1. © 2009 PGP Corporation Confidential State of Key Management Brian Tokuyoshi Solution Manager

2. © 2009 PGP Corporation Confidential Challenges Regulation and security concerns drive the need for encryption everywhere –Tight deadlines place emphasis on the goal, and not best practice Each new encryption technology introduces new key management challenges –Yet another system to manage –Building consistent policy enforcement gets harder and harder eDiscovery is the opposite of regulation –Data is being encrypted without consideration of how fast it must be recovered Each operations group handles key management differently Many different trust models, many different types of keys 2

3. © 2009 PGP Corporation Confidential How key management problems affect businesses Administrative costs Major online retailer takes 4 weeks to perform manual key audit for compliance. Audit required twice a year. Accountability CIO/CSO held accountable for data protection but lacks visibility GAO report on federal deployment Business Continuity Major bank – Retail branches could not open for 4 hours Numerous sites – Customers locked out from online services 3

4. © 2009 PGP Corporation Confidential Different Trust Models for Different Uses 4 Company ACompany B User Company ACompany B User1 User2 User1 User2 Point to Point Trust Secure File Transfer One to One, One to Many Cross Certification S/MIME Email Many to Many Company ACompany B Hierarchy SSL Certificates Anyone 3 rd Party CA

5. © 2009 PGP Corporation Confidential Reality Check 5 Company BCompany CCompany A Point to Point Cross Certify Businesses use mixed trust models today No easy way to migrate from one model to another Can’t force an architecture onto another company Internal Hierarchy 3 rd Party CA

6. © 2009 PGP Corporation Confidential The Growing Need Compliance! Data Breaches! Security Encryption Problem Solved?

7. © 2009 PGP Corporation Confidential The Growing Need Compliance! Data Breaches! Security Encryption Key Management

8. © 2009 PGP Corporation Confidential 8 Common Problems with Keys NetworksBackend Applications Clients Hardware Banking and Retail Hardware ATM PoS EMV Databases Application Servers Web Servers Mail Servers CRM WiFiVPN Wireless Keys SSL / TLS Keys Disk Encryption Keys Authentication Keys TPM Keys Encryption Keys Authentication Keys Data Encryption Keys Application Keys SSL / TLS Keys Transport Keys Authentication Keys Transaction Keys Manual Management Help Desk and Recovery Policy Requirements Key Rotation/ Key Archiving Validation and Rotation

9. © 2009 PGP Corporation Confidential 9 NetworksBackend Applications Clients Hardware Banking and Retail Hardware Addressing the Problem ATM PoS EMV Provisioning Storage Auditing and Reporting Lifecycle Management Policy Enforcement Discovery Key Management WiFiVPN Wireless Keys SSL / TLS Keys Disk Encryption Keys Authentication Keys TPM Keys Encryption Keys Authentication Keys Data Encryption Keys Application Keys SSL / TLS Keys Transport Keys Authentication Keys Transaction Keys Databases Application Servers Web Servers Mail Servers CRM

10. © 2009 PGP Corporation Confidential With PGP Key Management User 1 Keys User 2 Keys User 3 Keys User 4 Keys Key Management Services User 1User 2User 3User 4 FileEmailDisk Before and After Without Key Management User 1User 2User 3User 4 FileEmailDisk 10

11. © 2009 PGP Corporation Confidential What’s Needed in a Key Management System What’s needed Open standards support Support for APIs, Protocols and Agents Support for multiple key types Support for multiple trust models Highly Scalable Highly Secure Proven 11

12. © 2009 PGP Corporation Confidential 12 Q&A Thank You