IBM Security Systems Agenda Selling the IBM Security Portfolio • Landscape/Background • Opportunity • Issues • CIO perspective • IBM Security Framework Beginning Part 3 of 3 • Selling IBM Security Solutions for: • Security Intelligence, Analytics and GRC • People (Identity and Access Management) • Data Security • Application Protection • Infrastructure - Network, Server and Endpoint • A Postscript to Boost Sales Possibilities • For More Information. . . Part 3 – Slide 1 © 2012 IBM Corporation
IBM Security Systems Managing Security for Endpoints - Challenges How do I maintain the security and compliance of all my endpoints, regardless of where they are located or how they are connected, against a 24/7 ever evolving threat landscape? How do I achieve a high level or patch compliance across OS’s and applications within days of a patch release while lowering end-user impact and operational costs? In the event of a security incident, how do I ensure I can reach all my endpoints quickly enough to prevent further intrusion or disruption? How do I ensure the security of mobile devices as they access more and more sensitive systems? Part 3 – Slide 2 © 2012 IBM Corporation
IBM Security Systems Endpoint Manager, built on Big. Fix technology Endpoint Manager IT Operations Solutions Endpoint Manager for Lifecycle Management Unifying IT operations and security Endpoint Manager IT Security Solutions Endpoint Manager for Security and Compliance Endpoint Manager for Mobile Device Management Endpoint Manager for Core Protection Endpoint Manager for Patch Management Endpoint Manager for Mobile Device Management Endpoint Manager for Power Management Endpoint Manager for Patch Management Endpoint Manager for Software Use Analysis Part 3 – Slide 3 © 2012 IBM Corporation
IBM Security Systems Tivoli Endpoint Manager for Security and Compliance Tivoli Endpoint Manager Microsoft Windows • Mac OSX • IBM AIX • HP-UX • Solaris • VMware ESX Server • 7 versions of Linux • i. OS • Android • Symbian • Windows Mobile IT Asset Management IT Operations • Network discovery • Patch management • Managed endpoint hardware inventory • Managed endpoint software inventory • Software use Analysis • PC software license compliance analysis • • Software distribution OS deployment Remote control Server management IT Security and Compliance • Security configuration baselines • Vulnerability assessment • Network selfquarantine • Personal firewall • Multi-vendor antimalware management Green IT • Windows power management • Mac power management • Wake-on-LAN • Third-party antimalware management • Web, file, email reputation services 1 console, 1 agent, 1 server, many OSs Part 3 – Slide 4 © 2012 IBM Corporation
IBM Security Systems Endpoint Manager for Security and Compliance • Patch Management • Security Configuration Management • Vulnerability Management IBM Endpoint Manager • Asset Management • Software Use Analysis • Network Self Quarantine • Multi-Vendor Endpoint Protection Management Library of 5, 000+ compliance settings, including support for FDCC SCAP, DISA STIG Discover 10% - 30% more assets than previously reported Automatically and continuously enforce policy at the end point Achieve 95%+ first-pass success rates within hours of policy or patch deployment • Anti-Malware and Web Reputation Service Part 3 – Slide 5 © 2012 IBM Corporation
IBM Security Systems Endpoint Manager and endpoint compliance Traditional compliance Continuous compliance 1. The security team develops compliance policies 1. Security and operations work together to formulate policies and service-level agreements (SLAs) 2. The security team runs an assessment tool (or tools) against that policy 2. Operations implements the baseline (patch, configuration, anti-virus, etc. ) across all endpoints in the organization 3. The security team forwards findings to operations 4. Operations makes corrections as workload allows, one item at a time using different tools from security (which generates different answers to questions like “how many endpoints do I have? ”) 5. Users make changes causing endpoints to fall out of compliance again 3. Policy compliance is continuously monitored and enforced at the endpoint; changes are reported immediately 4. The security team can instantly check on the current state of security and compliance anytime 5. Security and operations teams work together to continually strengthen security and adjust to evolving requirements 6. Start assessment all over again Part 3 – Slide 6 © 2012 IBM Corporation
