SafeNet dramatically reduces the cost and complexity of PCI compliance with the most complete and easy to manage data protection solution. With SafeNet, merchants, banks, and payment processors can protect sensitive data at rest, in use and in transit to meet the most challenging PCI security requirements.

1. PCI Compliance Evolved: Perpetual Compliance for 2.0 and Beyond Mike Smart Product and Solutions Director mike_smart@safenet-inc.com

2. Agenda Growing Challenges with Compliance and the Cost of Breaches and Vulnerabilities PCI Version 2.0 Holistic Compliance New Technologies Beyond 2.0 Ease Compliance Management

3. What We Do: Compliance SafeNet delivers compliance-ready infrastructures that enable customers to persistently comply with evolving regulations, reduce audit complexity, and capitalize on new business models.

4. The Growing Compliance Challenge

5. Cost of Breaches and Vulnerabilities:Across Industries Cost per Breach: $204/ Record *Ponemon Institute Study 2010

6. Cost of Breaches and Vulnerabilities:Across Industries Portable Devices Laptop encryption and access Mobile smart phones access and payment security Unintended Disclosure Control access and distribution of Structured Data: Database environments Unstructured Data: File and folder Hacking and Malware Man-in-the Browser Attacks Phishing and Pharming Attacks DNSSEC Heirarchy Signing

8. Granular Access Controls

9. Assured User Authentication

10. Mobile Data LOCKED!

11. Cryptographic Perimeter

12. Application & DB Data

13. File-based Endpoints

14. Removable Media containedRemote Replication

15. Emerging Infrastructures:Sensitive Data Is Virtualized The cloud changes everything Multiple uses for a virtual resource that contains sensitive data make it difficult to apply the needed controls The cloud changes nothing Every rule of a mandate still applies when migrating sensitive data to the cloud Many infrastructure roles and responsibilities may drop out of view once data moves into the cloud, but compliance responsibility remains the responsibility of the organization

16. What’s New in PCI Version 2.0?Highlights

18. Data-centric protection—intelligence to protect the data itself throughout its lifecycle

19. Granular, selective protection over subset of unstructured or structured data (files, fields, and columns)

20. All-or-nothing encryption

21. Granular data protection for authorized users, assure compartmentalization

22. Keep bad guys out, authorized users get full access

23. Centrally managed solution that addresses business, compliance, data governance & security

24. Multiple products to meet business and security needs

25. High level or very specific policy only,

26. No proper central policy management

28. Approaches to Data Protection

29. Technology Beyond PCI v. 2.0Approach #1: Application Encryption

30. Technology Beyond PCI v. 2.0 Approach #2: Database Encryption

31. Technology Beyond PCI v. 2.0 Approach #3: File Encryption

32. Technology Beyond PCI v. 2.0 Approach #4: Storage Encryption

33. Technology Beyond PCI v. 2.0 Approach #5: Tokenization

34. Critical Step: Tackle Requirement 3 and Reduce the Key Management Scope Source: Oasis

35. Critical Step: Tackle Requirement 3 and Reduce the Key Management Scope What’s the cost of unmanageable key management? Planning time: Some organizations spent up to a year planning for key management issues including breaches and notifications* Audit prep time Demonstrate which apps and networks are using the keys and where in the world they are Data Loss: Up to 39 percent of organizations who have experienced key loss also lose data permanently or disrupt business operations. Maintenance costs: Disparate systems means no economy of scale for maintenance costs. Each encryption system and key management solution could have 15-20% annual maintenance fees. * Source: TrustCatalyst

36. Critical Step: Tackle Requirement 3 and Reduce the Key Management Scope

37. Thankyou Questions?