Executive visibility to critical business assets Data Risk Management Executive visibility to critical business assets IBM Data Security Services October 10, 2017

There is explosive data growth across multiple platforms 22.4% Annual increase in structured data2 Structured data 60% Growth in cloud documents 1 26% Annual increase in big data2 Big Data This slide shows our point of view around data growth. The volume of data is increasing, as are the platforms where the data is located. The data is also dynamic – moving between these platforms is common. This slide also presents a data–centric view of data security. No longer can you just consider a platform and protect it. There is no one technology that protects ALL platforms. The solution requires a combination of experienced consultants, a proven methodology and best of breed technology. IBM can provide great tools. Where we have a gap in our coverage, we have built IBM Business Partner relationships. Cloud Service 42.5% Annual increase in unstructured data2 Unstructured data 1 Elastica Shadow Data Report IDC

Common concerns / themes in critical data protection Where to start? With the exponential growth of mobile, cloud & data volumes, simply getting started may seem overwhelming Compliance-driven strategy It takes more than passing an audit to assure the security of critical data Where is your critical data? Technology is only as good as the platforms and repositories they protect Data security is an ongoing process Setting and forgetting is not enough Who can access your data? Understand how partners and suppliers can access your data Shared responsibility Building bridges What to lock down? You cannot protect everything. Focus your investments where they are needed most 06/15/2017

What point solutions are in place? What information do they share? Database Security DLP ? Drip DLP… CASB Application Security

Required: An Integrated Platform for Data Risk Management 4/25/2019 Required: An Integrated Platform for Data Risk Management Critical Data Discover critical data (PII, PCI, HIPAA, crown jewels M&A etc.) Remediation Moderate Business Context Address alerts and vulnerabilities. Define action plans Low High Business processes, lines of business, applications, data owners, data locations RISK INDEX Vulnerabilities Monitoring Discover vulnerabilities Data Activity Aggregation and Monitoring