Technology to Protect Crown Jewels

Purpose This pack draws out extreme examples for protecting the Crown Jewels. The purpose of examining these extremes is to spark meaningful discussion to settle on an appropriate risk vs. cost vs. usable solution. Note, the extremes are not necessarily mutually exclusive. Hybrid solutions are possible.

Options Considered OptionDescription / Use Case Extremely Over Engineered Example (EOE 2 ) Secured nTier architecture included controls at each architecture tier and between each tier. Secure Collaboration Environment (SCE)A highly secured and tightly access controlled environment for collaboration of unstructured information. Broad Brush ApproachConfiguration of Network and Client ILP to detect movement of Crown Jewels – not specific to any single system. Identify exactly where it exists in our environment and secure it in place

Extremely Over Engineered Example Client Device Web Server Application Server Database ServerFile Server Firewall / Reverse Proxy Firewall Application Firewall Client NAC (ensure integrity of client) – Symantec Enterprise Protection Client ILP (monitor movement of data) Data sensitivity tags applied to unstructured documents from most sensitive file shares or applications DRM Client (create, render and access secure data) 2 factor for the client (1 factor is biometrics) Encrypt data on the client and on removable media Enable ILP to prevent DVD write and require secure USB for tagged files. 2 factor authentication SSL to both client and application server HID/HIP SIEM monitors logs Hardened configuration with patching Reverse Proxy authentication NAC Require GSK device with ILP to access data/application Control permitted traffic and content of traffic between web server and app server Generate DRM controlled documents/reports HID/HIP SIEM monitors logs Hardened configuration with patching Oracle Data Vault (type technology) Encryption HID/HIP SIEM monitors logs Additional level of enhanced database monitoring 2 factor for administrative access Encrypted File System Privileged accounts cannot decrypt HID/HIP SIEM monitors logs 2 factor for administrative access Controls placed “in” and “between” each layer Segregation of duties for management of “in” and “between” layer controls Rigorous change control procedures for each item Security intrusion test performed on a regular basis for each item Everything but Client Device is in secure data center Internal Network ILP

Secure Collaboration Environment A “lock box” system – Access to the system is tightly controlled (e.g. BU IT Head approves access) – Strong authentication to access the environment – All content placed in the system is encrypted at rest on the server and DRM is applied when the content is imported – Access and all file movement is logged

Broad Brush Approach Configure the Network and Client ILP software with patterns to detect the Crown Jewels