IBM Security Systems Endpoint Manager for Core Protection Endpoint Manager Microsoft Windows • Mac OSX • IBM AIX • HP-UX • Solaris • VMware ESX Server • 7 versions of Linux • i. OS • Android • Symbian • Windows Mobile IT Asset Management • Network discovery • Managed endpoint hardware inventory • Managed endpoint software inventory • Software use Analysis • PC software license compliance analysis IT Operations • • • Patch management Software distribution OS deployment Remote control Server management IT Security and Compliance • Security configuration baselines • Vulnerability assessment • Network selfquarantine • Personal firewall • Multi-vendor antimalware management Green IT • Windows power management • Mac power management • Wake-on-LAN • Third-party antimalware management • Web, file, email reputation services 1 console, 1 agent, 1 server, many OSs Part 3 – Slide 7 © 2012 IBM Corporation
IBM Security Systems Endpoint Manager for Core Protection Protecting endpoints from viruses, malware and other malicious threats Overview Delivers single-console, integrated cloud-based protection from viruses, malware and other malicious threats via capabilities such as file and web reputation, personal firewall, and behavior monitoring Highlights § Delivers real-time endpoint protection against viruses, Trojan horses, spyware, rootkits and other malware § Protects through cloud-based file and web reputation, behavior monitoring and personal firewall § Provides virtualization awareness to reduce resource contention issues on virtual infrastructures § Leverages industry-leading IBM® and Trend Micro™ technologies with a single-console management infrastructure Part 3 – Slide 8 © 2012 IBM Corporation
IBM Security Systems Key Benefits & Features of Data Protection Add-on § Real-time content scanning of sensitive data § Out-of-the-box compliance templates to detect credit card numbers, social security numbers, among other sensitive data § Monitoring and enforcement of multiple egress points (email, browser, USB, etc) § Low TCO – Addresses baseline data protection requirements with minimal cost and investment; scales to 250, 000 endpoints on a single server Part 3 – Slide 9 © 2012 IBM Corporation
IBM Security Systems Tivoli Endpoint Manager for Mobile Device Management Tivoli Endpoint Manager Microsoft Windows • Mac OSX • IBM AIX • HP-UX • Solaris • VMware ESX Server • 7 versions of Linux • i. OS • Android • Symbian • Windows Mobile IT Asset Management • Network discovery • Managed endpoint hardware inventory • Managed endpoint software inventory • Software use Analysis • PC software license compliance analysis IT Operations • • • Patch management Software distribution OS deployment Remote control Server management IT Security and Compliance • Security configuration baselines • Vulnerability assessment • Network selfquarantine • Personal firewall • Multi-vendor antimalware management Green IT • Windows power management • Mac power management • Wake-on-LAN • Third-party antimalware management • Web, file, email reputation services 1 console, 1 agent, 1 server, many OSs Part 3 – Slide 10 © 2012 IBM Corporation
IBM Security Systems Managing Mobile Devices – The Solution Endpoint Manager for Mobile Devices – Enable password policies Secured by Big. Fix policy End User – Enable device encryption – Force encrypted backup – Disable i. Cloud sync – Access to corporate email, apps, VPN, Wi. Fi contingent on policy compliance! – Selectively wipe corporate data if employee leaves company – Fully wipe if lost or stolen • Personal Mail / Calendar • Personal Apps Corporate Profile • Enterprise Mail / Calendar • Enterprise Access (VPN/Wi. Fi) • Enterprise Apps (App store or Custom) VPN / Wi. Fi Encryption Enabled Corporate Network Access i. Cloud Sync i. Tunes Sync Part 3 – Slide 11 © 2012 IBM Corporation
IBM Security Systems PCs and mobile devices have many of the same management needs Traditional Endpoint Management Mobile Device Management § OS provisioning § Device inventory § Patching § Security policy mgmt § Power Mgmt § Application mgmt § Anti-Virus Mgmt § Device config (VPN/Email/Wifi) § Encryption mgmt § Device Wipe § Location info § Jailbreak/Root detection § Enterprise App store § Self-service portal § Roaming device support § Integration with internal systems § Scalable/Secure solution § Easy-to-deploy § Multiple OS support § Consolidated infrastructure Part 3 – Slide 12 © 2012 IBM Corporation
