Is technology ubiquity a chance to re-connect security?

1. Is technology ubiquity a chance to re-connect security? Greg Day Director of Security Strategy

2. The changing technology landscape • Circa 50% Source: Citi Investment Research and Analysis (support iPads) • 150m a year (2015) Source: Ovum • Q3 - 14.1m 12.1m Source: http://gizmodo.com/5667042/apple-sells-more-ipads-than-macs-on-the-way-to-record-20-billion-revenue • Circa 50% Source: IDC, Data is freely intermingled Computing Cycles in Perspective (from Morgan Stanley) 1,000,000 Mobile Internet Devices/Users (MM in Log Scale) 100,000 Desktop Internet 10,000 10B+ Units?? 1,000 PC 1B+ Units/ Users 100 100M Units Minicomputer 10 10M Units Mainframe 1 1M Units 1960 1980 2000 2020

3. What risks do they really bring? • Banking services already targeted • Authentication • Vulnerabilities in the apps • Heavily used for social networking • Apps stores add revenue • 10,000,000,000+ downloads to date! • Worth billions per year! • Less than 1000 viruses today due to diversity

4. Mobile Enterprise Apps are Rapidly EvolvingWhat are your long term goals? Enterprise and LOB Apps Basic Services Customer FacingApps Web andSocial Media

5. Approaches to Security on Smart Devices • Segregate data (inc wipe) • Secure 3rd party apps • Security controls Sandbox Full device • Mitigate on device attacks

6. Integration of Smart devices to your existing security strategy - Enterprise Mobile Manager iPad Enterprise Environment IT OpsSupport Android Provisioning Messaging MobileDevice Management Applications Compliance Security &Authentication iPhone PolicyManagement Directory McAfee EMM Certificate Services webOS Files Windows Mobile Database Symbian

7. Virtualization Enables technology ubiquity • Expect 50% of the enterprise data centers workloads to be virtualized by the end of 2012 (Gartner) • Go green, decrease datacenter footprint, improve utilization • Enables faster response reducing application deployment and migration times • But Gartner report that • Through 2012, 60% of virtualized servers will be less secure than the physical servers they replace, dropping to 30% by YE15 • 40% of virtualization deployment projects were undertaken without involving the information security team in the initial architecture and planning VM VM VM Hypervisor

8. Is your security utilizing the advantages of technology?MOVE (McAfee Optimized Virtual Environments ) • Move security processing out of each VM – Offloading • Optimized with the Hypervisor to address scalability • Enables planned capacity ~60% more VDI density • Integrated management, responsive user experience, supporting persistent and non-persistent desktops VM VM VM MOVE Virtual Appliance Scan Engine Hypervisor McAfee EPO MOVE Server Cloud Threat Intel (GTI) Cache Synchronization Protocol

9. Changing the way we apply security in the future • Integrity Control = Application Control + Change Control • Change Control • Change configuration audit • File Integrity Monitoring and Change Prevention • Prevents “compliance drift” • Application Control • Dynamic whitelisting • Trusted applications • Trusted sources • Memory Protection • No Updates • Keep the bad stuff out • Stop unauthorized apps • Deny unauthorized changes • Enforce change policy “Greater protection, faster time to compliance, lower cost”

10. Security ManagementThe Problem • Security Purchases are Tactical • Patchwork of independent products • Requiring separate management • Threats Overwhelm Existing Approach • Many product types and security layers • Can’t continue to add resources to manage new events, products • Security Dashboard Modestly Helpful • Decision-making still manual • Based on human correlation of available information • Net Result • Dramatic increase in Information Risk and Costs to secure

11. Network Access Control Management Tools Host Intrusion Prevention Management Tools Data Protection (DLP, Encryption, etc.) Management Tools Desktop Firewall Management Tools Policy Auditing Management Tools Anti-spywareManagement Tools Anti-virusManagement Tools 6 8 7 1 2 4 3 SecurityLandscape Web Security Management Tools 5 Leads to Proliferation of Security Management Consoles and Reporting Tools

12. A Re-connection strategy:Security Connected

13. Optimizing a Security Architecture Requires /Centralized security managementOpen platform for centralized management and maximum interoperability /Real-time Threat Intelligence Actionable protection with the delivery of correlated threat intelligence and immediate visibility into enterprise-wide security posture /Multi-layered protectionEffective and efficient defense in depth provided by multi-layered security approach /Automated complianceCompliance-ready solutions which streamline prioritization of threat responses, reporting, policy and risk management

14. Firewall Email Web AV AWL Mobile DLP McAfee Global Threat intelligence - Intelligent Connected Security via the Cloud Threat Intelligence Feeds Other feeds & analysis Endpoints Appliances Servers Firewalls Message Reputation File Reputation Web Reputation Web Categorization Network Connection Reputation Vulnerability Information ePO IPS

15. Security OptimizationSecurity Management Platform: ePO REAL TIME THREAT FEEDS (GTI) SECURITY METRICS ACTIONABLE INFORMATION PROTECTION Executive RiskMgmt WhiteListing Endpoint Web DLP IPS SIA Encrypt. Email Firewall SecurityAdmin ePO IT Architect Security Management Platform

16. McAfee’s Open Platform for Security Risk ManagementIndustry Leadership to Drive Better Protection, Greater Compliance and Lower TCO SIA Associate Partner SIA Technology Partner (McAfee Compatible)

17. RISK OPTIMIZATION Reactive spend ~3% of IT budget on securityHigh risk Cost Model of Enterprise Security Tools Based Applying tools and technologies to assist people in reacting faster Optimized spend ~4% with very low risk DYNAMIC Predictive and agile, the enterprise instantiates policy, illuminates events and helps the operators find, fix and target for response. Compliant/Proactive spend ~8% of IT budget on security Medium risk REACTIVE & Manual People only. No tools or processes. “Putting out fires”. Why has it been so challenging to reduce risk?

18. Greg Day Director of Security Strategy, EMEA Greg_Day@McAfee.com McAfeeGregDay