1. Fundamentals of Hardware Security Modules
Mark Yakabuski Product Manager, HSM René Bastien Product Manager, Payment Products Clara Wicke Product Marketing Manager, HSM

2. Agenda Definition of an HSM Product overview & general applications
Market drivers/trends
Going to market/ Why we win
Product overview (individual)
Competitive matrix
Payment products
Marketing tools and Q2 outlook

3. What is a Hardware Security Module (HSM)?
A device to keep Business critical crypto keys at the highest level of security
Accelerate Crypto operations to eliminate bottlenecks
Provides a clear audit trail for all key materials, crypto operations
We have a wide range of HSM options
Varying performance, storage capacity, and Form Factors, authentication models
Wide range of SDKs/Toolkits for flexible integration

4. HSM Technology Breadth of Hardware Security Offerings
Luna PCI
Luna SA / SP
Luna XML
Protect Host EFT
Performance
Protect Server
PCM, CA4
SafeNet offers technology for cryptography and secure key management from intellectual property that can be embedded on a chip all the way through scaleable networked appliances – no one else offers this breadth
Networked, Scaleable
Offline Key Archive
Customizable,
Economical
Payments, EMV/EFT
SOA, Web Services
Fastest

5. Market Overview

6. Typical HSM Applications
2A. Code Signing
1. PKI Certificate Authority
10. Financial
Transactions:
EFT, Payments Clearing & PIN Mgt
2B. Secure Manu. / Device Issuance
1B. Time Stamp
2C. Smart Card, Passport & License Issuance
Financial
Networks
5. Certificate Validation
HSM’s are the Tire!...Find the cars that need high security Tires!
Internet
3. Client Systems with Disc Enc &
2F Auth
4. Authentication
& VPN
Access Control
9. SSL & XML
Webservers
Documents
Database
8. Gaming
consoles
7. Secure
& Document
Rights Mgt / Signing
6. Database
Encryption

7. General Purpose Market Trends
ECC Brainpool/E-passport projects
ECC interest, Suite B (NSA standard
Key Management
PKI…real growth of 3rd gen PKI apps
Combining COTS solutions, and Customized development efforts.
Web Services/Service oriented architectures
MS CertServ continuing to gain install base
PCI-express
Paper to digital processing
PCI-DSS standard
Large HSM deployments
Hand/Hand with customized solutions.
In account early, help architect
Leverage our great SE’s
SWIFT/UBS/SIC…
The BIG DEALS.

8. Ideal Customers – how to find them
An HSM is nothing without a Host Application (a car).
Off the Shelf or Custom?
Solution Seekers
Are purchasing/have purchased some application from a 3rd party
Our HSM has either been recommended or referred as one of a number of supporting HSMs
Customers will select an HSM based on
3rd party recommendation
Responsiveness & Support
global presence and capability
level of integration
price
Developers
Are developing their own application for sell, cost or competitive reasons
Developers are either internal users or OEMs
Customer will select their HSM partner based on:
Apps Eng team, SE capabilities
technology & toolkits
Responsiveness & Support
global presence and capability, stability
price
Integrations team in India
Building Integration guides

9. Examples Solution Seekers Developers
…any size organizations – with small to medium sized deployments
Always because of a Partner Integration
SafeNets most valuable partners
Entrust & Verisign
Microsoft
Card Personalization
Payments Apps providers
From Contact to Contract ~ 3 months
Revenue from the deal is mostly complete at that point
but the partnership continues to deliver
Developers
…large organizations – with large future plans
Select SafeNet because of the quality of products/tools, our global presence and our relationship management
Examples
SWIFT, NCR, Cisco, Cavium, SIC
From Contact to Contract ~ 3 to 12 months
Revenue follows 3 to 6 months after Contract
Revenue is then ongoing based on the nature of the end solution
Action: Continue enhanced focus on partners – and developing those relationships
Action: Focus on enhancing toolkit & product offerings, material and positioning - and training Sales & responsiveness

10. Roadmap

11. 2008 HSM Value Add Easy setup/management Enterprise Grade Features
Early 2008
Luna Sx
Luna SA maturity
Luna XML
Brainpool support (PSG, SA)
DOCK II (I know…finally!)
Mid 2008
PCI Express support on Luna platform
Luna XML v2
Luna Sx v2
Late 2008, early 2009
Luna “PKI Bundle”
Luna SA maturity continued
Remote PED
PCI Express support on PS platform
Easy setup/management
Enterprise Grade Features
Easy deployment, First XML HSM in Market
ePassports
Initiative
PCI Express Support