IBM Security Systems How does Endpoint Manager manage mobile devices? § Agent-based Management - Android via native Big. Fix agent - i. OS via Apple’s MDM APIs - Full management § Email-based management through Exchange and Lotus Traveler - Supported platforms: i. OS, Android, Windows Phone, Windows Mobile, Symbian - Subset of management - management of email on the device and the ability to lock and wipe the device Category Endpoint Manager Capabilities Platform Support Apple i. OS, Google Android, Nokia Symbian, Windows Phone, Windows Mobile Management Actions Selective wipe, full wipe, deny email access, remote lock, user notification, clear passcode End-User Services Self-service portal, enterprise app store, authenticated enrollment (AD/LDAP) Application Management Application inventory, enterprise app store, whitelisting, blacklisting, Apple VPP Policy & Security Management Password policies, device encryption, jailbreak & root detection Location Services Track devices and locate on map Enterprise Access Management Configure email, VPN, and Wi-Fi; certificate management Expense Management Enable/disable voice and data roaming Part 3 – Slide 13 © 2012 IBM Corporation
IBM Security Systems Endpoint Manager extends the value proposition for existing endpoint and server security customers Endpoint Manager Family Value-Add Up-Sell Opportunity Proventia Desktop (PD) and Endpoint Secure Control (ESC) § Robust, scalable Big. Fix platform for delivering full lifecycle and security applications and content § Core PD applications move to Big. Fix § Upgrade 400+ PD customers to Endpoint Manager Lifecycle and Security Management suites Tivoli Security Compliance Manager (TSCM) § Vulnerability assessment and patch management for remediation § Lightweight, flexible platform § SCAP certifications for US Federal § TSCM is at end-of-market; so, TEM SC is not an upsell, per se. § Upgrade 400 SCM clients (200 individual, 200 ITD) to patch management to remediate configuration & vulnerability issues § Upgrade to full Endpoint Manager Family Proventia Server (IBM Security Server Protection) & Real. Secure Server Sensor § Integrated platform for management, patching, config compliance and threat prevention § Ability to sell/manage anti-malware § Add patch, configuration and vulnerability management § Anti-malware (via Trend Micro) for more complete compliance/ protection IBM Security Access Manager for Enterprise Single Sign-On (E-SSO) § Extend endpoint management value delivered by SAM E-SSO, to include Endpoint Manager deployment § Strengthens endpoint ROI case § Extend ROI / productivity gains from ESSO (450+ installs) by adding Endpoint Manager Lifecycle Management Part 3 – Slide 14 © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients IBM Security Systems End. Point Security Sales Insights (including Competition) ü Endpoint continuous compliance, monitoring, visibility and “take remediary action” focus is a big play in these days of compliance focus and audit and intrusion fears ü Don’t accept “We don’t need this product because “We already have security products for our endpoints” (e. g. NAV for anti-virus, SCCM for patch management) ð A Endpoint Manager proof of concept can dramatically demonstrate: - Wow! We have more OSs, devices, endpoints than we thought, and we need to protect them! (Some weren’t installed, weren’t up-to-date, weren’t up and running, …) - Wow! This product works! It’s up and running quickly, it is accurate, it has a wealth of capabilities and there is really fast time to value! ü Look for the following – large scale deployments - tool consolidation, 3 rd-party patching, continuous compliance focus, anti-virus consolidation/replacement. ü Continuous compliance through local enforcement ü Speed of policy updates ü Support for heterogeneous OS’s (Windows, Macs, *nix) and applications (Microsoft apps, Adobe, Java, Firefox, etc. ) ü Scalability is a big plus for us. . . 250, 000 endpoints per single Endpoint management server vs. Microsoft (e. g. 175 SCCM servers and 30 administrators for a 100, 000 endpoint customer) ü One system for ALL endpoints, including mobile. ü Our competitors don’t have the same integration for platforms & DLP without an expensive infrastructure Part 3 – Slide 15 © 2012 IBM Corporation
IBM Security Systems Security Challenges Specific to the Mainframe Ensuring Verifying Compliance § Compliance: – Compliance verification is a manual task with alerts coming after a problem has occurred, if at all § Complexity: Increasing Complexity – The mainframe is an integral component of many large business services, making the identification and analysis of threats very complex and creating a higher risk to business services – Systems are vulnerable to the unmanaged activities of privileged users. Rising Costs Part 3 – Slide 16 § Cost: – Mainframe security administration is usually a manual operation, or relies upon old, poorly documented scripts. – Administration is done by highly skilled mainframe resources that are usually in short supply. © 2012 IBM Corporation
