We look at how much it costs to be secure and why. Three key areas: control & audit configuration; monitoring & managing user activity; and managing & enforcing change control. Automation and the ROI and payback period for NetIQ IT Security Process Automation as analyzed by Gartner, and the next steps. Presented by NetIQ and CalCom.

1. Improve ROI on Security and Compliance Management June 7, 2010

2. How Much It Cost To Be Secure? First Level Third Level Second Level *Calculated on 2080 Hours/Year Deeper it goes, longer is the Exposure and the associated Risk Cost Standard IT Security Model Resource Type Ownership % Hourly Cases Hourly Cost* Help Desk & Service Desk Low Skill Resources High Turnaround 68% 4 22$ IT Professionals Platform Specific In-House Personnel 26% 1,5 44$ Security Officers Technology Specific Mostly External 6% 0,13 112$

4. Goal of IT Management Become an Efficient Business Enabler Operational Efficiency Business Enablement Goal: Cost Effective with Optimized Service Delivery Sub-Optimal: Cost-Centric and Tactical with Marginal Services Current State: Expensive and Tactical with Limited Perceived Value Sub-Optimal: Aligned To Business Goals But Expensive Efficient Business Enabler A Low Cost Provider C Expensive Business Enabler B Low Value Provider D

5. Management’s Dilemma Operational Efficiency vs. Business Enablement Significant up-front investments and the need for profound changes jeopardize or delay expected cost reductions . Off-shoring and outsourcing, combined with little investment in processes, often forsake agility and business enablement . “ The Cost Cutter” “ The Framework Adopter” Operational Efficiency Business Enablement Operational Efficiency Business Enablement

8. Control and Audit Configuration Primary Goal: Protect systems, applications and data in accordance with their business value and satisfy compliance mandates NetIQ Delivers Real-time event correlation reduces alert volumes while highlighting critical events, improving incident management while reducing costs. TRACE™ technology delivers log management, protects the chain of custody, and provides trend analysis and forensics to meet evolving mandates. Powerful auditing of user activity and access controls helps meet compliance mandates and address both inside and outside threats. Effective detection at both the host and network level provides better protection of corporate data and demonstrable oversight of change controls. What's Needed Event Correlation and Analysis Log Management and Forensics Access Control and User Monitoring Change and Threat Detection Challenges What's Needed 1. Security events and alerts often overwhelm security staff, inhibiting effective security incident management. Event Correlation and Analysis 2. Evolving mandates require more than simple log consolidation, to encompass integrity of data, chain of custody, and forensic reporting. Log Management and Forensics 3. Effective protection of corporate data is dependent on user activity monitoring, which is often inhibited by native capabilities. Access Control and User Monitoring 4. Intrusion detection and log monitoring are insufficient to meet the evolving mandates for data protection and change control. Change and Threat Detection

9. Monitor and Manage User Activity Primary Goal: Maintain the infrastructure, applications, user accounts, and security per business requirements NetIQ Delivers A prevention-oriented, proxy-based administration solution delivers higher availability than that of system-wide backup and restoration. Non-hierarchical, rules-based delegation simplifies safely granting privileges to users. Automated tasks triggered by events streamline routine administrative tasks, saving time and improving service. Automation and repeatability, along with Active Directory and Unix users optimization, assures business availability and satisfied end users. What's Needed Prevention and Recovery Delegated Administration Administrator Task Automation Migration and Optimization Challenges What's Needed 1. Administrative errors and malicious acts threaten the integrity and reliability of systems and services. Prevention and Recovery 2. Native tools make it impractical to enable non-administrators to make routine or low-risk changes. Delegated Administration 3. Manual, routine tasks often consume valuable skilled resources. Administrator Task Automation 4. Diversity, complexity and emerging technologies increase the time to deploy and operate systems management tools. Migration and Optimization

10. Manage and Enforce Change Control Primary Goal: Real time enforcement of an organization policy throughout the different layers of the IT infrastructure. Without stopping the services operations CalCom Delivers Automated Process for Real Time Policies Enforcement within the different IT Layers, not stopping the normal operations An extensible library with hundreds of Policy Process Protection Rules covering OSs, Applications, Users Behavior, Network Connections Learning Mode to understand how and element should behave. Unparalleled capabilities in Monitoring, Auditing, Access and Change control Built-in reports, Regulatory Compliance Reports, Policy Center © – Gap Analysis Report and Compliance Dashboard © What's Needed Hardening Solutions that doesn’t harm or stop the Services Operations Harden not only basic Objects but also ensure Applications proper utilization and regulate Policies Changes and Access Easily p rovide Real Time Policies monitoring and implementation Unparalleled reporting capabilities on regulatory compliance Challenges What's Needed 1. Real time enforcement of an organization policies on the IT Infrastructure layers, without harming the Services Operation Hardening Solutions that doesn’t harm or stop the Services Operations 2. Protect and enforce the organization’s Policy Processes through verifying the User behavior Harden not only basic Objects but also ensure Applications proper utilization and regulate Policies Changes and Access 3. Monitor, alert and prevent policies break, rolling back to any change of the hardened element following the Policies Easily p rovide Real Time Policies monitoring and implementation 4. Be able to produce a wide range of regulatory reports, gap analysis, what if analysis and compliance dashboard Unparalleled reporting capabilities on regulatory compliance

11. All of Those Through Automation Workflow Automation Engine NetIQ Products Message Bus, Resource Model, CMDB 3 rd Party Best-of-Breed products Run Books (Event Correlation, Fault Recovery, Routine Server Restarts, etc. ) Processes (ITIL Incident Management, Change Management, DR testing, etc.) Correlation Engine AM SM/CG SCM DRA SCOM HPOM Remedy Smarts Adapters Bi-directional data collection and control Activity Libraries Workflow building blocks that control other tools Process Templates Provides built-in knowledge Presentation Layer Consoles tailored to specific users Independent Engines Allow data processing scalability Resource Mgmt DB Normalizes data from diverse tools Ops Console Config Console Reports … …

12. At The End This is What Really Counts

13. Real World Example On Self Password Reset