12. Luna SA Result: A mature Enterprise Grade Appliance Robust Feature Set
The required certifications
SA 4.2(Nov 2007):
NTLS redesign (connection limit increase, 800)
Over 4000 ops/sec
CNG support
Enhanced SNMP
Fuller Platform support (including Solaris X86 support)
Luna SA 4.3(march 31/08)
Brain pool Support
HP Itanium OS support
Luna SA 4.4(Q4/08)
HA Overhaul
Remote PED
PKI Bundle

13. Remote PED Administration (part of Luna SA 4.4 release, Q4/08)
Will offer full PED functionality at Remote Admin work station.
Centralized control
No PED required at Data Centers
Will require new Remote PED built at manufacturing (not field upgradeable). Can be used as either remote/local PED.
Will not be compatible with 2U units.
New Orange PED key for Remote Admin

14. PKI Bundle (part of Luna SA 4.4 release, Q4/08)
Why?
Customer/Partners have asked for it; Verisign, Entrust, Arcot, Microsoft, RSA….
Allows us to leverage existing technology Luna SA/Luna tokens
Create competitive differentiator
What is it?
Luna SA, up to 20 partitions for Signing/key management. Internal SA card reader is used to house PCM tokens.
Tokens are accessible via same client API as the Luna SA. Each token is a member of the available slot list exposed by the SA/CA4/KE total.
Benefit:
Key Gen/Offline Root/Online Root capable from 1 unit
Cost savings to customer
Product IT
Will not be compatible with 2U units.

15. SafeNet Luna XML…world’s first!
Rapid-to-deploy high-assurance HSM for XML environments
Revolutionizing application and transactional security with the world’s easiest to integrate and deploy hardware security module
Why?
Business applications move to Service Oriented / XML based architecture.
Nature of XML is designed to allow for B2B, B2G, B2C inline communication/processing = Security Need!
Benefits?
Clientless
OS independent
Customers don’t need to be crypto API gurus(P11/JCA/CAPI)
FIPS validated HSM Level 3
Scalable, Reduces IT costs and Time to deploy.
Built for Service Oriented Architectures
Meets Compliance Needs

16. Rapid Deployment with Luna XML
Traditional HSM
SafeNet Luna XML
OS dependency
OS independent!
Customer Application
Customer XML Application
Custom built XML service
Custom Java layer
JCA/JCE API
Cryptoki Layer
XML Crypto Service
From months …
… to days!
Jan | Feb | Mar | Apr | Jun | … ?
Mon | Tue | Wed | Thu | Fri !

17. Luna XML Operational Use
Platform independent
XML Based Application
SSL
SSL
SSL
XML
XML
SSL
SSL
XML
SSL
Easy to Scale!
Load balancer
Available across multiple sites for DR
XML crypto service
XML crypto service
XML crypto service
Crypto object synchronization

18. Sample XML Call What is XML? (Extensible Markup Language)
XMLSign
Signs XML Document
<xmlSign Profile="urn:oasis:names:tc:dss:1.0:profile:dss_interop" RequestID="id">
<OptionalInputs>
<KeySelector>
<KeyInfo/>
</KeySelector>
<IncludeObject WhichDocument="12345" ObjectID="54321"/>
</OptionalInputs>
<InputDocuments>
<Document ID="12345" RefURI="uri">
<EscapedXML>escaped XML</EscapedXML>
<InlineXML>Some XML</InlineXML>
<Base64XML>base64 encoded xml </Base64XML>
<Base64Data>base64 data</Base64Data>
</Document>
</InputDocuments>
<AuthToken/>
</xmlSign>
What is XML? (Extensible Markup Language)
Like HTML in structure
Data centric, not concerned with display
Leveraged via WSDL (Web Service def’n language)…like our PKCS#11 API.
SOAP (Simple object access protocol), used to encapsulate msg objects.
SOAP msg’s defined in pairs (request/response)

19. Luna XML Replacement for Luna SA? No it is not…
New customers, new opportunities
Paper to digital
PCI DSS
B2B, B2G
Existing customers, new opportunities
New deployments

20. XML Value Added Questions
Reduce risk, $ cost of compromise
Are you deploying SOA/XML today, or in the future?
What if your services were compromised?
Are these services client or partner based?
Would you like to differentiate from your competitors?
Would you like decrease your HSM deployment and management costs
Would you like a quick/easy way to add Enterprise grade security to your service offerings?
Help Architect. Know the customer = larger deals
There are 1000’s of companies deploying Web Services…FIPS/CC HSM differentiates
No more platform Dependence, Upgrades
Luna XML!