IBM Security Systems z. Secure suite Capabilities Auditing & Compliance Reporting Enhanced Administration Vulnerability analysis for your mainframe infrastructure. Automatically analyze and report on security events and detect security exposures Enables more efficient and effective RACF administration, using significantly fewer resources Visual Administration Event Alerting Helps reduce the need for scarce, RACF-trained expertise through a Microsoft Windows–based GUI for RACF administration Real-time mainframe threat monitoring permits you to monitor intruders and identify misconfigurations that could hamper your compliance efforts CICS based Administration Command Verification Policy enforcement solution that helps enforce compliance to company and regulatory policies by preventing erroneous commands Provides access RACF command & APIs from a CICS environment, allowing for additional administrative flexibility Administration & Auditing for z/VM Combined audit and administration for RACF in the VM environment including auditing Linux on System z Part 3 – Slide 17 © 2012 IBM Corporation
IBM Security Systems z. Secure suite Business Benefits § Helps to reduce cost and improves resource utilization – Task automation reduces labor cost to perform essential z/OS and RACF security functions – Simplified UI allows less experienced resources to perform key security functions, freeing up skilled mainframe resources and allowing administer to manage security rather than using system programmer skills. – Improved system availability with automated analysis and detection of threats and configuration changes. § Proactive compliance monitoring – Automated compliance monitoring, customized to fit your business, issues real time alerts on external threats, inappropriate data access or misconfiguration – Real-time blocking of dangerous RACF commands helps prevent privileged user abuse – Automated data collection for compliance reporting, audit trail analysis and forensic research. § Improves efficiency and quality – Automated functions reduce mistakes that lead to data exposure and costly outages – Single point of administration easily manages large and small z/OS environments, and multiple RACF databases – Streamlined management of privileged users quickly identifies & removes unnecessary access to information Part 3 – Slide 18 © 2012 IBM Corporation
IBM Security Systems Solving Customer Security Challenges in Mainframe Environments z/OS, z/VM and Linux on System z Automate continuous compliance to address worldwide industry standards and regulations Improve administrator effectiveness with built-in best practices Illustrated to auditors that preventative, detective and corrective controls are installed Reduced identity and access security management overhead and costs with integrated security management Protect the integrity of sensitive enterprise data Major healthcare organization Part 3 – Slide 19 Used IBM technologies to track and redact medical information from imaged documents. Simplify mainframe administration and auditing for compliance and governance Establish user identification services for compliance and governance © 2012 IBM Corporation
IBM Security Systems z. Secure provides customers with significant business value IBM's Significant Product Capabilities z. Secure Enhanced Administration § § Auditing & Compliance Automated cleanup of orphan accounts Off line change management & change modeling RACF DB merges Cascading permissions for Group Tree Structures § Customizable reports § Automated risk classification § Broad coverage of audit control points § Security Intelligence to identify and manage Trusted Users § Exceptional coverage of security event records Part 3 – Slide 20 IBM's Business Value § Helps improve security at lower labor cost § Aids in reducing costs by avoiding configuration mistakes § Eases labor cost for directory merges § Helps reduce labor cost by more efficient group management § Can provide report that match business model / business requirements § Helps optimize labor utilization by prioritizing tasks § Aids in reducing cost by helping eliminate outages not detected by non-IBM solutions § Address business risk by helping to find segregation of duties exposure © 2012 IBM Corporation
