Archive

Archive for the ‘Data Protection’ Category

4 breakthrough ideas for compliance and data security

June 27th, 2022 No comments

Compliance management will never be easy, but there are ways to make it simpler and more transparent. Every year, organizations confront a growing volume and diversity of data and ever-evolving industry and government regulations. But the answer to more data, more devices, and more regulations isn’t more point security solutions. In fact, it may be possible to simplify compliance even as everything around you gets more complex.

Through research and conversations with customers, we’ve identified four key data security challenges that many organizations face as they implement hybrid work and multicloud environments. You can dig into our findings and recommendations by signing up and downloading the e-book Blueprint for Data Protection: 4 Breakthrough Ideas for Compliance and Data Security. In the meantime, let us walk you through some of the highlights.

1. Addressing insider risk created by hybrid work and the Great Reshuffle

By now, you’re probably familiar with the news that record numbers of workers are quitting and switching jobs. The phenomenon has even been given a name: the Great Reshuffle. Many of these career changers have prioritized flexible work environments that enable them to work remotely at least some of the time. This creates a great opportunity for businesses with the right technology to attract top talent; however, job-hopping also comes with risk. Employees may inadvertently—or, unfortunately, intentionally—take sensitive data with them when they leave. And it’s common for new workers to make mistakes while they are getting up to speed on security policies.

To improve risk management, it’s important to implement an effective insider risk program. The right security program will focus on both culture shifts that help people make the right decisions and privacy controls that don’t impede productivity. If you’re uncertain where to start, you’ll find more detail in the e-book, which outlines several recommended best practices.

2. Knowing your data

Our customers tell us that running a multicloud environment and supporting a hybrid workforce makes it extremely difficult to know what data they have and where it’s located. Employees, customers, and IoT devices are continuously creating new information, storing it on various clouds and devices, and frequently moving it to new locations. Data protection must be balanced with governance that doesn’t impede productivity.

Automate discovery to amplify data governance. Classification is key to defining which data is sensitive and who should have access to it. But if you’re doing this process manually, it’s nearly impossible. We recommend solutions that use AI to automatically classify data based on pre-defined requirements. With the right processes and technology, you can dramatically reduce your workload and enhance data protection.

3. Securing data in a borderless world

The network perimeter is widely held to be an ineffective strategy, and we’ve now entered a world where the office walls are also disappearing. Your company resources aren’t just stored inside your on-premises data center, they also exist in cloud environments and apps. People, IoT devices, and services from all over the place—including other countries—legitimately need to access those resources to get things done. Working from anywhere is more convenient than ever, but it’s also created more opportunities for bad actors to get a hold of sensitive data.

To help ensure that only authorized users can access your data, implement a Zero Trust framework. With Zero Trust, you don’t automatically trust any access request, even if it comes from inside the network. To prevent a breach, it’s important to verify every request explicitly. When access is granted, individuals, services, and smart devices should only be given as much access as they need and only for the amount of time that they need it. A notable tenet of a Zero Trust strategy is that teams should assume that the organization has already been breached, which is why it’s critical to make verification and access controls ingrained as protocol.

Zero Trust isn’t a product: It’s a strategy and process. Refer to the e-book for several recommended tips that will help you implement this important framework in your own organization.

4. Managing security platform complexity

If you have a patchwork system of unintegrated security solutions that you’ve acquired over time, you’re not alone. Many of our customers struggle to coordinate across multiple systems, losing precious time that they could put toward threat management.

You can significantly reduce complexity by unifying compliance solutions and data protection strategies. By replacing your point solutions with a platform from a single vendor, you can reduce cyberattacks, save time, and recover from an attack more quickly. Look for the following when choosing a vendor:

  • Easy deployment, maintenance, and governance.
  • A lower cost than a multiple-solution strategy.
  • Easier deployment and user training.
  • Solutions that work well with your current environment and tools.
  • In-place data management.

Putting it all together

Respecting privacy while enabling productivity has only gotten more challenging as the way people work has shifted, but you can make your job a little bit easier with the proven strategies outlined in this blog.

Dive deeper into these four challenges and best practices in the e-book Blueprint for Data Protection: 4 Breakthrough Ideas for Compliance and Data Security.

Learn more about Microsoft Purview, a family of governance and compliance solutions that work together to give you greater visibility and control over your data.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

The post 4 breakthrough ideas for compliance and data security appeared first on Microsoft Security Blog.

