Core.co.enterprise.deck.06.16.10

Core Security Technologies Corporate Overview - CONFIDENTIAL - Mark Hatton, President and CEO - CONFIDENTIAL -

- CONFIDENTIAL - Core Security Technologies Today Who we are… and what makes us so relevant… Leading provider of commercial penetration testing software 950+ CORE IMPACT Pro customers Dozens of awards from press, test labs Segment leadership recognized by analysts, market watchers Diverse, highly accomplished organization ~180 employees (55 Boston, 110 Buenos Aires, 15 India) Highly experienced management team (fmr. Sophos, CA, SYMC) Professional product/exploit development ops 5 patents approved, 7 applications pending Groundbreaking threat research Leading-edge consulting services history CoreLabs vulnerability research team High-profile research community involvement

Customer Sampling Serving a cross-section of industry leaders 2 of 3 top Banks* 2 of 3 top Retailers* 2 of 3 top Telecoms* 9 of 12 US Federal Civilian Agencies Leaders in Healthcare & Entertainment * According to F1000 rank

Our Product Today… Core Impact Professional Software solution that automates penetration testing of: Networks Web Applications Clients & Endpoints Wireless Weaknesses, seams between all Users/Target Market Professional security testers Red Teams Operational Security Managers Vulnerability Management Managers Visionary CISOs … Why? More efficiently conduct penetration testing and red teaming Conduct multi-layer testing of defenses and security investments Test the seams between defensive layers Prioritize and inform remediation Meet PCI/FISMA compliance testing requirements Test, report, repeat, measure and benchmark - CONFIDENTIAL -

Test the Layers and the Seams - CONFIDENTIAL - Application Layer Host / OS Layer Network Layer Email Spreadsheet Browser App Scanners Customer Data Employee Records Network Device C Network Device B Network Device A SIEM GRC App Cfg Audting System Audting Config Reporting Vuln Scanning CISO ITSec Operations

Security Depth and Breadth Embedded Agents Disconnected - CONFIDENTIAL - 15+ Client Exploits / Month WEP & WPA Currently in research Currently in research Reflective Post Persistent (in Research) Established Recent Future Legend IDS/IPS WAF Ongoing research for new techniques Data via Web DB Data Files Asymmetric Dictionary Attack Ongoing with Exploits Agent direct Agent via SQLi RFI & SQLi Blind SQLi Postgres OWASP Adds DB2 Other Info Gathering Post-Exploitation Evasion Web HTML XSS 2.0 / RIA Client-Side Exploit Phish Wireless Network Devices Vulnerabilities Agent on NDs Database Vulnerabilities Application 2008 2009 2010 2011 2012 Windows 7 5+ Server Exploits / Month Server-Side OS Apps BREADTH DEPTH Currently in research Currently in research Currently in research Email/USB APs Handheld

What Sets us Apart Real-world: Proactively testing (in a safe and controlled manner) proves the existence of your most critical security exposures Enables customers to identify and validate the complex paths of security exposures that jeopardize specific, critical information assets within organizations Comprehensive: Integration across organization’s IT infrastructure; web network and endpoint systems, end users and wireless networks Stay ahead of constant changing mix of vulnerabilities and attack techniques Validation: Rather than hypothesizing, providing volumes of data or modeling, we demonstrable proof of what information assets are exposed and how it could occur This is the most realistic approach for ensuring that required security controls are in-place and working effectively

Market Differentiation Scanning (web and/or network) products identify potential weaknesses Data overload including false positives/negatives – not most critical threats Does not prove exploitability, limited-view point solution, single vector IT-GRC gathers information to aggregate and report Mostly used for higher-level policy and governance with little “R” SIEM aggregates real data, dash-boarding, drill-down, etc. SIM/SEM correlates and presents what has happened (via alert), but doesn’t tell you if your defenses are working Operational data, not situational. Just incidents or log data from past events Security Risk Mgmt is simulator/model Correlates scanned, imported and entered data to infer highest risk vulnerabilities, doesn’t do actual testing Network only and works on models vs. a real test of the security DLP detects and prevents transmission of confidential information To date, the critical challenge of how to provide insight into actual risks across multiple layers of infrastructure still remains!

