The Cloud Computing China Congress (CCCC http://www.cloudcomputingchina.org ) is specially designed for senior IT and line of business executives evaluating and making purchasing decisions in the areas of on-demand infrastructure and software services.

1. www.cloudcomputingchina.org

2. Harnessing the Cloud with
Security as a Service
Marc Olesen
Senior Vice President and General Manager, Software-as-a-Service

3. “Organizations worldwide lost
approximately $1 trillion in intellectual
property last year due to cybercrime.”
− McAfee Labs

4. “Two years from now,
Spam will be solved”
− Bill Gates, January 2004

5. More Sophisticated & Complex
• ICBC, most popular bank in China
• The phishing site’s domain name: “1”CBC

6. More Sophisticated and Complex

7. Economic Pressures
Worldwide IT Spending Declining
Worldwide IT Spending Declining

8. Opposing Forces
Do More! Spend less!

9. A New Direction
• SaaS is a priority for 74% of Chinese
firms with 29% planning to pilot SaaS
projects in the next 12 months.
Source: Forrester
• SaaS is forecasted to grow at five times
the rate of software applications through
2013. Cloud Computing
Source: Gartner
• In 2008, SaaS deployments grew 33%
in Enterprises.
Source: Forrester
• Over next five years, Security-as-a- Do More! Spend less!
Service market will grow by twenty-five
percent.
Source: IDC

10. SaaS Benefits Growing Businesses of Any Size
Small Businesses
• Enterprise-grade security w/out complexity
• Simple to deploy and maintenance free
Medium Businesses
• Highly scalable and flexible for growth
• Requires no major capital outlays
Large Enterprises
• Leverage core competencies
• Flexible architecture & interlocked solutions
• Lower and more predictable costs (TCO)

11. Unlike previous times, we
have an opportunity to address cloud
security challenges before the cloud
becomes ubiquitous

12. McAfee’s Cloud Strategy
SECURITY FROM THE CLOUD
SECURITY IN THE CLOUD
SECURITY FOR THE CLOUD

13. McAfee Security-as-a-Service
What is Security-as-a-Service?
Security controls that are available by
subscription and are managed and delivered
via the internet by a software vendor.
Why Security-as-a-Service?
Greater Return on Investment Less Risk
•Faster time to value • Focus on securing business,
•Reduce total cost of ownership not managing software
• Unburden IT resources

14. Value of Security SaaS
Reduce operational expenses
On Premises Security Security SaaS
Year 1 Year 2 Year 3 Year 1 Year 2 Year 3
SaaS subscription,
$146,000 $146,000 $146,000
maintenance included
Perpetual license $500,000 $0 $0
Annual support (40%) Included $200,000 $200,000 Included Included Included
Management server
$1,500 $0 $0 Included Included Included
hardware
Management server
operating system/ $270 $50 $50 Included Included Included
other hardware
Administration and
$500 $0 $0 $500 $0 $0
deployment
Ongoing server
$0 $750 $750 Included Included Included
maintenance cost
Total $502,270 $200,800 $200,800 $146,500 $146,000 $146,000
Data provided for illustrative purposes only. Your results will vary.

15. Value of Security SaaS
Reduce operational expenses
On Premises Security Security SaaS
Year 1 Year 2 Year 3 Year 1 Year 2 Year 3
SaaS subscription,
$146,000 $146,000 $146,000
maintenance included
Perpetual license $500,000 $0 $0
Summary
Annual support (40%) Included On Premises
$200,000
$200,000 Included SaaS
Included Included
Management server
$1,500 $0 $0 Included Included Included
hardware
3-year TCO
Management server
$903,870 $438,500
operating system/ $270 $50 $50 Included Included Included
other hardware
SaaS Savings
Administration and
− 51%
$500 $0 $0 $500 $0 $0
deployment
Ongoing server
$0 $750 $750 Included Included Included
maintenance cost
Total $502,270 $200,800 $200,800 $146,500 $146,000 $146,000
Data provided for illustrative purposes only. Your results will vary.

