Crucial data privacy and protection insights for 2019 Richard - PowerPoint PPT Presentation

Crucial data privacy and protection insights for 2019 Richard Macaskill and Kendra Little

20 years Oracle and SQL Server experience Product Manager at Redgate Data Governance Richard Macaskill bolshevik! Richard.Macaskill@Red-Gate.com

Founder of SQL Workbooks Evangelist at Redgate Microsoft MVP & Microsoft Certified @Kendra_Little Master Kendra.Little@Red- Gate.com

Agenda

Compliance is shifting left

What do we mean by ‘Shift Left’?

Employers are responsible for employees’ actions

Organizations as a whole are responsible “If a business can’t show that good data protection is a cornerstone of their practices, they’re leaving themselves open to a fine or other enforcement action that could damage bank balance or business reputation.” Elizabeth Denham, UK Information Commissioner

https ps://a ://asset ssets.r s.red-gat gate.com e.com/pr /produc oducts ts/db dba/sq a/sql-clone/s clone/sql ql-ser erver-da datab tabase se-provi visioning sioning-repor eport. t.pdf pdf Microsoft Confidential

A few words on Static Data Masking Realistic Values – how useful are they? ➢ 1. Applications actually work for debug/test ➢ 2. Correlating & syncing values across columns Data rarely exists in isolation ➢ 3. Retaining table integrity post-masking Are there keys that should be masked? ‘Systems’ use multiple data sources ➢ 4. Cross-database & cross-server masking ➢ We can’t block our day’s work 5. Performance when masking large sets of data

Perimeter protection is no longer sufficient

• 53,000 incidents • 2,216 confirmed data breaches • 43,000 successful accesses involving botnets 2018 Data Breach Investigations Report · Verizon · https://enterprise.verizon.com/resources/reports/dbir/

2018 Data Breach Investigations Report · Verizon · https://enterprise.verizon.com/resources/reports/dbir/

2018 Data Breach Investigations Report · Verizon · https://enterprise.verizon.com/resources/reports/dbir/

2018 Data Breach Investigations Report · Verizon · https://enterprise.verizon.com/resources/reports/dbir/

DBAs are famous for having “zero trust” for developers

2018 Data Breach Investigations Report · Verizon · https://enterprise.verizon.com/resources/reports/dbir/

We need proactive, general “zero trust”

“There is a fatal flaw in the assumption… that there is a ‘trusted’ internal network where data is safe” The Future of Data Security: A Zero Trust Approach · John Kindervag, Heidi Shey, Kelley Mak, 2014 · Forrester Research, Inc.

Key takeaways Security must become data-centric A security and control framework should define, analyze, and protect the data Data breaches dangerously erode consumer trust The Future of Data Security: A Zero Trust Approach · John Kindervag, Heidi Shey, Kelley Mak, 2014 · Forrester Research, Inc.

Limit access Classify data Devalue or “kill” data using Dispose of data when no longer needed abstraction techniques The Future of Data Security: A Zero Trust Approach · John Kindervag, Heidi Shey, Kelley Mak, 2014 · Forrester Research, Inc.

“SQL Provision has given us the ability to mask data and push it out to multiple locations almost instantly. That saves hours compared to the way we used to refresh.” KEPRO: Ensuring HIPAA compliance with SQL Provision · Redgate · http://bit.ly/2RtUCoB

You risk overspending when you implement security controls

Executives have traditionally under -estimated risk relative to tech professionals

But that’s changing Source: Redgate-commissioned survey, 378 respondents in mid-large enterprises, senior roles

But that’s changing Source: https://uk.pcmag.com/feature/118088/gartners-cio-agenda-and-ceo-perspective-for-2019

Or misconstrued its nature

2018 Data Breach Investigations Report · Verizon · https://enterprise.verizon.com/resources/reports/dbir/

Alignment protects against over-spend

Discussion: chat on YouTube, Slack, or Twitter #sqlinthecity

Crucial DPP insights for 2019 1. Compliance is shifting left 2. Perimeter protection is no longer sufficient, adopt a “Zero Trust” mindset for your data 3. Alignment of developers, ops, and IT Managers protects against over spending when implementing security controls

Next steps Download the Data Contact Privacy Influencer PDF sales@red-gate.com red-gate.com/sitc

References & Resources 2018 Data Breach Investigations Report · Verizon · https://enterprise.verizon.com/resources/reports/dbir/ KEPRO: Ensuring HIPAA compliance with SQL Provision · Redgate · http://bit.ly/2RtUCoB SQL Provision adds fully integrated data masking · Redgate · https://www.red- gate.com/hub/product-learning/sql-provision/sql-provision-adds-fully-integrated- data-masking The Future of Data Security: A Zero Trust Approach · John Kindervag, Heidi Shey, Kelley Mak, 2014 · Forrester Research, Inc. Zero Trust: Your Knight In Cyber Armor · Forrester Research, Inc. · https://go.forrester.com/what-it-means/ep93-zero-trust-cyber-armor/