IBM Security Systems z. Secure provides customers with significant business value z. Secure IBM's Significant Product Capabilities §IBM's Business Value § Can capture unauthorized back door § Can reduce cost by helping eliminate changes to RACF, Security Policies § Extensive coverage of real time audit control points, especially network Alerting outages not detected by competition Command Verification § Auditing of RACF changes by Privileged Visual Administration § Real time, on line updates § Integrates w/ HR Systems (People. Soft, § Permits changes in minutes, not overnight § Enables better business control by SAP, etc. ) § Roles based administration for separation of duties § Manage from a single screen providing access for only current employees & contractors § Helps minimize business risk by enabling segregation of duties § Aids in reducing labor cost and errors § Externalizes authentication from the § Can lower application development and CICS based administration Part 3 – Slide 21 Users application § Can complete audit in seconds, not days, reducing labor cost maintenance costs © 2012 IBM Corporation
IBM Security Systems IBM Security z. Secure suite products Vulnerability analysis for your mainframe infrastructure. Automatically analyze and report on security events and detect security exposures Real-time mainframe threat monitoring permits you to monitor intruders and identify misconfigurations that could hamper your compliance efforts Policy enforcement solution that helps enforce compliance to company and regulatory policies by preventing erroneous commands Combined audit and administration for RACF in the VM environment including auditing Linux on System z Enables more efficient and effective RACF administration, using significantly fewer resources Helps reduce the need for scarce, RACF-trained expertise through a Microsoft Windows–based GUI for RACF administration Provides access RACF command & APIs from a CICS environment, allowing for additional administrative flexibility Note: ACF 2 and Top Secret are either registered trademarks or trademarks of CA, Inc. or one of its subsidiaries. Part 3 – Slide 22 © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients IBM Security Systems You Survived the Security Gauntlet. . . Time for a Knowledge Check Match customer need with IBM security solution: • “Provisioning and managing users” C • “Comprehensive single sign-on” C • “Proactive threat mitigation” • “RACF administration ease of use” A, B, C, D B A • “Patch management, endpoint protection D asset discovery and mobile device security” A – IBM Security z. Secure suite B – IBM Security Network IPS C – IBM Security Identity & Access Assurance D – Endpoint Manager Family Part 3 – Slide 23 © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients 24 IBM Security Systems Move Up the “Food Chain” Whenever You Can Cross-IBM Security Solution Bundle Individual Product Part 3 – Slide 24 © 2012 IBM Corporation
25 IBM Security Systems P. S. – Tivoli Directory Server • A registry/directory/repository. . . For multiple applications to share consistent, up-to-date info about users • World-class technology (DB 2 underpinnings) • Aids IBM Security Sales, by being in the package (limited use license) comes in the AMeb, TIM, TFIM, . packages. Can compete on its own with other Directory/Registry providers: • • Performance/scalability Did we mention “performance/scalability”? Wide platform coverage. (AIX, Solaris, HP-UX, Linux (z. Series, i. Series, x. Series, p. Series), Windows 2003/2008, z/OS) • Open. Group LDAP v 2 certified (Only TDS and Apache are listed at http: //www. opengroup. org/openbrand/register/ ) • Common Criteria evaluation of EAL 4+ (2009) (Oracle is 4+ (2008), CA is 3 (2007)) • Price. Can beat Sun, for example, on price. • Good in large deployments. Some vendor LDAP servers (e. g. Sun) have an architecture requiring all directory entries to be cached in memory to give good performance. TDS offers good performance in configurations where the number of directory entries is too large to be cached in memory. Part 3 – Slide 25 © 2012 IBM Corporation
26 IBM Security Systems P. S. – Tivoli Directory Integrator § Lotus Connections – Maps/maintains enterprise users into Connections DBs (various sources) – Integrates w/PBX middleware that controls physical telephone switches – Integration between TSRM 3 rd party helpdesk systems – “Blue Glue” - Closes the gaps between products TIM’s integration platform for new supported adapters. Customers use TDI as their extension point for customization. § Sametime Unified Telephony § Help desk integration § Tivoli Identity Manager Which products? § Web. Sphere Commerce Server – Automatically add customers to Lotus Connections through published WWW interface into TDI § IBM Mashup Center – Provides WWW access to enterprise data such as SAP, Domino, and other TDI-accessible resources § Compliance Management – TSIEM scans audit & log files. TDI reads from custom systems in the field to create W 7 format logs. Lotus