finance_App1

(vCenter Object)Database_Group(NSX SecGroup)

MSSQL Allow4 HR_App2

(Open StackObject) Finance_Group(ACI EndPoint Group) CRM Allow

5 User_ID SAP_App(Azure Object) SAP Allow

Fast API connectLook for a security solution that talks to all major vendor Architectures

Security Workgroups

Public

PrivateFor AWS

For AzureFor NSX

For vCenter For ACIFor OpenStack

For Google

Consistent security policy and control across ALL Private and Public CloudsACI

THE CloudGuard FAMILY

CloudGuard IaaS FOR THE CLOUD

Infrastructure Security Next Generation Firewall & VPNApplication and Data Security Advanced Threat PreventionForensic Analysis

CloudVendor

Firewall

Anti-Virus

Anti-Bot

Application

Control

Threat

Emulation

Filtering

Utmost Protection from Modern Threats

‘Cloud Ready’ Unified Access Policy

Users Devices Applications Data Gateways Mobile Public Cloud Private Cloud

MICRO-SEGMENTATION WITH SUB-POLICIES* R80 Sub-Policies The only NGTP solution with policy designed for micro-segmented environment

SUCCESSMore than 3,500 customers world-wide use CloudGuard to secure their cloud

XERO is a global online accounting firm servicing over 1M accounts in AWS CloudGuard secures all their accounts in AWSAllegiant makes leisure travel affordableCloudGuard secures their new NSX-based Private Cloud

HAPPY CUSTOMERS

SUMMARYCloud is eating the worldBad guys are everywhereCloud Native Controls are good, but…Own your security!You can get burned when it’s cloudy, protect yourself!

CHECK POINT’S CLOUD SECURITY BLUEPRINT• Agile - security architecture that enables DevOps innovation• Efficient – adaptive policy and elastic operation • Multi-Clouds – unified security architecture for all environments

CHECK POINT’S CLOUD SECURITY BLUEPRINT

Spoke 1 Spoke 2 Spoke 3 Spoke N…

NorthboundHub

Southbound Hub

NorthboundHub

Southbound Hub

NorthboundHub

Southbound Hub

NorthboundHub

Southbound Hub

Spoke 1 Spoke 2 Spoke 3 Spoke N…VPN

CloudNorthbound-HUB

SPOKE-1 SPOKE-2

vSEC Auto-ScalevSEC-NvSEC-1SPOKE-N…

Southbound-HUBvSEC HAvSEC-2vSEC-1

WWWLoad Balancer

Load Balancer

Load BalancerSPOKE-3

Corporate

• North Bound Security is Auto-Scaled • Southbound Security is highly available • Supported Clouds

• Azure Transit- vNET• AWS Transit - VPC

ARCHITECTURE How To

THANK YOU

sf safe journey to the cloud netuse · 2018-09-24 · what used to take weeks takes minutes with...

Documents

building full-stack serverless applications · resource on...

digital transformation, - cloudsecusing serverless today...

bimodal / two speed it and cloud serverless microservice...

alibaba cloud serverless

polardb serverless: a cloud native database for

serverless - o'reilly...the future is serverless. on-prem...

tech update serverless apis with aws · serverless apis...

building a serverless api in the cloud

the serverless cloud @ jax london 2016

aws lambda and serverless cloud

seismic in the cloud - spe aberdeen€¦ · seismic in the...

basics of cloud computing – lecture 4 serverless ...ibm...

netuse web application framework kai voigt netuse ag...

real-time serverless: cloud resource management …...cloud...

building serverless data infrastructure in the aws cloud

container and serverless at edge connected to cloud€¦ ·...

new serverless world - cloud native apps

building serverless machine learning models in the cloud

introduction to serverless php - akrabat.com · serverless...

getting started with aws lambda and the serverless cloud