Security Market – The Game is Changing Security professionals manage complex, evolving (threat) environment Increasing expectations to contribute to fulfillment of business goals, including: Strategic mandates related to compliance, business continuity and risk management Obligations to prove efficacy of security controls to boards and business stakeholders Shift in the board room and management to focus on reputational risk Malware growth and cyber security attacks continue to grow exponentially Jump in demand for "business analysts" who embed with business units to keep risk mgmt practices integrated into business processes. Access to resources (bodies and dollars) is challenging Management of logs and event correlation challenging Increasing number of applications (point solutions) generating alerts and logs – firewall, intrusion detection systems, email/web content, anti virus, DLP, etc Mandates for security assessment, assurance continue to emerge … Legislative, industry and internal regulations PCI, HIPAA, FISMA/NIST, CAG, multiple pieces of pending U.S. government legislation Demand for due diligence by customers, investors and other stakeholders Requires ongoing measurement, benchmarking and reporting of security posture - CONFIDENTIAL -

- CONFIDENTIAL - Security Market Trends – Current View Endpoint Suites Network UTM Application Security Vulnerability Management [Other Point Products] Product B Product C Product A Security Incident and Event Management Alerts Log Mgt Event Correlation Compliance Certification Governance Risk and Compliance User Policy Compliance Compliance Workflow and Reporting Remediation Workflow and Reporting Anti-Virus HIPS Local Firewall NAC Patch Management Endpoint DLP Firewall IDS AV Gateway Full Disk Encryption Anti-Spam Net DLP DB Encryption IAM / Single Sign-On URL Filter DAM Vulnerability Scanning Web App Scanning Code Scanning WAF Penetration Testing DB Scanning Config Audit

- CONFIDENTIAL - Security Market Trends – Future View Endpoint Suites Network UTM Application Security Vulnerability Management [Other Point Products] IT Security Management Vendors: IBM, HP, Cisco, Computer Associates, Symantec, McAfee Product B Product C Product A Comprehensive Security Test and Measurement Verify and Validate Security Controls Measure Real-world Threat Readiness Measure Security Effectiveness Security Incident and Event Management Alerts Log Mgt Event Correlation Compliance Certification Governance Risk and Compliance User Policy Compliance Compliance Workflow and Reporting Remediation Workflow and Reporting Anti-Virus HIPS Local Firewall NAC Patch Management Endpoint DLP Firewall IDS AV Gateway Full Disk Encryption Anti-Spam Net DLP DB Encryption IAM / Single Sign-On URL Filter DAM Vulnerability Scanning Web App Scanning Code Scanning WAF Penetration Testing DB Scanning Config Audit

Our Future Product – Core Insight Enterprise Why: Pen testing established as standard process for security validation Org’s without internal expertise need to validate spending and controls while decreasing costs of vulnerability management Pro designed for individual user What (it is): Enterprise Test & Measurement Solution Continuously, proactively validate controls Evaluate exposure to real-world threats Transform vulnerability management Needs Addressed Answer the question “are we more secure today than we were yesterday?” Trend, delta and visual attack path information to allow benchmarking of security posture over time Validation of security standing, compliance, risk and security controls - CONFIDENTIAL -

IMPACT Pro Compared to Insight Two Very Different Products for Two Very Different Audiences CORE IMPACT Pro Core Enterprise User Professional pen testers (internal and external consultants) Red and Blue teams IT with security responsibilities CISOs/IT management Risk management IT development IT audit Consumer of Output Internal departments Operational security Administrative & compliance management Executive leadership Business and IT management Risk management Characteristics Software, windows-based Surgical focus; granular control In-depth testing across networks, web apps, clients, end users, WiFi Ability to pivot across multiple vulnerable systems and layers Targeted reporting including remediation recommendations Appliance or software, Linux Continuous, automated security testing Leverages asset-driven attack planning to calculate risk Role based No internal expertise required Goal of Test Demonstrate exploitability Reveal what business critical data is exposed, in own business terms Value Proposition Test select IT assets against real-world attack techniques to identify exploitable vulnerabilities. Ability to benchmark and measure posture over time, calculate real-world risk, and validate mandated security controls

