XYGATE Data Protection Optimizing HPE SecureData on NonStop Ken Scudder Sr. Director, Business Development, XYPRO January 2016

Agenda Introduction Encryption/tokenization - why? HPE SecureData on NonStop XYGATE Data Protection Product Ordering and availability

HPE and XYPRO partnership XYPRO - providing solutions on NonStop since 1983 Offers comprehensive suite of security and compliance solutions on NonStop Authentication and access control Audits Compliance monitoring Data Security 2013 AllianceOne partner of the year in the security category XYPRO Technology – All Rights Reserved

A framework for NonStop security While not applicable to all companies, PCI is useful for considering a framework for NonStop security

Securing the NonStop XYGATE Access Control (XAC) XYGATE Data Protection (XDP) XYGATE User Authentication (XUA) XYGATE Merged Audit (XMA) XYGATE Compliance PRO (XSW)

XYPRO solutions in HPE price-book Authentication and access control Monitoring and auditing Data Security XYGATE User Authentication* XYGATE Access Control XYGATE Compliance PRO XYGATE Merged Audit* BASE24 plug-in BASE24-eps plug-in AJB RTS plug-in HLR plug-in XYGATE Data Protection New * Included in the OS Security bundle (J-Series) or the OS (L-Series) XYPRO Technology – All Rights Reserved

Security breaches are still making news Experian breach exposes 15 million T-Mobile customer data (October 2015) 4.6 million Scottrade accounts breached (October 2015) 100 banks hit by $1 Billion cyber attack (February 2015) XYPRO Technology – All Rights Reserved

Security breaches are still making news 80 million member records stolen from Anthem BlueCross Blue Shield (February 2015) U.S government breached – data for 21.5 million employees stolen (July 2015) 30 million customers’ account info stolen from Ashley Madison (August 2015) XYPRO Technology – All Rights Reserved

Traditional “Solutions” to Data Encryption Protecting data at rest is easy, isn’t it? Why are we still seeing these breaches? Two problems Traditional infrastructure solutions do not protect the data consistently throughout the enterprise Implementing traditional encryption solutions is hard! XYPRO has been partnering with Voltage and now HPE Security for over three years to address these issues

Major Security Breaches Continue To Occur... WHY? Impossible to protect against every vulnerability – IT infrastructures will continue to be breached Impossible to keep all data behind a firewall – there is no longer the concept of a “perimeter” The data must be pervasively protected Why has this not happened to date?

Problems with Traditional Data Protection Need to change data structures and applications 7412 3456 7890 0000 8juYE%Uks&dDFa2345^WFLERG AES Fully encrypted data is unusable until decrypted Ija&3k24kQotugDF2390^320OWioNu2(*872weWaasIUahjw2%quiFIBw3tug^5a… ? Key management can be a nightmare Requires multiple, piecemeal solutions, which create multiple security gaps

Advantages of HPE SecureData Data Protection Minimal change to data structures and applications 7412 3456 7890 0000 8juYE%Uks&dDFa2345^WFLERG AES 7412 3423 3526 0000 7412 3456 7890 0000 FPE Protected data behaves correctly in applications and analytics versus Ija&3k24kQotugDF2390^320OWioNu2(*872weWaasIUahjw2%quiFIBw3tug^5a… ? Simplified operations via Stateless Key Management versus Name SS# Salary Address Enroll Date Kwfdv Cqvzgk 161-82-1292 100000 2890 Ykzbpoi Clpppn, CA 10/17/2005 Key Database Policy controlled, dynamically generated Keys End-to-end Security within a consistent Data Protection Framework Preserve format, structure and behavior versus

HPE SecureData protects data end to end Threats to Data Traditional IT Infrastructure Security Data Ecosystem Security Gaps HPE SecureData Data-centric Security Data & Applications Credential Compromise Authentication Management Middleware/Network Security gap If you look at the whole IT infrastructure supporting the e-commerce ecosystem, you see multiple points of origin, transport, consumption and storage of data. You have the client devices where the data originates, the applications which process them, the network and middleware where it traverses, the databases, file systems, and storage. In all these places the data is vulnerable to compromise through several means. For example, you protect application access through a authentication, your protect data in transit through encryption using TLS, you encrypt the database and the secondary storage, you protect file systems through encryption and malware scanners. So, you end up applying different means to protect your data and as it transitions from one to another, you data again becomes vulnerable due to multiple security gaps. What’s more, the costs of passing audit and maintaining compliance are becoming more unpredictable – especially in an environment of increasing regulations, outsourcing, Big Data and cloud computing. There is a strong desire to reduce audit scope wherever possible to contain cost. By tokenizing payment card data, the scope of the PCI audit and cardholder data environment is limited because the storage of payment cards is being substituted by tokens. The footprint for attacks shrinks accordingly because token data is useless if stolen. Tokenization has emerged as a powerful technique for removing live data from systems while achieving PCI scope reduction. It is the only comprehensive data protection platform that secures data as it is captured, processed, and stored across a variety of devices, operating systems, databases, mission-critical systems, and applications used by enterprises, merchants, and service providers. HP SecureData Enterprise includes market-leading HP Format-Preserving Encryption (FPE), HP Secure Stateless Tokenization (SST) technology, HP Stateless Key Management, and data masking to address the entire lifecycle of sensitive data as it moves through the enterprise and beyond. It also extends data protection beyond organizational borders, enabling protection of data shared with partners, suppliers, and outsourcers. HP SecureData Enterprise solves the issue of advanced threats attacking data as it is stored, processed and moved across different systems end-to-end, without the need to expose live data in the gaps between or across systems. Traffic Interceptors SSL/TLS/firewalls Security gap SQL injection, Malware Databases Database encryption Data security coverage End-to-end Protection Security gap Malware, Insiders SSL/TLS/firewalls File Systems Security gap Malware, Insiders Disk encryption Storage

