Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential Top of Content Box Line Subtitle Line Title Line ​ The Need for Efficiency ​ Security Connected Franklin Sujo, CISSP SE East Commercial Sector

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. Intel Security Confidential SERVERS PC LAPTOP DATABASE USB SMART PHONE ROUTING/ SWITCHING CLOUD VIRTUAL ENVIRONMENT SAN VOIP TABLET EMBEDDED DEVICES WIRELESS APPS 12.5 BILLION CONNECTED DEVICES TODAY 25 BILLION CONNECTED DEVICES BY 2015 Security Challenges: 469,000 unique malware samples discovered weekly 83% organizations hit by Advanced Persistent Threats Flat to down IT/IS budgets Flat number of trained practitioners 50 BILLION CONNECTED DEVICES BY 2020 DECREASED/FLAT BUDGETS LIMITED OR UNTRAINED RESOURCES UNPLANNEDCOMPLIANCE AND REPORTING REQUIREMENTS CHANGINGBUSINESSDEMANDS A Nasty Math Problem Source: Cisco ISBG IoE Report

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. Intel Security Confidential Firm or Fixed Function Devices and IoT An onslaught of uncounted devices

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. Intel Security Confidential Sources: Verizon 2013 Data Breach Investigations Report. Securosis Malware Analysis Quant Metrics Model CONTAINMENT ATTACK COMPROMISE DISCOVERY COMPROMISE TO DISCOVERYDISCOVERY TO CONTAINMENT ADVANCED TARGETED ATTACKS Weeks 64% Days 11% Years 4% Months 12% Minutes 2% Weeks 14% Months 23% Days 42% Hours 19% $8,769 / Incident $3,840,988 / Year 1.2 incidents / Day Hours 9% Advanced Targeted Attacks The reality

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 5 Firewall Endpoint Protection Gateway Security Network IPSCompliance Data Protection MobilitySIEM. 5 TIME Fragmented Security Industry Decreased integration and automation opportunities

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 6 History of Defining Architecture –Inventor of the world’s most widely used computing architecture –Defining countless standards used in everyday lives ranging from USB, WiFi, to IoT –Top 10 Most Influential Brands in the World Largest Dedicated Security Provider –Broadest security product coverage in the industry –Complete portfolio focused upon security –Leadership position in 6 of 8 Gartner Security Magic Quadrants Delivering a Next Generation Security Architecture –Defining innovative industry approaches for collaborative and adaptive security –Introducing security integrations which are sustainable and broadly reaching –Developing capabilities for new security paradigms in areas such as Software Defined Datacenter, Cloud, and IoT

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 7 Consolidating Architectures Challenge: Operational Complexity Console Sprawl Need: Easier Deployment Broader Adoption Deliverables: Console Consolidation Fewer Agents Value: Easier Policy Management Reduced Computing Resources Endpoint Intrusion Prevention Web Gateway Advanced Malware SIEM DLP Firewall Mail Gateway Compliance McAfee Security Connected Evolution Achieving A Connected Ecosystem

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 8 McAfee Security Connected Evolution Achieving A Connected Ecosystem Consolidating Architectures Challenge: Operational Complexity Console Sprawl Need: Easier Deployment Broader Adoption Deliverables: Console Consolidation Fewer Agents Value: Easier policy management Reduced computing resources Firewall Intrusion Prevention Web Gateway DLPMail Gateway Achieving Return on Investment Challenge: Reduce Budgets Greater Operational Expense Reduced Staffing Need : Self Provisioning Reduced Infrastructure Overhead Deliverables: Virtual / Cloud Security Fewer Appliances Reduced Vendor Footprint Value : Significantly Reduced TCO Simplified Operational Experience Endpoint Advanced Malware SIEMCompliance

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 9 Firewall Mail Gateway Intrusion Prevention Web Gateway DLP Endpoint Advanced Malware McAfee Security Connected Evolution Achieving A Connected Ecosystem Achieving Return on Investment Challenge: Reduce Budgets Greater Operational Expense Reduced Staffing Need : Self Provisioning Reduced Infrastructure Deliverables: Virtual / Cloud Security Fewer Appliances Reduced vendor footprint Value: Significantly reduced TCO Simplified operational experience Connected Services Framework Challenge: Siloed Technology Failures Complex Attacks Need: Coordinated Response Adaptive Security Environment Deliverables: Data Exchange Framework Standardized Integration Model Value: Sustainable Integrations Adaptive Protection Models SIEMCompliance

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 10 A Connected Services Architecture Is Not… A Single Vendor Solution A Monolithic Architecture The Continuous Addition of New Technologies A New Environment Requiring More Resources to Maintain Massive Rip/Replace of Security Infrastructure McAfee Security Connected Evolution Debunking Common Obstacles

