This document summarizes the key points from a webinar about email security with hosted Exchange. It outlines 14 elements of Exchange security that are important to know about. These include multi-tenant platform security, physical security of datacenters, employee security practices, redundant internet providers, authentication and access controls, dedicated security staff and monitoring, privacy policies, third-party audit reports, PCI compliance, anti-spam capabilities, anti-virus protection, security for mobile devices, data replication for continuity, and encryption options. The webinar provided details on how Intermedia addresses each of these security elements.

1. Security With Hosted Exchange:
What You Need to Know Now
Panelists
Ryan Barrett, Vice President, Security and Privacy
Marc Blakeney, Director, Product Marketing, Office in the Cloud & Exchange

2. Mark Blakeney
Director, Product Marketing, Office in the Cloud
& Exchange
Ryan Barrett
Vice President, Security & Privacy
Questions
We love questions. If you have one during the
webinar, please expand the GoToWebinar chat
window and ask away. Following the webinar we
will address as many questions as we can.
Welcome—Thank You for Joining Us

3. Office in the Cloud: Our Suite of Services
Office
IN THE
Cloud™
Email
File Management
Collaboration
Backup & Security
Cloud Server
Mobility
Voice Services
Reliability
You can trust the cloud to
securely underpin your business.
Empowerment
You can manage and use your
cloud any way you want.
Support
You can rely on us 24/7 to
assure ease of doing business.
INTERMEDIA’S DIFFERENCE: THE WORRY-FREE EXPERIENCE
HostPilot® Control Panel
3

4. Agenda
1. The Importance of Exchange Security
2. 14 Elements of Exchange Security (That You Need to Know Now)
3. Questions and Q&A
4

5. The Importance of Exchange
Security
5Confidential

6. 6
Why Does Exchange Security Matter?
A breach in email security could…
… infect your own systems
… corrupt your business-critical
systems and data
… require extensive time and resources
to recover
… cause lost revenue and missed
business opportunities
… infect your customers/partners
systems
… infect your competitors’ systems
… open you up to legal liability

7. 7
Why is the Cloud Actually More Secure?
Hosted Exchange security far exceeds
the reasonable capacity of the
average business’s in-house IT team.
- Physical security
- Datacenter facilities
- Hardware and software
- Third-party auditing
- And much, much more

8. 8
Poll Question
Confidential
What are your top email security concerns? (select all that apply)
 Data loss or theft
 Data corruption or recovery
 Virus infections
 Regulatory compliance
 None of the above

9. 14 Elements of Exchange Security
(That You Need to Know Now)
9

10. 1. Multi-Tenant Platform Security
10
THE RISK
Datacenters are hosting multiple clients
simultaneously.
THE SECURITY IMPERATIVE
The provider must protect against unauthorized
access between accounts.
Ask a provider about:
- Firewalls
- VPNs
- Traffic management tools
- Intrusion Protection Systems
Intermedia’s approach:
 Redundant,
enterprise-class
firewalls
 Multiple Intrusion
Prevention Systems
(IPS) employed (host
and network)

11. 2. Physical Security
11
THE RISK
Your data is vulnerable where it exists in the real
world.
THE SECURITY IMPERATIVE
The providers’ datacenters must be physically
protected.
Ask a provider about:
- Cameras
- Perimeter security
- Employee access controls
Intermedia’s approach:
 Closed-circuit TV
 Secure access policies
 Security guards

12. 3. Employee Security
12
THE RISK
Exchange provider employees require access to your
data.
THE SECURITY IMPERATIVE
The provider must vouch for the trustworthiness and
competency of their employees.
Ask a provider about:
- Background checks
- Employee experience
- Do they have dedicated personnel?
- Training and certifications
- Outsourcing
Intermedia’s approach:
 Background checks
 Two-factor
authentication and
role-based access
control
 Restricted server
access

13. 4. Redundant Internet Service Providers
13
THE RISK
The datacenter must be connected to the Internet in
order to provide service.
THE SECURITY IMPERATIVE
Protection against provider downtime and Distributed
Denial of Service attacks?
Ask a provider about:
- Who are their Internet Service Providers?
- DDoS protection
- Mitigation technologies
Intermedia’s approach:
 Multiple Tier-1
Internet providers
including Sprint, Level
3 and Verizon

14. 5. Authentication and Access
14
THE RISK
Someone can call the provider’s tech support and
impersonate you.
THE SECURITY IMPERATIVE
Tools for identifying callers and confirming their
access.
Ask a provider about:
- Policies governing account access
- Policies governing phone support access
Intermedia’s approach:
 Stringent caller
identification
procedures
 Admins have control
over access

15. 6. Dedicated Security Staff and Monitoring
15
THE RISK
A provider’s security is only as good as its human
capital.
THE SECURITY IMPERATIVE
The provider must assure that their staff is capable
of addressing an ever-changing IT security landscape.
Ask a provider about:
- Staff experience
- Dedicated vs. shared security personnel
- What their security staff monitors
- What you must monitor on your own
Intermedia’s approach:
 Employs dedicated,
full-time certified
security staff
 Team monitors all
aspects of security