21. Luna SX (Start-up Xpress)
Why?
Difficult setup
So is Competitors
Gives us another competitive advantage.
What is Sx?
GUI management
Built in partnership with KEYON.
Can Manage SA or SP appliances (multiple)
How to get it?
Demo available
Production features will require update to license on the sentinel key.
GA?
Q2, 2008.

22. Luna SX Screen shot Partition details Multiple clients
Multiple devices, SA/SP
Available preset actions
Admin Tabs

23. Driven By ePassports Initiatives World Wide
BrainPool Support
PSG with PTK 3.32 release GA May /08
Luna SA with 4.3 release GA March 31/08
Luna PCI with 3.0 release GA Q3/08
Support for Named, and “user defined” Brainpool ECC curves
Driven By ePassports Initiatives World Wide
User Defined feature…opens other doors (like Marlin curve set)

24. Release Details (Protect Server)
PTKC 3.32 (May/08)
Brainpool support
RoHS Card reader/Pin Pad support
PTK-M password fix
PSO/PSG support
CNG support
New OS support
Java 1.5 support
PTK 4.0 (Q1/09)
PCI-Express support
New PCI board layout
PTK BETA with Brainpool support available Now!

25. SafeNet HSM Product Range Overview
ProtectServer External
ProtectServer Internal
ProtectHost EFT
Luna CA3/CA4
Luna PCM
Luna PCI
Luna SA
Luna SP
Server
Network
Network
Network
Embedded
Embedded
Embedded
Server/
Network
Attachment
FIPS 140 Level 2 and Level 3
Certifications
CCEAL 4+ (CA3)
CCEAL 4+
CCEAL 4+
PKCS 11, Java, CAPI
SW Support
PPO
PPO
PPO
1024 RSA
Signings (max)
27/sec
4000+/sec
4000+/sec
600/sec
27/sec
600/sec
7000/sec
1200/sec
Encryption
Algorithms
Symmetric and Asymmetric
20 x partitions,
SSL acceleration
EFT Command
Sets
Other features

26. SafeNet Network-Attached HSMs
Luna SA / SP
ProtectHost EFT
Luna XML
Luna SX
 High assurance enterprise-grade HSM
4,000 ops/s
FIPS Level 3, CC EAL 4+
Full platform support
Secure remote administration
10/100 Ethernet interface
Protected application execution environment (Luna SP)
Extensive algorithm support
 High assurance HSM for financial payment systems
PIN generation & verification
Supports global payment processing, EMV, and Card Issuance APIs
1,200 Visa PIN Verify operations / sec
Certifications: FIPS Level 3, CC
Easy GUI-based administration
 High assurance enterprise-grade HSM for XML environments
XML interface (WSDL) encapsulates crypto functions, enabling rapid integration development
FIPS Level 3
Extensive algorithm support
No client required
2,200 ops/sec
OS independent
Secure remote administration
10/100/1000 Ethernet interface
 Central HSM Management Console
Intuitive GUI
Easy setup & management of multiple HSM appliances
Reduces cost of administration

27. SafeNet Internal HSMs CA4 Luna PCM Luna PCI ProtectServer Gold
 Root key HSM for true hardware key management
FIPS Level 3 certified
Extensive algorithm support
Supports two-factor trusted path authentication
Supports common certificate authorities (Microsoft, Entrust, Verisign, RSA, etc.)
 Portable, cost-effective PCMCIA HSM card for hardware key management and crypto acceleration
Versions for document signing, key export for registration of tokens, and signing and back up of key material to a token
FIPS Level 3
Extensive algorithm support
 Cost-effective high- assurance PCI HSM card for customizable hardware key management
600 ops/s
Easy GUI-based administration
Customizable interface
FIPS Level 3
Extensive algorithm support
Secure remote administration
 Fast, high-assurance PCI HSM card for hardware key management and crypto acceleration
7,000 ops/s
FIPS Level 3, CC EAL 4+
Supports two-factor trusted path authentication
Extensive Algorithm support