4 breakthrough ideas for compliance and data security

June 27th, 2022 No comments

Compliance management will never be easy, but there are ways to make it simpler and more transparent. Every year, organizations confront a growing volume and diversity of data and ever-evolving industry and government regulations. But the answer to more data, more devices, and more regulations isn’t more point security solutions. In fact, it may be possible to simplify compliance even as everything around you gets more complex.

Through research and conversations with customers, we’ve identified four key data security challenges that many organizations face as they implement hybrid work and multicloud environments. You can dig into our findings and recommendations by signing up and downloading the e-book Blueprint for Data Protection: 4 Breakthrough Ideas for Compliance and Data Security. In the meantime, let us walk you through some of the highlights.

1. Addressing insider risk created by hybrid work and the Great Reshuffle

By now, you’re probably familiar with the news that record numbers of workers are quitting and switching jobs. The phenomenon has even been given a name: the Great Reshuffle. Many of these career changers have prioritized flexible work environments that enable them to work remotely at least some of the time. This creates a great opportunity for businesses with the right technology to attract top talent; however, job-hopping also comes with risk. Employees may inadvertently—or, unfortunately, intentionally—take sensitive data with them when they leave. And it’s common for new workers to make mistakes while they are getting up to speed on security policies.

To improve risk management, it’s important to implement an effective insider risk program. The right security program will focus on both culture shifts that help people make the right decisions and privacy controls that don’t impede productivity. If you’re uncertain where to start, you’ll find more detail in the e-book, which outlines several recommended best practices.

2. Knowing your data

Our customers tell us that running a multicloud environment and supporting a hybrid workforce makes it extremely difficult to know what data they have and where it’s located. Employees, customers, and IoT devices are continuously creating new information, storing it on various clouds and devices, and frequently moving it to new locations. Data protection must be balanced with governance that doesn’t impede productivity.

Automate discovery to amplify data governance. Classification is key to defining which data is sensitive and who should have access to it. But if you’re doing this process manually, it’s nearly impossible. We recommend solutions that use AI to automatically classify data based on pre-defined requirements. With the right processes and technology, you can dramatically reduce your workload and enhance data protection.

3. Securing data in a borderless world

The network perimeter is widely held to be an ineffective strategy, and we’ve now entered a world where the office walls are also disappearing. Your company resources aren’t just stored inside your on-premises data center, they also exist in cloud environments and apps. People, IoT devices, and services from all over the place—including other countries—legitimately need to access those resources to get things done. Working from anywhere is more convenient than ever, but it’s also created more opportunities for bad actors to get a hold of sensitive data.

To help ensure that only authorized users can access your data, implement a Zero Trust framework. With Zero Trust, you don’t automatically trust any access request, even if it comes from inside the network. To prevent a breach, it’s important to verify every request explicitly. When access is granted, individuals, services, and smart devices should only be given as much access as they need and only for the amount of time that they need it. A notable tenet of a Zero Trust strategy is that teams should assume that the organization has already been breached, which is why it’s critical to make verification and access controls ingrained as protocol.

Zero Trust isn’t a product: It’s a strategy and process. Refer to the e-book for several recommended tips that will help you implement this important framework in your own organization.

4. Managing security platform complexity

If you have a patchwork system of unintegrated security solutions that you’ve acquired over time, you’re not alone. Many of our customers struggle to coordinate across multiple systems, losing precious time that they could put toward threat management.

You can significantly reduce complexity by unifying compliance solutions and data protection strategies. By replacing your point solutions with a platform from a single vendor, you can reduce cyberattacks, save time, and recover from an attack more quickly. Look for the following when choosing a vendor:

  • Easy deployment, maintenance, and governance.
  • A lower cost than a multiple-solution strategy.
  • Easier deployment and user training.
  • Solutions that work well with your current environment and tools.
  • In-place data management.

Putting it all together

Respecting privacy while enabling productivity has only gotten more challenging as the way people work has shifted, but you can make your job a little bit easier with the proven strategies outlined in this blog.

Dive deeper into these four challenges and best practices in the e-book Blueprint for Data Protection: 4 Breakthrough Ideas for Compliance and Data Security.

Learn more about Microsoft Purview, a family of governance and compliance solutions that work together to give you greater visibility and control over your data.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

The post 4 breakthrough ideas for compliance and data security appeared first on Microsoft Security Blog.

Virtualization-based security (VBS) memory enclaves: Data protection through isolation

The escalating sophistication of cyberattacks is marked by the increased use of kernel-level exploits that attempt to run malware with the highest privileges and evade security solutions and software sandboxes. Kernel exploits famously gave the WannaCry and Petya ransomware remote code execution capability, resulting in widescale global outbreaks.