HPE Data Security – SecureData on NonStop Simple API – Native to HPE NonStop OSS environment Structured (FPE) and unstructured (“IBSE”) encryption Unstructured data APIs Host SDK – Native to HPE NonStop FPE and SST native capability NonStop and OSS environment support NonStop code 800 (TNS/E) and code 500 (TNS/X) objects Also supports HPE Payments Transaction Decrypt Integration with – C, TAL, COBOL, ASM etc. Both Simple API and Host SDK use HPE SecureData Key Server Secure SSL/TLS for key and policy fetch Stateless, resilient, proven. Smart caching so APIs can operate offline In turn connects to AD, LDAP if required for external authentication HPE SecureData Web Services API can be called over SOAP using SOAP Stack (e.g. OSS gSOAP) SD

XDP - powered by HPE SecureData Format Preserving Encryption and Secure Stateless Tokenization, Optimized for Mission Critical HPE NonStop Environments

HPE NonStop Environment Unique Data Protection Requirements Protect extremely sensitive data and mission-critical applications Support older legacy applications and newer (often ported) applications Support a wide variety of data types including payments and other PII (e.g., SSN, DoB) Support NonStop’s OS personalities and executable types Conform to NonStop fault tolerance fundamentals Be highly performant Be secure and integrate with NonStop’s unique security framework XYPRO Technology – All Rights Reserved

XYGATE Data Protection (XDP): Optimizes HPE SecureData for NonStop environments Enables implementation with no application changes on NonStop Adds support for nowaited/non-blocking encryption/tokenization Increases support for NonStop’s OS personalities and executable types Adds multiple language support: C, TAL, COBOL and Java Adds distributed architecture for fault-tolerance, parallelism and scalability Adds built-in access control and auditing, as with all XYGATE products Adds packaged functionality to support either linking directly to the application or offloading encryption tasks to a dedicated server class process (note: TNS applications can only do the latter) Standards-based: all cryptography is standards based (AES) and publicly validated Industry-proven: used by large payment processors, financial institutions, retailers, and telcos Multi-platform support: HP NonStop, z/OS, Solaris, Windows, Linux, Stratus, AIX, etc. Support for wide variety of data types: payments, other PII (e.g., SSN, DoB) Stateless key management: no keys to store, manage or distribute/replicate Flexible: full/partial encryption, masked, and tokenized data from the same interface Runs natively on NonStop: tokenization and encryption happen natively on NonStop

XDP: Implementation Options Can be implemented in two ways As an intercept library requiring absolutely no changes to the application As an SDK that requires a small amount of programming in the customer’s preferred programing language – provides access to both SimpleAPI and HostSDK

XYGATE Data Protection (XDP) High-level Architecture Intercept Library option: No application changes required Overlays system’s I/O procedures with additional functionality to encrypt/tokenize on the fly Application sees clear data and is unaware that XDP is being used Allows integration with other platforms via HPE SecureData enterprise support All sensitive data is protected in the database XDP configuration files control behavior (such as which files or fields to access and protect) Enscribe/ OSS/ SQL/MP

XYGATE Data Protection (XDP) High-level Architecture SDK option: Lightweight API that can embed directly into NonStop application Enables multi-threaded apps to have non- blocking access to Voltage encryption/tokenization Minimal code changes All sensitive data is protected in the database XDP configuration files control behavior (such as which files or fields to access and protect) Comprehensive data-centric security approach Alternative to I/O blocking that occurs for encryption/tokenization with the intercept technology XYPRO Technology – All Rights Reserved

HPE SecureData/XDP Summary Industry-leading tokenization and encryption solutions Format-preserving Standards-based Multi-platform support Runs natively on NonStop and z/OS Support for wide variety of data types Stateless key management Flexible XYGATE Data Protection Optimizes HPE SecureData for HPE NonStop environments Simplifies HPE SecureData implementation Enhances HPE SecureData functionality Integrates HPE SecureData with NonStop security framework Enhances HPE SecureData fault tolerance and parallelism and scalability Provides NonStop database-specific tools for HPE SecureData

Product Availability SecureData and XYGATE Data Protection are orderable today EAP product available now through XYPRO and/or HPE Target GA ship ready date: SecureData: 15 Jan 2016 XDP: 15 Jan 2016

XYPRO Technology – All Rights Reserved Thank you! HPE SecureData and XDP Format-Preserving Encryption (FPE) Secure-Stateless-Tokenization (SST) & XYPRO Technology – All Rights Reserved