28. Competitive Details

29. SafeNet HSM Industry Leadership
First general purpose network HSM
Secures the most financial transactions
Most PKI deployments
Most HSM hardware form factors/toolkits
HSM leader for 15 years
Leader in HSM compliance (FIPS, CC, PCI-DSS, E-passports…)
……New Luna XML

30. Why SafeNet HSM’s? Do You Care about these things? Reducing your risk
Fraud/Breaches
Physical disaster
Reducing your costs
Moving to digital processing
Deployment/integration costs
Increasing your revenue
Enabling new online Business process
Industry regulation/compliance
FIPS, CC, Sarbox, PCI-DSS, E-Passports, EMV, and industry audits
Who does: Largest online PKI provider in the World. Deploys 1000’s of SafeNet HSMs
Who does: Largest Financial Network in the World. Deploys 1000’s of SafeNet HSM’s.
Who does: World’s Largest internet Bank.

31. Luna Vs. PS, which to position?
HW Key Management
Enterprise class Appliance
SNMP, HA, secure CLI, NTLS, Shareability
CC certification in process
PED auth
More 3rd party integrations
HSM backup option
Existing Luna install base
Higher Performance PS
FM’s (and the customization they offer)
PCI FF, lower entry $price$
Embedded OEM opportunities
Fuller OS support than Luna PCI
EFT FM
Existing PS install base
Position Luna:
High Assurance, security focused offering.
More FF choices.
Enterprise Grade Appliance offering.
Competing v nCipher
on Security:
Leverage Luna features
on Entry Price:
Leverage PS features
Position PS:
Flexible, Embedded focused offering
Customizable Firmware
lower entry price.

32. Competitive Details (Positioning)
More Secure key management
More Enterprise Grade features
More speed, up to 7000 ops/sec (more than Double nCipher)
First to market XML HSM
Easiest to Set up/Manage (Luna Sx)
More extensive API/Toolkit set
FM’s, XML, Java, OpenSSL, P11, CAPI
More Extensive range of HSM offerings
Appliances, PCI cards, PCM tokens
More Large Customer installations
SWIFT, SIC, DOD UBS, Verisign, NCR, AOL
LESS expensive HSM’s
LESS expensive HSM product options (licenses, toolkits, FM)
Updates:
nCipher Buys Neoscale.
Tape backup
Key Man App (not very Robust).
Bankrupt, then bought
Sun Crypto card
Cheap, but not real threat.
Ltd OS/API support
FCC only in SUN box.
SSL/IPSec target card.
= BEST VALUE
Difference
Difference
Difference

33. Competitor’s Positioning
nCipher leads with Key Management positioning
We offer True Hardware key management
nCipher positions themselves as “Enterprise provider”, SFNT as “low-cost” provider.
We have lower list prices, but a more extensive, secure HSM offering
nCipher offers discounts on maintenance, and initial purchases.
nCipher has a stronger MS relationship
nCipher “solution sells”, often is more marketing than “meat”.
Most of what they market as solutions, are the same partnerships offering we have. We are moving to a clearer marketing focus on solutions.

34. Rene Bastien Product Marketing Manager
Payment HSMs
Rene Bastien
Product Marketing Manager

35. HSMs in Payment Market drivers differ Retail Market: Wholesale: EMV
PCI-DSS
Streamlining of operations (outsourcing, PIN)
Move to contactless cards
Payment over new channels (m-payment, NFC, transit, loyalty)
Wholesale:
Transaction authentication
User authentication
Compliance requirements

36. Payment Products Network-attached HSM: ProtectHost EFT Replaces PHW
Great competitive features :
Form factor (1U instead of 4U)
Price competitive
Performance (50% faster than Thales)
Ease of integration (runs same software as PHW)
Backwards compatible

37. Payment Products ProtectTool EFT Version 5.02 in SQA.
Expected GA by Q
Sits on ProtectServer Gold
Essentially, Mark II in a different form factor
Works with PTK C

