1Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only COMPLETE LIFECYCLE APPROACH TO ADVANCED THREAT PROTECTION ZACH SIVERTSON Product Management March 5, 2014

2Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only WHAT’S NEEDED ADVANCED THREAT PROTECTION LIFECYCLE DEFENSE Incident Resolution Investigate & Remediate Breach Threat Profiling & Eradication Ongoing Operations Detect & Protect Block All Known Threats Incident Containment Analyze & Mitigate Novel Threat Interpretation GLOBAL INTELLIGENCE NETWORK

3Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only TAKING A NETWORK-CENTRIC APPROACH TO ANTI-MALWARE Critical Controls For Effective Cyber Defense - SANS Institute, March 2013 Utilize network-based anti-malware tools to analyze all inbound traffic and filter out malicious content before it arrives at the endpoint. “ “ Device-based anti-malware offers incomplete protection: - Proliferation of new devices - BYOD - Guest WiFi - Machine-to-machine comms Device-based anti-malware offers incomplete protection: - Proliferation of new devices - BYOD - Guest WiFi - Machine-to-machine comms Secure Web Gateway provides: - Real-time Rating - URL database - Negative Day Defense Network Anti-Malware needed for: - APTs - Targeted malware attacks Secure Web Gateway provides: - Real-time Rating - URL database - Negative Day Defense Network Anti-Malware needed for: - APTs - Targeted malware attacks Network-based anti-malware adds extra layer of defense against targeted attacks not be detected by mainstream algorithms

4Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only REAL WORLD RESULTS: BENEFIT OF ADDING NETWORK BASED ANTI-MALWARE TO SECURE WEB GATEWAY Global Financial Enterprise Billion attempts to access websites (allowed + blocked) Million attempts to access known malicious sites blocked by WebPulse. -89,192 Malicious files blocked by network perimeter anti-malware 12 months ending 4/13. Over 250,000 employees 4 Enterprise Network Internet Secure Web Gateway Network Anti-malware

5Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only CURRENT SOLUTIONS OPERATE IN SILOS Technology and Organizational silos limit current defenses

6Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only Block Known Web Threats ProxySG Allow Known Good Content Analysis System with Application Whitelisting Block Known Bad Downloads Content Analysis System with Malware Scanning Free up resources to focus on advanced threat analysis Reduce threats for incident containment and resolution Block all known sources/malnets and threats before they are on the network Analyze Unknown Threats Malware Analysis Appliance Block Known Web Threats ProxySG Allow Known Good Content Analysis System with Application Whitelisting Block Known Bad Downloads Content Analysis System with Malware Scanning Analyze Unknown Threats Malware Analysis Appliance INTELLIGENT DEFENSE IN DEPTH Discover new threats and then update you gateways

7Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only Non-Blue Coat Sandbox Malicious UPDATE & ALERT Not Malicious Global Intelligence Network CONTENT ANALYSIS SYSTEM WITH MALWARE ANALYSIS Content Analysis System Encrypted & Unencrypted Traffic ProxySG Internet Application Whitelisting Malware Signature Databases Blue Coat Malware Analysis ICAP / S-ICAP Threat Data Sent To WebPulse: - File HASH - URL - Time Stamp - File Name

8Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only File Whitelisting - For Improved Control and Performance -Eliminates need to analyze known “good” files -Ability to block delivery of all but known ‘good’ files -Tests show 29% of files are identified as ‘good’ - Database of over 1 billion files is updated continuously Orchestrated Sandboxing – For Better Performance and Accuracy -Pre-filtering results in 37% reduction in number of files sent to sandbox -Fewer files to analyze improves performance and reduces false-positives -Simultaneously send suspicious files to Malware Analysis Appliance and third- party sandboxes Dual Anti-Malware - For High Accuracy, Comprehensive Protection - Deploying two anti-malware engines increases coverage by 12% (choice of McAfee, Sophos, Kaspersky) - Best practice – network anti-malware engine(s) different from desktop CONTENT ANALYSIS SYSTEM THE FOUNDATION FOR ADVANCED THREAT PROTECTION Expandable High Performance Platform – For Investment Protection -Four models with throughput ranging from 50Mbps to 500Mbps -Scan files up to 5GB in size and analyze compressed archives 99 layers deep -Expandable over time (ex. On-box/Cloud Sandbox planned for mid-2014)

9Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only DISCOVERING NEW THREATS WITH BLUE COAT MALWARE ANALYSIS IntelliVM Replicate your production environment Reduce false positives Pre-filter with application whitelisting and malware scanning Protect immediately New malware discoveries shared via global intelligence network Emulation Replicate your system environment Scale your defenses Protection shifts to the gateway when new threats are discovered

10Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only MALWARE ANALYSIS APPLIANCE IMPROVING ON THE BASIC SANDBOX Hybrid Sandboxing – Dual detection - ‘Bare-metal’ sandbox to detonate VM- aware malware - Customized VM profiles to replicate your specific environment Plug-ins – Simulating user interaction -Replicate mouse movements, click- through dialog boxes etc… Risk Scores – Identify highest risk malware -Allows graduated response -Improve use of security resources Detailed Information – Improving response -Info on process, file system, network and registry events -Pattern matching classifies malware and identifies industry and app-specific attacks

11Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only DEPLOYMENT SCENARIO: GATEWAY ADVANCED THREAT PROTECTION Content Analysis System Proxy SG Malware Analysis Appliance ICAP / S-ICAP HTTPS API For Flexible/Scalable Deployment Threat Data To WebPulse: - File HASH - URL - Time Stamp - File Name

12Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only ATP LIFECYCLE ARCHITECTURE WebPulse Internal Network Web Server Content Analysis System Proxy SG Malware Analysis Appliance Security Analytics Platform Integrated Solution: Web Gateway + Content Analysis + Malware Analysis + Analytics Threat Data To WebPulse: - File HASH - URL - Time Stamp - File Name

13Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only Incident Resolution Investigate & Remediate Breach Threat Profiling & Eradication Ongoing Operations Detect & Protect Block All Known Threats Incident Containment Analyze & Mitigate Novel Threat Interpretation GLOBAL INTELLIGENCE NETWORK ADVANCED THREAT LIFECYCLE DEFENSE Security Analytics Platform with ThreatBlades Content Analysis System with Malware Analysis ProxySG

14Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only BLUE COAT CUSTOMER FORUMS  New Blue Coat Customer Forums now available  Community where you can learn from and share your valuable knowledge and experience with other Blue Coat customers  Research, post and reply to topics relevant to you at your own convenience  Blue Coat Moderator Team ready to offer guidance, answer questions, and help get you on the right track  Access at forums.bluecoat.com and register for an account today!forums.bluecoat.com  Win an iPad mini by participating in the Blue Coat Customer Forums Referral Contest. Visit the forum for details!

15Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only THANK YOU FOR JOINING TODAY!  Please provide feedback on this webcast and suggestions for future webcasts to: Webcast replay and slide deck found here: er-support-technical-webcasts er-support-technical-webcasts (requires BTO login)

16Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only RESOURCE CENTER

17Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only ADDENDUM

18Copyright © 2013 Blue Coat Systems Inc. All Rights Reserved.Blue Coat Confidential – Internal Use Only CONTENT ANALYSIS SYSTEM: TOPOLOGY EXTERNAL MAIL RELAY USERS USER DIRECTORY SWITCH INTERNET GLOBAL INTELLIGENCE NETWORK PROXY SG INTERNAL MAIL SERVER CENTRAL MANAGEMENT ADMIN FIREWALL CONTENT ANALYSIS MALWARE ANALYSIS