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential SINGLE CONSOLE SINGLE AGENT McAfee ePO Server Continuously Monitoring over 7M USG and DIB endpoints today Capabilities delivered by single host agent and console Continuous Diagnostics and Mitigation Dynamic Whitelisting Real time file & directory level change control Rootkit, BIOS, device driver, hypervisor, MBR change detection/prevention Processor enabled KVM without KVM switch USB, Bluetooth, Ethernet, Infrared, other Device Control Data Leakage Prevention Processor-Accelerated Encryption (System & File/Folder) Host Intrusion Prevention Anti-Virus Auditing and Compliance Reporting Systems Management FIPS and Common Criteria certification Section 508 Compliance Getting more measurable results per labor hour Security Connected

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential Review Centralized Security Dashboard Discover Active Botnet Traffic Identify Impacted User/Host Verify Host Security Configuration Review Host Security Events Review Host Vulnerability Assessment Block Identified Attacker from Network Investigate Host Network Events OPTIMIZEDENVIRONMENT Consoles Required Resource s Required Effectivenes s Time Required 7.5 hrs 36 mins Low/Moderate High 7 consoles 1 console 4 resources 1 resource The Power of Optimization Reduced effort, increased security posture

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 13 ​ The Data Exchange Layer ​ The new information-sharing ecosystem

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential The Data Exchange Layer 14 The new information-sharing ecosystem Asset Threat Identity Activity BPM Risk Data Location An innovative, real-time, bi-directional communications fabric providing product integration simplicity. Security components operate as one to immediately share relevant data among endpoint, gateway, and other security products, enabling security intelligence and adaptive security. THE SECURITY CONNECTED FRAMEWORK ADAPTIVE SECURITY ARCHITECTURE The data exchange layer is analogous to the nervous system, dedicated to time-sensitive communication and operating alongside the arteries.

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential McAfee Data Exchange Layer 15 The new information-sharing ecosystem Common Content Real-Time Messaging Adaptive Workflows Data: Provides enterprise security state and context. Includes information about devices, users, location, reputation, and more. Clients: Security products that use the data exchange layer to publish or consume information. Fabric: Real-time messaging infrastructure for security products.

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 16 McAfee Threat Intelligence Exchange

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 55B IP Reputation queries/mo.55B queries/mo.8B Web Reputation queries/mo.260M Msg Reputation queries/mo. Msg Reputation queries/mo.2B Malware Reputation queries/mo. Geo Location Feeds 55B IP Reputation queries/mo. Utilizing Intel Security’s global footprint to your organizational advantage Global Threat Intelligence

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential Apply the power of knowledge Collective Threat Intelligence 18 Local Threat Intelligence McAfee Web Gateway McAfee Gateway McAfee Network Security Platform McAfee Advanced Threat Defense McAfee Next Generation Firewall McAfee Endpoint Agent Organizational Intelligence Administrator Organizational Knowledge Global Threat Intelligence McAfee Global Threat Intelligence Third-Party Feeds Threat Intelligence Assemble, override, augment, and tune the intelligence source information. Other Data Sources Future ? McAfee Threat Intelligence Exchange Server

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential Execute Prevent and Remediate Prevent and Quarantine Submit to Application Sandboxing Actionable Security Decisions 19 Tunable Policy Variable Degrees of Risk Tolerance Local Context Personalized Threat Intelligence Classification Decision

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential It’s not always black and white. There are some shades of grey. The Role of Threat Intelligence Exchange 20 File Is New Packed Suspiciously Low Prevalence Loads as Service Revoked Certificate Runs From Recycle Bin Metadata Sources System properties: Example: run from recycle bin. Reputations: Example: McAfee Global Threat Intelligence, McAfee Advanced Threat Defense, administrator overrides. Enterprise-wide properties: Example: New in environment? Prevalent? On execution, McAfee Threat Intelligence Exchange rules apply this metadata to a set of conditions that indicate risky behavior.

