1. ISE Confidential - not for distribution THE EVOLVING THREAT LANDSCAPE: ADVANCING ENTERPRISE SECURITY 11 December 2013

2. Agenda ISE Confidential - not for distribution Objectives About ISE I. Security Separated from Functionality II. Black Box vs. White Box III. Secure Assets, Not Perimeters IV. “Build It In,” Not “Bolt It On” V. Security as Ongoing Process Q&A

3. Objectives ISE Confidential - not for distribution Analyze trending best practices Keep pace with the rapidly evolving adversaries Streamline resource and financial investment

4. About ISE ISE Confidential - not for distribution

5. About ISE ISE Confidential - not for distribution Analysts Fortune 500 Enterprises Media & Entertainment, Security Software, Healthcare, etc Customers White box Perspective Computer Scientists Ethical Hackers Research Recent: Browsers; Routers Upcoming: Digital Cinema; Hospital Pilot

6. I. Security Separated From Functionality ISE Confidential - not for distribution

7. I. Security Separated From Functionality ISE Confidential - not for distribution CONFLICT IS GOOD! There, I said it.

8. I. Security Separated From Functionality ISE Confidential - not for distribution

9. FunctionalitySecurity I. Security Separated From Functionality ISE Confidential - not for distribution I.T.

10. I. Security Separated From Functionality ISE Confidential - not for distribution

11. I. Security Separated From Functionality ISE Confidential - not for distribution

12. I. Security Separated From Functionality ISE Confidential - not for distribution

13. I. Security Separated From Functionality ISE Confidential - not for distribution Objective of Conflict Facilitate dialogue amongst teams to arrive at a usable system, on deadline, that entails an acceptable level of security protocols.

14. II. Black Box vs. White Box ISE Confidential - not for distribution

15. II. Black Box vs. White Box ISE Confidential - not for distribution Evaluation Types Penetration Test Vulnerability Assessment Methodologies Black Box White Box

16. II. Black Box vs. White Box ISE Confidential - not for distribution Black Box Perspective

17. II. Black Box vs. White Box ISE Confidential - not for distribution White Box Perspective

18. II. Black Box vs. White Box ISE Confidential - not for distribution

19. III. Secure Assets, Not Perimeters ISE Confidential - not for distribution

20. III. Secure Assets, Not Perimeters Traditional AttacksTraditional Defenses 20

21. III. Secure Assets, Not Perimeters 21 Modern Attacks

22. III. Secure Assets, Not Perimeters 22

23. IV. “Build It In,” Not “Bolt It On” ISE Confidential - not for distribution

24. IV. “Build It In,” Not “Bolt It On” ISE Confidential - not for distribution Determine Business & User Needs Requirements Define Architecture Design Coding Implementation System Testing Testing Customer Roll-out Deployment Resolve bugs Maintenance

25. IV. “Build It In,” Not “Bolt It On” ISE Confidential - not for distribution Determine Business & User Needs Create Threat Model Requirements Define Architecture Defense in Depth Design Coding Audit Code Implementation System Testing White Box Vulnerability Assessment Testing Customer Roll-out Configuration Guidance Deployment Resolve bugs Iteration Hardening Maintenance

26. IV. “Build It In,” Not “Bolt It On” ISE Confidential - not for distribution

27. IV. “Build It In,” Not “Bolt It On” ISE Confidential - not for distribution

28. V. Security as Ongoing Process ISE Confidential - not for distribution

29. V. Security as Ongoing Process ISE Confidential - not for distribution

30. V. Security as Ongoing Process ISE Confidential - not for distribution

31. V. Security as Ongoing Process ISE Confidential - not for distribution

32. V. Security as Ongoing Process ISE Confidential - not for distribution

33. Recap ISE Confidential - not for distribution I. Security Separated from Functionality II. Black Box vs. White Box III. Secure Assets, Not Perimeters IV. “Build It In”, Not “Bolt It On” V. Security as Ongoing Process Whitepaper forthcoming

34. Questions? ISE Confidential - not for distribution Ted Harrington Executive Partner ted.harrington@securityevaluators.com