38. Payment Products ViewPIN+ Application that does 2 things quite well:
Changes your PIN
Enables you to retrieve a forgotten PIN
All of this securely
All of this either at home through a web browser, or in a bank branch
No one does that!
Replaces IVR interface
Simplifies ATM upgrades
Great lead-in to new accounts

39. Payment Product Roadmap
ViewPIN+ formal launch in November 2008
Mark II roadmap for the next 2 years
Full EMV support
Dual role devices (MarkII plus AMB)
Contactless
Mobile commerce
Multiple languages, printers for PIN mailers
Integration with other products, partners
Mark II over multiple platforms

40. SafeNet’s Competitive Edge
Hardware:
Performance
Commonality of platform
Multiple form factors
Continuous R&D
FIPS and CC compliance
Application:
General purpose appliances (including XML appliance)
Depth, breadth of offering
Market share:
General purpose worldwide: leader
Payment:
EMEA (2nd)
APACS (1st)
Partnerships and integrations

41. HSM Marketing Materials and Campaigns
Clara Wicke
Product Marketing Manager, HSM

42. MySafeNet.com Our corporate intranet
Mysafenet.com is broken down by departments. Here is where you can put a face to a name of a colleague, get contact information and also access the latest collateral including sales tools. Intuitive, complete, great bed-time reading material.

43. Sales Tools Case Studies Competitive Matrixes Presentations
Qatar Central Bank
Security Biometric
PCI DSS
E-passport
Egg Bank
Canadian Government
Automotive
Pharmaceutical
Competitive Matrixes
Presentations
Sales Presentations and Corporate Product Slides
Product Briefs
Luna XML
Luna SA
Luna SP
Luna CA4
Luna PCI 7000
ProtectServer External
ProtectServer Gold
ProtectHost EFT
Sales & Partner Success Kits
Hard and Soft Copy
Solutions Briefs
Solutions Selling Handouts
Technical Matrixes
Webinars
Application Development
PCI- Changes and Audits
PCI- Global Compliance
PCI- Technical Architecture & Best Practices
PCI- Deadlines Past Merchants Still Not Compliant Parts 1 & 2
SOA Web Services Security with Layer 7
HSM 101
Whitepapers & Guides
CA3-CA4 Migration Guide
Compliance
Microsoft Guide (almost there)
Tumbleweed User Guide
E-Passport
PKI Best Practices
XML Security
-Qatar shows how our Luna SP, Luna PCI and iKeys were applied in a SWIFT-like environment
-Security Biometric is a US federal government application, the Transportation Security Association, showing how our Luna SA secured data under the registered traveler program
-PCI DSS show cases any HSM
-E-Passport is a Luna SP application
-Canadian Government is a general HSM application used to secure citizen’s private data for online services
-Automotive case study is a European application showing secure authentication and back up with Luna SA and Luna CA3
-Pharmaceutical case study demonstrates access control to private information using CA3 and Luna SA and SP for database encryption
*********************************************************************************************************
-Sales and Partner Success kits were mailed to Betty and Ingrian last week by Trisha Paine
Solution Briefs are internal documents that are dense by nature because they are formatted for at-a-glance viewing and portability Examples of a Solution Selling Handout and “cheat sheet” on the slides to follow
Under white papers and guides, we have integration guides for migrating CA3 to CA4, and user guides such as the Tumbleweed application. The compliance white paper explains the importance of compliance and how it is applied as a best-practice tool. Also falling under best practices, are our PKI and XML Security.

44. HSM XML “Cheat Sheet”

45. Sales Kit- What’s Inside!
HSM Overview
Key Drivers (Internal and External)
HSM Value Proposition
Applications by Vertical
Problem Owner Profiles
Vertical Solutions
Competitive Analysis
Partner Guides
Quick Sheets for Applications, Competition, and Objection Handling
Prospect List
And More!!!
Online version of sales kit

46. Upcoming HSM Campaigns Q2/Q3
HSM Luna XML Campaign
Launched product at RSA
List being purchased to identify project managers for applications in IT
Also use internal house list of software developers
May: to promote XML white paper
June: to promote XML webinar
Vertical Focused Campaigns
Financial
PCI DSS Compliance
Paper to Digital Transactions
Government
E-passport
First Responders

47. Thank You