Windows 10 remained resilient to these attacks, with Microsoft constantly raising the bar in platform security to stay ahead of threat actors. Virtualization-based security (VBS) hardens Windows 10 against attacks by using the Windows hypervisor to create an environment that isolates a secure region of memory known as secure memory enclaves.

Figure 1. VBS secure memory enclaves

An enclave is an isolated region of memory within the address space of a user-mode process. This region of memory is controlled entirely by the Windows hypervisor. The hypervisor creates a logical separation between the normal world and secure world, designated by Virtual Trust Levels, VTL0 and VT1, respectively. VBS secure memory enclaves create a means for secure, attestable computation in an otherwise untrusted environment.

VBS enclaves in Microsoft SQL Server

A key technology that will leverage VBS secure memory enclaves is Microsoft SQL Server. The upcoming SQL Server secure enclave feature ensures that sensitive data stored in an SQL Server database is only decrypted and processed inside an enclave. SQL Servers use of secure enclaves allows the processing of sensitive data without exposing the data to database administrators or malware. This reduces the risk of unauthorized access and achieves separation between those who own the data (and can view it) and those who manage the data (but should have no access). To learn more about the use of secure enclaves in SQL Server, see the blog post Enabling confidential computing with Always Encrypted using enclaves.

Data protection

One of the major benefits of secure memory enclaves is data protection. Data resident in an enclave is only accessible by code running inside that enclave. This means that there is a security boundary between VTL0 and VTL1. If a process tries to read memory that is within the secure memory enclave, an invalid access exception is thrown. This happens even when a kernel-mode debugger is attached to the normal process the debugger will fail when trying to step into the enclave.

Code integrity

Code integrity is another major benefit provided by enclaves. Code loaded into an enclave is securely signed with a key; therefore, guarantees can be made about the integrity of code running within a secure memory enclave. The code running inside an enclave is incredibly restricted, but a secure memory enclave can still perform meaningful work. This includes performing computations on data that is encrypted outside the enclave but can be decrypted and evaluated in plaintext inside the enclave, without exposing the plaintext to anything other than the enclave itself. A great example of why this is useful in a multi-tenant cloud computing scenario is described in the Azure confidential computing blog post. This move allowed us to continually make significant innovations in platform security.

Attestation

Attestation is also a critical aspect of secure memory enclaves. Sensitive information, such as plaintext data or encryption keys, must only be sent to the intended enclave that must be trusted. VBS enclaves can be put into debug mode for testing but lose memory isolation. This is great for testing, but in production this impacts the security guarantees of the enclave. To ensure that a production secure enclave is never in debug mode, an attestation report is generated to state what mode the enclave is in (among various other configuration and identity parameters). This report is then verified by a trust relationship between the consumer and producer of the report.

To establish this trust, VBS enclaves can expose an enclave attestation report that is fully signed by the VBS-unique key. This can prove the relationship between the enclave and host, as well as the exact configuration of the enclave. This attestation report can be used to establish a secure channel of communication between two enclaves. In Windows this is possible simply by exchanging the report. For remote scenarios, an attestation service can use this report to establish a trust relationship between a remote enclave and a client application.

One feature that relies on secure memory enclave attestation is Windows Defender System Guard runtime attestation, which allows users to measure and attest to all interactions from the enclave to other capabilities, including areas of runtime and boot integrity.

Figure 2. Windows Defender System Guard runtime attestation

Elevating data security

There are many secure memory enclave technologies in the industry today. Each have pros and cons in capabilities. The benefit of using a VBS secure memory enclave is that there are no special hardware requirements, only that the processor supports hypervisor virtualization extensions:

Additionally, VBS enclaves do not have the same memory constraints as a hardware-based enclave, which are usually quite limited.

VBS secure memory enclaves provide hardware-rooted virtualization-based data protection and code integrity. They are leveraged for new data security capabilities, as demonstrated by Azure confidential computing and the Always Encrypted feature of Microsoft SQL Server. These are examples of the rapid innovation happening all throughout Microsoft to elevate security. This isnt the last youll hear of secure memory enclaves. As Microsoft security technologies continue to advance, we can expect secure memory enclaves to stand out in many more protection scenarios.

 

 

Maxwell Renke, Program manager, Windows

Chris Riggs, Principal Program Manager, Microsoft Offensive Security Research