16. 7. Privacy
16
THE RISK
Your Exchange provider has access to your personal
data.
THE SECURITY IMPERATIVE
The provider must assure privacy.
Ask a provider about:
- Privacy guidelines and policies
- Meeting requirements of Us Department of Commerce’s
Safe Harbor Program
Intermedia’s approach:
 Registered with the US
Dept. of Commerce’s
Safe Harbor program,
meeting their privacy
requirements

17. 8. Audit Reports
17
THE RISK
You shouldn’t rely solely on information from the
provider itself.
THE SECURITY IMPERATIVE
You should request third-party validation of the
provider’s security claims.
Ask a provider about:
- Third-party audit reports
- Look for SOC 2 reports (as opposed to SAS 70 or SSAE16
reports)
- Look for Type I vs. Type II reports (Type II is more stringent)
- Request specific “trust principles” details for security,
availability, processing integrity, confidentiality and privacy
Intermedia’s approach:
 SOC 2 Type II audited
 Audit applies
company-wide, not
just at the datacenter
level
 Audited against all
five trust service
principles

18. 9. PCI Compliance
18
THE RISK
Your provider will have your payment details.
THE SECURITY IMPERATIVE
Assurance of the safety of your provider’s payment
processing systems.
Ask a provider about:
- PCI Compliance
Intermedia’s approach:
 Payment processing
system is PCI
compliant

19. 10. Email Security: Anti-Spam
19
THE RISK
Spam wastes bandwidth and distracts employees.
THE SECURITY IMPERATIVE
The provider must block spam without blocking
legitimate email.
Ask a provider about:
- Anti-spam protection
- Granularity of control of settings and black/white lists
for end users
- Flexibility of spam control for admins
Intermedia’s approach:
 SpamStopper™ or
SpamStopper Pro included
with all accounts, free
 Company-wide white and
black lists
 Control over white/black
lists through Outlook and
OWA
 Administrator flexibility
to manage spam settings

20. 11. Email Security: Anti-Virus
20
THE RISK
Malware can infiltrate your systems and cause
massive damage.
THE SECURITY IMPERATIVE
The provider must scan for and eliminate email-
borne malware.
Ask a provider about:
- Effectiveness of protection
- Proactive scanning
- Additional costs
- Frequency of virus definition updates
Intermedia’s approach:
 All accounts include
VirusStopper™ free of
charge
 Catches 99.999% of viruses
 Virus databases auto-
updated multiple times
per day
 Continuously managed
software and virus
definitions

21. 12. Email Security: Protection for Mobile Devices
21
THE RISK
Mobile devices can introduce security threats—
especially personal mobile devices.
THE SECURITY IMPERATIVE
Enable employees to use mobile devices while
mitigating the risks of extended access.
Ask a provider about:
- Mobile device management
- Provider responsibilities
- Customer responsibilities
Intermedia’s approach:
 Admin can set security
and message management
policies for mobile
devices
 Remotely wipe mobile
devices
 Deactivate devices
remotely
 Set policies account-wide
or per user

22. 13. Email Security: Data Replication
22
THE RISK
Datacenter hardware can fail unpredictably.
THE SECURITY IMPERATIVE
The provider must assure the integrity of your data
at all times.
Ask a provider about:
- Data corruption protection
- Business continuity
- Replication policies
Intermedia’s approach:
 Runs regular backups
 Replicates data in real
time
 Maintains three copies
of data, including tape
archives

23. 14. Email Security: Encryption
23
THE RISK
Unencrypted email can be accessed and read by
unauthorized parties.
THE SECURITY IMPERATIVE
The provider must offer encryption options to
protect your business and employees.
Ask a provider about:
- Message-level encryption
- Encryption of attachments
Intermedia’s approach:
 Encrypted email solution
offered for greater
protection
 Can be deployed at the
account level or the user
level
 Standards-based encryption
(PKI, S/MIME, X.509)
 Transport layer encryption
via SSL from client to server

24. Summary
24
1. Multi-tenant platform
security
2. Physical security
3. Employee security
4. Redundant Internet Service
Providers
5. Authentication and access
6. Dedicated security staff and
monitoring
Confidential
7. Privacy
8. Audit reports
9. PCI compliance
10. Anti-spam
11. Anti-virus
12. Protection for mobile
devices
13. Data replication
14. Encryption
14 Elements of Exchange Security
(That You Need to Know Now)

25. Free Exchange Security White Paper
25
Security and Privacy in a Hosted
Exchange Environment
- Check your email after the webinar
- Details on everything covered in this
webinar
- Includes a two-page checklist for side-
by-side comparisons of providers
- You can also request it by calling
800.379.7729
Confidential

26. Questions?
www.intermedia.com
26

27. Intermedia and the Office in the
Cloud
27Confidential

28. Intermedia: The Business Cloud for SMBs
+
from the world’s largest provider of hosted Exchange
HOSTPILOT®
+
28