1. 1© Copyright 2012 EMC Corporation. All rights reserved. Next Generation Authentication Bring Your Own security impact Tim Dumas – Technology Consultant

2. 2© Copyright 2012 EMC Corporation. All rights reserved. Threat Landscape

3. 3© Copyright 2012 EMC Corporation. All rights reserved. 2011 DIGITAL UNIVERSE 1.8 ZETTABYTES 1,800,000,000,000,000,000,000

4. 4© Copyright 2012 EMC Corporation. All rights reserved. $ $

5. 5

6. 6

7. 7 are the New Perimeter People

8. 8© Copyright 2012 EMC Corporation. All rights reserved. had email addresses compromised by malware 60% OF FORTUNE 500 Source : RSA Security Brief, February 2011 “Malware and the Enterprise” Threat Landscape

9. 9© Copyright 2012 EMC Corporation. All rights reserved. Threat Landscape 88% of Fortune 500 had BOTNET ACTIVITY associated with their networks Source : RSA Security Brief, February 2011 “Malware and the Enterprise”

10. 10© Copyright 2012 EMC Corporation. All rights reserved. Threat Landscape were created last year alone Source : RSA Security Brief, February 2011 ONE-THIRD of malware in existence today Of the 60 million variants

11. 11© Copyright 2012 EMC Corporation. All rights reserved. Advanced Threats of organizations believe they have been the victim of an Advanced Threats 83% of organizations don’t believe they have sufficient resources to prevent Advanced Threats 65% Source: Ponemon Institute Survey Conducted “Growing Risk of Advanced Threats” of breaches led to data compromise within “days” or less 91% of breaches took “weeks” or more to discover 79% Source: Verizon 2011 Data Breach Investigations Report

12. 12© Copyright 2012 EMC Corporation. All rights reserved. Advanced Security Response Versus Operations Today’s Processes Do Not Address Advanced Threats CompliancePolicyControlsTestReportFixCompliancePolicyControlsTestReportFix I ntelligent IdentifyAnalyzeRespond IdentifyAnalyzeRespond Rules-based Siloed Audited Risk-based Contextual Agile

13. 13© Copyright 2012 EMC Corporation. All rights reserved. RSA Approach GOVERNANCE INTELLIGENT CONTROLS ADVANCED VISIBILITY AND ANALYTICS CloudMobilityNetwork Rapid Response and Containment Collect, Retain and Analyze Internal and External Intelligence Manage Business Risk, Policies and Workflows

14. 14© Copyright 2012 EMC Corporation. All rights reserved. Authentication

15. 15© Copyright 2012 EMC Corporation. All rights reserved. Before: Controlled Network Environment Server Applications Remote Managed Device Inside the Network Network or VPN Employees Corporate Users Managed Devices Controlled Access Points Information on a Network

16. 16© Copyright 2012 EMC Corporation. All rights reserved. Today: Any User, Any Device, Anywhere Network VPN Virtual Desktop Mobile Apps Web Browser External and Temporary Users Unmanaged Devices Uncontrolled Access Points Information in Public Cloud and Hosted Applications Employees Contractors Partners Customers

17. 17© Copyright 2012 EMC Corporation. All rights reserved. Today’s Challenge: Establishing Trusted Identities

18. 18© Copyright 2012 EMC Corporation. All rights reserved. Diverse User Populations Require Choice  Choice of credentials to meet convenience requirements –External users and customers require convenient and easy to manage solutions  Scalability and costs aligned with size of user population –Large user populations require lower cost per user –Scalability to address future authentication plans  Single management platform –Ability to manage choice of credentials on a single platform to minimize IT resources and maximize efficiency Internal Employees, Temporary Employees, Contractors, Partners, Clients, Customers, Auditors, Remote workers

19. 19© Copyright 2012 EMC Corporation. All rights reserved. BYOD – Protect Access from Any Device  Use of the mobile device as the authenticator  Strong authentication natively integrated with 3 rd party remote access applications  Authentication SDKs accessible on application development platforms for custom app development

20. 20© Copyright 2012 EMC Corporation. All rights reserved. Cloud – Extend Authentication Controls  Secure authentication and identity validation to cloud-based resources  Seamless federation of authentication credentials to cloud applications  Integrated approach to authentication and cloud-based identity management  Hosted and managed strong authentication services TO THE CLOUD FROM THE CLOUD

21. 21© Copyright 2012 EMC Corporation. All rights reserved. Threats – Layer Authentication Controls RISK –BASED ANALYSIS Evaluate risk of activity based on device and user characteristics Compare risk to accepted policy controls CREDENTIAL MATCHED TO RISK Require user credential appropriate to risk level Allow different credentials for different use cases and users MONITORING AND REPORTING Monitor risk levels and adjust policies Report activities for compliance audits

22. 22© Copyright 2012 EMC Corporation. All rights reserved. Technologies

23. 23© Copyright 2012 EMC Corporation. All rights reserved. Two-factor Authentication: One-time Password (OTP) OTP = PIN + Tokencode OTP = PIN + Tokencode PIN: Something the user knows Tokencode: Something the user has

24. 24© Copyright 2012 EMC Corporation. All rights reserved. Risk Engine Case Mgmt SSL/VPN Policy Mgr. BehaviorBehavior DeviceDevice FraudFraud Authenticate Continue Risk-based Authentication Step-up Authentication Feedback Challenge Out-of-band Others Knowledge 271 937 Feedback Web Access Management Mobile App, Browser Web

25. 25© Copyright 2012 EMC Corporation. All rights reserved. Digital Certificates (PKI) User Device Certificate Authority Key Recovery Module Validation Manager

26. 26© Copyright 2012 EMC Corporation. All rights reserved. Dynamic Knowledge-based Authentication

27. 27© Copyright 2012 EMC Corporation. All rights reserved. RSA Mobile Authentication SDKs Software Development Kit (SDK) for mobile apps –Sample application, documentation and library for embedding functionality in mobile apps –Free of charge for RSA customers and RSA Secured partners Developers can choose from the following functionality –SecurID OTP Module Import software tokens, generate OTP User visible or invisible OTP –Adaptive Authentication Module Retrieve device identifiers and location information for risk evaluation by Adaptive Authentication –Transaction Signing

28. 28© Copyright 2012 EMC Corporation. All rights reserved. Choice

29. 29© Copyright 2012 EMC Corporation. All rights reserved. One-time Passwords * Coming in 2013

30. 30© Copyright 2012 EMC Corporation. All rights reserved. Risk-based Authentication Seamless user experience Nothing for users to manage Diverse Users Support for all devices BYOD Hosted availability Cloud Security policies aligned to threats Threats

31. 31© Copyright 2012 EMC Corporation. All rights reserved. Digital Certificates Available on various devices Diverse Users Support for device authentication BYOD Available hosted Cloud Component of a layered strategy Threats

32. 32© Copyright 2012 EMC Corporation. All rights reserved. Knowledge-based Authentication User provisioning not required Prior relationship with user not required Diverse Users Support for mobile devices BYOD Hosted solutions available Cloud Prevent impersonation at enrollment Secure high risk transactions Threats

33. 33© Copyright 2012 EMC Corporation. All rights reserved. BYO Security Impact Summary  Evolving Threat Landscape –Information Explosion –Diverse User Population –BYOD –Cloud Developments  Intelligent Risk Management  Authentication Control is Key  Strong Authentication Choice (Direct and via SDK) –One-time Passwords –Risk-based Authentication –Digital Certificates –Knowledge-based Authentication  BYOD renewes focus on security management and authentication

34. 34© Copyright 2012 EMC Corporation. All rights reserved. THANK YOU