Information Security Management at the Olympics: Finding the Needle in the Haystack

(1)

Information Security Management

at the Olympics:

Finding the Needle in the Haystack

Markus J. Krauss

VP Cloud Computing and Service Provider

[email protected]

Chris Van Den Abbeele

Solution Manager ISRM

(2)

Agenda

• Who is Atos, Who is Novell/NetIQ

• The Olympic Environment

• The IT project

• Information Security Methodology

• Trends in information security at the Olympics

(3)

(4)

Who is Atos?

• Atos is an international information technology

services company. Its business is turning client vision

into results through the application of consulting,

systems integration and managed operations.

• Atos is the Worldwide Information Technology

Partner for the Olympic Games and has a client

base of international blue-chip companies across all

sectors.

• Atos is quoted on the Paris Eurolist Market and trades

(5)

(6)

Atos and The Olympics

• Started supplying software for Barcelona „92

• Contract with IOC awarded in ‟98 as Integrator

• The largest ever Sports IT related contract

• Reduce risks and reduce costs

• Two extensions, the current contract up to 2016

• 8 Games

• Salt Lake City, USA ‟02

• Athens, Greece ‟04

• Turin, Italy ‟06

• Beijing, China ‟08

• Vancouver, Canada ‟10

• London, Great Britain ‟12

• Sochi, Russia ‟14

(7)

The Olympics Environment

230.000 accreditations (Beijing)

(8)

(9)

The IT Project

• Highly visible and critical, no second chances

• This is an IT project with a deadline that does not

move… that does not move

• Complex mix of technology, processes and people

with no room for error

• A risk-management driven project

• Massive testing program

• Knowledge capture  industrialization  integrate in

(10)

Methodology:

End-to-end Information Security

UNDERSTAND

Define criticality

of Systems and Data

Identify

“normal” Behavior

Define

Security Metrics

Understand Business

Requirements

ANALYZE

Evaluate the Risk

(based on scenario)

Define controls

(based on scenario)

BUILD

Implement

Architecture

Enforce

Security Controls

Using Technology

Enforce

Monitoring Controls

Using Technology

RUN

_Respond

to the Incident

Use adopted Real Time

Risk Management Technology

Monitor for “abnormal”

(11)

Risk Modeling

Scenarios

: “

What

–

How

–

What for

”

–

What

: describes the threat

–

How

: defines which vulnerability is exploited to break into the

target

–

What for

: describes the purpose of the attack

Example of scenario:

–

A worm is released in the CIS VLAN

through

OS vulnerability

to disturb the commentators

• Validation of the scenarios:

–

Penetration Testing (TR1 & TR2)

(12)

Risk Mitigation Strategy

Qualitative risk measurement

Top down (scenarios) and bottom up approach (from IT)

• Consider the following

controls for each scenario:

–

preventive

–

detective

–

Corrective

• These controls become the

building blocks for:

(13)

Integrated Security

• Information

Security is not an

extra domain

• Information

Security is a

transversal activity

• Information

Security is

integrated

(embedded) with

the rest of IT

Operations

Service Desk

Configuration Management

Incident Management

Problem Management

Release Management

Change Management

Service Level Management

Financial Management

Capacity Management

IT Services Continuity Management

Availability Management

Information Security Training

Input for Security Risk Management

Incident Response Handling Process Security Monitoring Vulnerability and Patch Management

(14)

Testing and Training

• Applications go through exhaustive integration testing

programs.

• Systems undergo technical

tests where performance,

load and fault performance

are tested to their limit.

• Teams are trained following

comprehensive programs to be

ready to operate the systems and react to different

scenarios according to the defined policies and

(15)

Operations

The challenge:

• How to recognize real threats in

12,000,000 security events / day?

• How to understand over 20,000

(16)

Operations

The solution:

Real Time Security Risk Management

• Implement a Security Information and Event

Management (SIEM) solution

• Perform Intelligent Event Processing

• Active Filtering

• Aggregation & Correlation

• Prioritization

• Real Time Auditing

• Predefined Incident Management

(17)

Results

(18)

Results

Security Information Reduction (Daily)

(19)

The Trend in Information Security at

(20)

Security Monitoring

Security monitoring

per environment

Security Information Management

providing: Collection, Filtering,

Aggregation, Correlation,

Prioritization across the different

environments

SIM v 2

- Correlation with business rules

- Improved reporting

- Improved performance

SIM v3

- Auto Audit integration

- Auto learning rules

- Multilayer processing

(21)

Identity Management

- Active Directory for Windows environment

- LDAP for UNIX environment

- Radius for Network environment

- Oracle and SQL authent. for Apps and DB

- Directory synchronization:

Active Directory to LDAP

- Application authenticating

against AD and LDAP

- IdM system implemented

- Access control based on job description

- Approval based on organizational structure

IdM workflow fully integrated with

Operational procedures

(22)

Future Plans: “Intelligent SIEM”

Security Monitoring

Security Event information in real

time enriched with “intelligence”

from Identity Management

When we send a Security Guard to investigate,

they are no longer looking for an IP address,

they are looking for a face

(23)

(24)

“Innovation is about turning new ideas

into real business value “

Our know-how and

experience from the

Olympics is integrated

in our

“Atos High Performance

Security (AHPS)

”

service, which is now

available to all customers

(25)

If you’re facing any of these regulations

Then see us on Atos High Performance Security

• UK: GPG-13 (Government) and PCI-DSS

• France: RGS (Référentiel Général de Sécurité') and

PCI-DSS

• Germany: BSI, ISO2700x and PCI-DSS

• Netherlands: 'Code voor Informatiebeveiliging'

(based on the standard ISO 27001 and

the code of practice ISO 27002)

• Spain: LOPD (Organic Law for Data Protection), and

(26)

Markus J. Krauss

VP Cloud Computing and Service Provider

Chris Van Den Abbeele

Solution Manager ISRM

If We Can Do it for The Olympic Games,

Imagine What We Can Do For You!

(27)

Thank you

Chris Van Den Abbeele

Solution Manager ISRM

Atos, the Atos logo, Atos Consulting, Atos Worldline, Atos Sphere, Atos Cloud and Atos WorldGrid

are registered trademarks of Atos SA. June 2011