“ For A Moment, I Had A Feeling Of Total Security. Then Someone Said Cloud! “

2 | © 2015 CloudPassage Confidential IT Security – The Missing Piece in IT Replatforming Steve Opfer Enterprise Sales Director

3 | © 2015 CloudPassage Confidential IT Replatforming – Next Gen, Gen 3, …

4 | © 2015 CloudPassage Confidential What’s Driving IT Replatforming? New Features = New Revenue The Business wants new features faster than ever IT has Responded ◦Virtualization ◦Self Service Development has Responded ◦DevOps ◦Rapid Releases ◦Cloud Test & QA Security has [Not] Responded ◦Current tools built for Gen 2 data center ◦In many cases, asking for things to Slow down ◦In other cases, pushed aside in acceptance of Risk Provisioning – Weeks to Minutes Release Cycle – Quarters to Days Change Breaks Security

5 | © 2015 CloudPassage Confidential Legacy Traditional Data Center Bare Metal Basic Virtualization

6 | © 2015 CloudPassage Confidential Modern UCS Director

7 | © 2015 CloudPassage Confidential Modern UCS Director

8 | © 2015 CloudPassage Confidential Modern UCS Director

9 | © 2015 CloudPassage Confidential Legacy Modern Seeks control to avoid risk Waterfall approach Low rate of change Data centers / colo Approval-driven Stringent change control Network-centric security IT focused (less customer-centric) More centralized IT operations Embraces risk to gain agility Fast-iteration approach High rate of change SDDC / cloud Learning-driven Little or no change control System & app-centric security Business focused (closer to customer) More distributed IT operations Legacy Modern Security Must: Embrace Both Legacy and Modern IT

10 | © 2015 CloudPassage Confidential Modern Legacy Experiments Innovation Greenfield Applications Any New Application Low-Risk Migrations High-Risk Migrations Core Business Applications “BUSINESS AS USUAL” Last Legacy Project IT Replatforming

11 | © 2015 CloudPassage Confidential Modern Legacy New Security Tool Research Experiments with Public Security Securing DevOps Full IT Security Replatforming Securing Low- Risk Apps Trusting Security to Protect your High-Risk Apps Wherever they Reside Network Security “BUSINESS AS USUAL” Server Security for Critical Apps IT Security Replatforming

12 | © 2015 CloudPassage Confidential JDFMAMJJASON Analysis and design Coding & implementationQuality testing Staging and release R1 Legacy Application Development (traditional waterfall)

13 | © 2015 CloudPassage Confidential Quality testing Staging and release JDFMAMJJASON Analysis and design Coding and implementation R1R12R11R10R2R3R4R5R6R7R8R9 Modern Application Development (agile / iterative)

14 | © 2015 CloudPassage Confidential Quality testing Staging and release JDFMAMJJASON Analysis and design Coding and implementation R1R12R11R10R2R3R4R5R6R7R8R9 Modern Application Development (agile / iterative) App 1 App 2 App 3 App 4 App n

15 | © 2015 CloudPassage Confidential Core security policies already implemented, regardless of environment Security unit-testing cases required, or code is rejected (yes, really) Code & infrastructure policies ensured using DevOps-style automation Staging smoke tests include automated pen-testing, vulnerability assessment, policy validation, security baselines (against gold master) JDFMAMJJASON R1R12R11R10R2R3R4R5R6R7R8R9 Weaving Security & Compliance into Modern AppDev / Devops All of this feeds into SIEM and GRC tools Quality testing Staging and release Analysis and design Coding and implementation

16 | © 2015 CloudPassage Confidential Everything “behind the firewall” Complete visibility & control Fewer changes at slower pace IT largely calls the shots Natural physical segmentation More controlled, paced cadence LegacyModern Assets are everywhere Inconsistent visibility & control More & faster changes (by OOM) Business units run their own IT Physical constructs are gone (portability) As-fast-as-automation-allows You Need Security That Embraces Both Modern and Legacy IT

17 | © 2015 CloudPassage Confidential 8 Keys To Securing The Transformation of IT 1.Built directly into core environments 2.Security that operates anywhere 3.Context-aware operation 4.Orchestration of many functions 5.Deep automation of each function 6.Instant and long-term scalability 7.Alignment with DevOps models 8.API-based integration capabilities This is the most profound IT transformation you’re likely to see in your career… make it count!

18 | © 2015 CloudPassage Confidential Questions or more importantly Thoughts/Comments?