Domino TAMeb TIM § Tivoli Directory Server – TDI acts as an SNMP agent for TDS, IBM’s great LDAP server. – Custom integration of asset information into TADDM and CCMDB using the Id. ML XML format § TADDM – Service Management IT infrastructure discovery Web. Sphere RFID Information Center Tivoli Svc. Req. Mgr. § Network Monitoring drives TSRM ticket generation – Working with IBM products (Netcool Omnibus, TEC, Net. View) and HP Open. View, TDI monitors events in real-time and drives selected events into TSRM. Optionally synchronizes status back to monitoring consoles. § Tivoli Federated Identity Manager – TFIM provides federated (multi-domain) single sign-on. TDI can be called at run-time to augment security tokens with custom data Part 3 – Slide 26 Lotus Quickr Tivoli CCMDB Lotus Connections and many more … © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients IBM Security Systems To successfully sell security, you must include the right stakeholders during the sales cycle: LOB owners SOA/App Architects Application/Db Authorization Security Admin Network / Operations Identity and Access Management Federation Web Security User Account Provisioning Key Management Compliance Threat Mitigation (The solution categories shown typically move right over time – (For ex. - Federation and Web Security both started more in the “SOA/Application Architects” domain)) Part 3 – Slide 27 © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients IBM Security Systems Resources – IBM – Putting Collateral at Your Fingertips Single “landing page” URL to bookmark “Top of mind” items: Sales Plays, SVSA, Security Talk replays Links to all non-SSD Sales Kits Links to all SSD Sales Kits http: //w 3. ibm. com/software/xl/portal/products? nav. selection=/securitysystems Part 3 – Slide 28 and more. . . © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients IBM Security Systems Business Partner Security Collateral - Partner. World Single “landing page” URL to bookmark Key Resources: Sales Plays, Security Talk Replays, Sales Kits, Top Gun Preparation ibm. com/partnerworld/security Part 3 – Slide 29 © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients IBM Security Systems Resources – IBM – Leverage the Power of the Full IBM Security Team w 3 Connections “IBM security contacts” PPT Partner. World “IBM Security contacts” PPT Plus Tiger Team, SWAT, Sales, . . . contacts (incl. non SSD) Part 3 – Slide 30 © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients IBM Security Systems IBM Security Sales Kits § A Sales Kit for each IBM Security Product § Linked to from the IBM Security “Landing” pages (see previous chart) § 80 -20 approach (The 20% of the collateral you need 80% of the time) § Easy “One Stop Shopping” § Ongoing sweeps are done, to ensure relevance, “up-to-datedness” § Includes up-to-date contact info * Value proposition Benefits Average Deal Size/Pricing Lead Passing Guidelines Cross Selling Target Audience Pain Points Key Questions Seller Call to Action Competitive Differentiators References Platform Part 3 – Slide 31 Announcement letters Case studies Client presentation Client References Contacts Data Sheets Demos Education – offering & solution Education - skills & knowledge building FAQ Presentations for IBM Sellers * Press releases Pricing information Proof of concept Proposal Support Materials Redbooks Request a quote Return on Investment (ROI) Solution/product information Technical sales Self Web sites/blogs/wikis explanatory Wins and successes * © 2012 IBM Corporation
IBM Internal/Business Partner Use Only – Not for Use with Clients IBM Security Systems IBM Security References § IBM sales professionals contribute • Through successful sales (revenue) • Through references - Expand the impact/scope of your sales successes - Assist your peers - Thereby positively impacting IBM Security revenue, your salary, variable pay § We ask that you • Review your customers. . . in terms of their willingness to be a reference • Submit information about the reference customers who you identify and negotiate online here. § Need help in explaining the reference process to your client? • Either visit the Client Reference wiki for information, or contact your Client References Specialist for help. § All client references are welcome. In particular, we need of references for: • TSPM, SIAA and z. Secure § Any questions, please feel free to contact us. (See Client References Specialist. ) Part 3 – Slide 32 © 2012 IBM Corporation
33 IBM Security Systems You’ve Made It! Part 3 – Slide 33 © 2012 IBM Corporation
Скачать презентацию IBM Security Systems Agenda Selling the IBM Security
b3eb729d7f6f54b45de7c288c1ab9a09.ppt