16. Challenges
1. Fragmented market
2. Lack of focus, experience or expertise
3. All-or-nothing offerings

17. McAfee’s Unique Position
Instant Access Real-Time Protection Peace of Mind
DIVERSITY – Broadest Security-as-a-Service portfolio in the industry
RELIABILITY – Real-time protection with Global Threat Intelligence
FLEXIBILITY – Deployment options to fit your dynamic business
Security-as-a-Service

18. Broadest SaaS Portfolio in the Industry
Real-time Protection with Global Threat Intelligence
Global Threat Intelligence™
http://
!
McAfee SaaS Management Console
Email Email Website PCI Vulnerability
Endpoint Web Email Continuity Archiving Certification Compliance Assessment
Multi‐tenant , Scalable Service Platform

19. McAfee Delivers Flexible Security
Deployment options to fit your dynamic business
Security-as-a-Service
Software Appliance

20. Flexible Options for Email Protection & Compliance
Hybrid Delivery / Layered Security
INBOUND
OUTBOUND
Email Gateway

21. McAfee’s Cloud Strategy
SECURITY FROM THE CLOUD
SECURITY IN THE CLOUD
SECURITY FOR THE CLOUD

22. Global Threat Intelligence
Spans the entire Internet Providing reputation
including millions of based capabilities
sensors
Across all threat Dedicated GTI
vectors research team
Real-time “in the cloud” threat Complete suite of endpoint and
collection and distribution model network research products
22

23. The Protection Gap
1–24 4–8 2–8 4–8 1–24
Hrs Hrs Hrs Hrs Hrs
t0 t1 t2 t3 t4
Malware Malware Protection Protection Protection
in the Wild Discovered Available Downloaded Deployed
Protection Gap of
24–72 Hours
with Current Solutions

24. Compressing the Protection Gap
1–60 1 15 0 1–10
Min. Sec. Min. Sec. Sec.
t0 t1 t2 t3 t4
Malware Malware Protection Protection Protection
in the Wild Discovered Available Downloaded Deployed

25. Compressing the Protection Gap
~15
Min.
t0 t1 t2 t3 t4
Malware Malware Protection Protection Protection
in the Wild Discovered Available Downloaded Deployed

26. New Paradigm
0
Min.
t0* t0
Protection Malware
Is in the
Deployed Wild

27. Korean DDoS Attack
GTI Thwarting a DDoS Attack
Deviation
5000%
4000%
3000%
Reputation Class
2000%
1000%
0%
Deviation from average message count Deviation from average connection count
July 4th DDoS
July 4th 2009: 200,000 zombie Korean botnet
launches DDoS against US and South
Korean government sites

28. McAfee’s Cloud Strategy
SECURITY FROM THE CLOUD
SECURITY IN THE CLOUD
SECURITY FOR THE CLOUD

30. What cloud END USERS want...
 Secure cloud infrastructure
 Providers implement current & future cloud standards
 Third-party certification
 Automation of auditing & security
 More transparency

31. Existing Standards for Cloud Providers

32. Information Certification is NOT enough
Must test for technology vulnerabilities
• Daily third-party security validation
• Updated with latest vulnerabilities
• Quick remediation
• Automate compliance
• Easy-to-deploy and maintain

33. McAfee Cloud Secure Program
TE
ST
+
ED
25
-M
Cloud Security Certification McAfee Cloud Secure AR
•ISO/IEC 27001 & 27002 • Over 15,000 vulnerabilities tested
•SAS70 Type II • Automated Security Audits
• Infrastructure
•Gap Analysis
• Network Perimeter
•Readiness Assessments • Application
•Certification Planning • Remediation Management
•Implementation and Training • Intelligent Network Discovery
•Annual Renewal • Discovery of hosts, services and devices
• Daily Scan and Audit Report

34. McAfee’s Cloud Strategy
SECURITY FROM THE CLOUD
SECURITY IN THE CLOUD
SECURITY FOR THE CLOUD

35. In today’s environment, Cloud computing
is not just for scaling your business,
but also protecting it

37. www.cloudcomputingchina.org