Benefits of Core Insight Enterprise Get out in front of security threats… Empower executive leadership with decision-making metrics Trend data to answer “the” question: “are we more or less secure than we were yesterday” Benchmark and validate effectiveness of security projects and controls Map IT / technical exposures to actual affect on business Gain actionable information about the underlying business implications of exposures Continuously monitor your IT infrastructure for changes in posture Proactively test, measure security status across Web, Network and Clients Manage data from disparate security technologies to chart exposures Regularly assess the impact of emerging threats to your organization Prepare more effectively for audits (compliance) with repeatable pre-audit testing Provide expanded testing services to development and IT groups Increase internal assessment capabilities without increasing headcount - CONFIDENTIAL -

Controls Verification and Effectiveness - CONFIDENTIAL - Legend Controls: PCI 11.3 CAG # 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Typical Products nCircle IP360, Gidean Secure- Fusion Bit9, Nessus eEye Retina, Nessus, nCircle Read Seal, Skybox, Athena Security FirePac Red Seal, Secure Passage, FireMon ArcSight, Splunk, Intelli-tactics Cenzic Hailstorm, Nessus MS Active Directory, Intelli-tactics Forescout Counter-Act nCircle, Qualys, McAfee Nessus, Rapid7, Skybox MS SMS, Security Blanket, Intelli-tactics Blink, MS SMS, Active Directory nCircle CCM, FireMon eEye Retina & Blink RSA DLP Test & Measure-ment SW Inventory and Whitelists Secure Configurations Secure Config of Network Devices Maintain and Monitor Audit Logs HW Inventory Boundary Defense Control Admin Privileges Control Access Vuln Assessment and Remediation Application Software Security Malware Defenses Wireless Device Control Data Loss Prevention Secure Network Engineering Network Ports and Protocols Penetration Testing Data Recovery Account Monitor and Control Skills Assessment/Training Incident Response CAG Test Future General Test Now Never CAG Test Now

The Innovation Behind Core Enterprise - CONFIDENTIAL - Step 1: Environment Profiling Provide layout of your IT assets, including network, applications and/or end users … or let Enterprise discover them independently Import data from vulnerability and/or web scanners Step 2: Goal Definition Define the goal of each Enterprise assessment campaign (e.g., being able to access pre-defined, sensitive business data) GOAL

The Innovation Behind Core Enterprise - CONFIDENTIAL - Step 3: Security Assessment Campaign Core Enterprise AI Algorithm (patent pending) determines most likely path to achieve Campaign goal Exploit Engine takes advantage of initial vulnerability to begin campaign AI Algorithm learns about the environment, analyzing results, re-adjusting path on-the-fly Exploit Engine leverages vulnerabilities along the way, effectively “opening doors” along the path GOAL AI Algorithm Exploit Engine

The Innovation Behind Core Enterprise GOAL - CONFIDENTIAL - Step 4: Report Generation Reports use your own business terms (e.g., brokerage client account numbers exposed by SQLi vulnerability in portfolio self-service application) Step 5: Ongoing Monitoring and Assessment Run the product on scheduled basis and monitor for deltas, trends and new breach points Delegate rights and responsibilities to users (e.g., red teams, auditors, developers, etc.) and/or offices – and monitor their results via dashboard Business Impact Report CISO Dashboard AI Algorithm Exploit Engine

Core.co.enterprise.deck.06.16.10

More Related Content

What's hot (20)

Similar to Core.co.enterprise.deck.06.16.10 (20)

Recently uploaded (20)

Core.co.enterprise.deck.06.16.10

Editor's Notes