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential McAfee TIE Endpoint Module VirusScan ® Enterprise Threat Intelligence Module McAfee ePO McAfee ATD Threat Intelligence Exchange Adapt and Immunize — From Encounter to Containment in Milliseconds McAfee Global Threat Intelligence 3 rd Party Feeds Data Exchange Layer McAfee TIE Server File age hidden Signed with a revoked certificate Created by an untrusted process

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential McAfee ESM McAfee TIE Endpoint Module VirusScan ® Enterprise Threat Intelligence Module McAfee ePO McAfee ATD McAfee Web Gateway McAfee Gateway McAfee NGFW McAfee NSP Instant Protection Across the Enterprise Data Exchange Layer McAfee Global Threat Intelligence 3 rd Party Feeds Gateways block access based on endpoint convictions Security components operate as one to immediately share relevant data between endpoint, gateway, and other security products Proactively and efficiently protect your organization as soon as a threat is revealed McAfee TIE Server

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 23 Use Cases McAfee Threat Intelligence Exchange in action

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 24 TIE Use case 1: Finding Patient 0

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential TIE Use case: Third Party Reputation lookup (VirusTotal)

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential Use Case: Analyzing the Unknown 26

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential McAfee Advanced Threat Defense: Dynamic and Static Analysis Analyze Static AnalysisDynamic Analysis Analyze Unpacking Disassembly of Code Calculate Latent Code Familial Resemblance Run Time DLLs Network Operations File Operations Process Operations Delayed execution 27

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential Use Case SIEM 28 Top Malicious file Offenders by IP and User View: Display of top IP and User offenders for malicious file executions. View: Trends by day for User and IP. Customer Value: Quickly see the top IP’s and users executing malicious files so action can be taken. Able to see trends by day/month/etc. Answers the question: Am I seeing more or less malicious files over time? Speed is to be enhanced with Agent Handler events sent directly to SIEM in Q4 TIE SIEM DXL ePO TIE Client Events Additional Enrichment Data (ex. GUID to IP)

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential Use Case SIEM 29 New file on the Network Alarm: When a file TIE has never seen is identified on the network. Customer Value: Once file reputation baseline is established this will pro-actively notify security admins when new executable files enter their network so they can do analysis and define action to be taken. TIE SIEM DXL ePO TIE Client Events Additional Enrichment Data (ex. GUID to IP)

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential Threat Intelligence Sharing Bridge the Gap between the Network and Endpoint Ability to share threat data between technologies Forward Thinking - Ability to pre-emptively import threat data collected by the security community STiXX & TAXII Empower the administrator to make security decisions on risk level of files running in their environment 30 The Power Of Open

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential CONTEXT & ORCHESTRATION Data Exchange Layer A common messaging bus for automated security intelligence and action Web Gateway Identity Management Mail Gateway Vulnerability Management HIPSHIPS App & Change Control Mobile Security IPSIPS Data Protection VirtualizationVirtualization Network Firewall Database Security EncryptionEncryption Anti-MalwareAnti-Malware Access Control Web Gateway Identity Management Mail Gateway Vulnerability Management HIPSHIPS Threat Analysis Database Security Network Firewall App & Change Control Mobile Security IPSIPS Anti-MalwareAnti-Malware Access Control VirtualizationVirtualization Data Protection SECURITY MANAGEMENT SECURITY MANAGEMENT Data Exchange Layer

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line McAfee Confidential. 32 Personalized Threat Intelligence Assemble, override, augment and tune the intelligence source information Optimizing Security for Your Organization McAfee Threat Intelligence Exchange Adaptive Security Against Targeted Attacks LOCAL THREAT INTELLIGENCE ORGANIZATIONAL INTELLIGENCE GLOBAL THREAT INTELLIGENCE McAfee Web Gateway McAfee Threat Intelligence Exchange Other Data Sources Future ? McAfee Global Threat Intelligence 3rd Party Feeds McAfee NGFW Administrator Organizational Knowledge McAfee NSP McAfee Endpoint Client McAfee Gateway

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line McAfee Confidential. 33 McAfee Threat Intelligence Exchange Additional information:

Title Line Subtitle Line Top of Content Box Line Top of Footer Line Left Margin LineRight Margin Line Top of Footer Line Top of Content Box Line Subtitle Line Title Line Right Margin LineLeft Margin Line. McAfee Confidential 34 Worlds largest Transportation provider Decreased network utilization 10% Saved 15% in annual audit/compliance cost Improved Efficiency NYC to Save $18M over five years Reduced Costs US 2nd Largest healthcare insurer and provider Saved $1.5M in annual PCI remediation cost – without implementing anything more! Streamline Compliance 2nd Largest Bank & Brokerage in US Saved $22M; addressed glaring public issue Saved over $1M in annual helpdesk calls Limited Liability Hardware-Enhanced Security COUNTERMEASURES THREAT INTELLIGENCE SECURITY MANAGEMENT ANALYTICS ANALYTICS CONTEXT & ORCHESTRATION Measuring Reduced TCO Gains on both CAPEX avoidance as well as OPEX reduction and efficiencies

Intel & McAfee Confidential