1. Centralized Logging and Reporting for Enterprises

2. eMail Office Apps IM Collaboration Apps VoIP Enterprise Apps Web Apps POS Increasing number of employees Partners & Suppliers Customers Organization’s Network Users Applications Devices Increasing mobile workforce Evolving Enterprise Networks More Windows of Vulnerabilities More Data being Generated Increasing Network Complexity

3. Malicious insiders Unintended actions by insiders Increasing external attacks New vulnerabilities Changing Threat Landscape

4. Challenge faced by IT managers

5. HQ SC, USA Singapore Branch Toronto Branch Melbourne Branch John, IT manager ABC Corporation Case-In-Point: ABC Corporation

6. 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 IMPOSSIBLE TASK! Going through Logs on Separate devices to identify possible threats Mammoth of logs; Difficult to Identify Threats Network and Security Devices deployed at various sites…. Generates lots and lots of logs… HQ SC, USA Singapore Branch Toronto Branch Melbourne Branch John, IT manager ABC Corporation

7. 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 Threats may go un-noticed!! Mac:Hey John, Mac this side. I am not able to access the internet today. John:Hey Mac. Let me see what is happening. Once in a while someone calls up with a problem; John logs into that specific device, sees the logs and resolves it John:Gotcha Mac. Your problem has been resolved. HQ SC, USA Singapore Branch Toronto Branch Melbourne Branch BUT, John might not have received any calls for a mishap that is later identified after several months John, IT manager ABC Corporation Mac, Employee

8. 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 10100101021012012 02103.10.03230.100 01021210010002102 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02102010002100120 01021210010002102 00102010102101120 02103.10.03230.100 00102010102101120 02102010002100120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 02102010002100120 00102010102101120 10100101021012012 01010001000210201 02103.10.03230.100 01021210010002102 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 00102010102101120 01010001000210201 02102010002100120 10100101021012012 01021210010002102 02103.10.03230.100 02102010002100120 00102010102101120 01010001000210201 10100101021012012 02103.10.03230.100 01021210010002102 Management asks John to submit a forensic root cause report for the unfortunate attack happened a week before Threats may go un-noticed!! HQ SC, USA Singapore Branch Toronto Branch Melbourne Branch This is a humongous task!! and I might run into mistakes!!

9. Challenge: Multiple security devices, Many logs, Shortage of resources Identifying trends /patterns to form story and not just see logs for better decision making Viewing reports & logs of all devices at one place Quickly responding to incidents by identifying security attacks and incidents Troubleshoot problems easily and Forensic investigation Identifying unusual activity within the network Generating compliance reports in minutes rather than taking hours

10. Introducing Cyberoam iView Next Generation Intelligent Logging and Reporting Appliances

11. Get centralized visibility into distributed networks Servers Firewalls IDP / IPS Switches Routers UTM / NGFW Applications Desktop systems Logs & Events Compliance Management Forensic Analysis Log Management Security Management Identity LoggingReporting

12. Centralized Logging & Reporting of user and network activities of multiple devices across locations Centralized Visibility Search and Filter through Logs and Bookmark search results for re-use Log Management Comprehensive Reporting; 1300+ predefined Reports, Customized Reports, Report Scheduling Security Management Inbuilt Compliance Reports - PCI DSS, SOX, GLBA, FISMA, HIPAA Compliance Management Allow Administrative or Viewer rights for individual or group of devices Security Administration Graphical summary and Details of all Network activities with customized Dashboards and Views Forensic Analysis What does CYBEROAM iView offer?

13. How iView helps John… John deploys Cyberoam’s iView appliance at HQ John, IT manager ABC Corporation HQ SC, USA Singapore Branch Toronto Branch Melbourne Branch iView Next Generation Intelligent Logging and Reporting Appliance Cyberoam Central Console Internet

14. Detecting Unusual Traffic Patterns While browsing through the iView reports, John notices unusual behavior in Web Usage Why so many hits for Jenny? -Which Websites? -Which Devices/hosts A new toolbar add- on is the cause Further Drill down will show other Users with the same add-on

15. Incident Management Hey John! Our CRM is responding very slow. Please do something. Sure. Let me check. Network connectivity Alex An employee John ISP Link Now John gets concerned and thinks of other possibilities ? Top Victim report in iView shows 48000 hits on 10.20.20.122 (CRM) Knowing attack method and source of attack

16. Forensic Analysis – Identifying TROJAN infected hosts Sure. Let me check. Hey John! I am not able to open some files on my PC Alex An employee John John finds the Trojan’s C&C URL on google (scanning Alex’s PC) TROJAN FOUND! SEARCH Web Surfing Reports with the C&C URL gives other Users infected by the same Trojan Other Infected Users

17. iView also helps with…

18. Region-wise Grouping of Security AppliancesView Region specific Dashboard Region-wise Appliance Groups and Dashboards

19. Create Custom Views Traffic Dashboard Security Dashboard Executive Dashboard

20. 1200+ predefined reports

21. Top Web UsersUsers accessing P2P Easy to know with Cyberoam iView…

22. Top Websites Easy to know with Cyberoam iView…

23. Top Risky Applications Easy to know with Cyberoam iView…

24. Visibility into Attacks, attackers and the victims Quick Attack Identification

25. Top viruses detected and blocked Quick Attack Identification

26. Save days of effort with the help of inbuilt compliance reports Preset Compliance Reports to help with Regulatory needs…

27. More Features to meet Enterprise needs Bookmark reports for later reference Schedule Reports & Get them emailed Role based User Access – Can be limited to a few devices/ device groups

28. Powerful Hardware with Reliable Storage Appliance Features  RAID 5 Technology  Ultra fast Processing with Quad core chips  Hardened OS for security against future attacks and system downtime  Dual and Redundant Power Supply for Higher Availability and Reliability Appliance Benefits  Simplicity in deployment -Turnkey Logging & Reporting Solution -Eliminates need for Technical expertise to set up  Terabytes of storage space – Available upto 16TB -Compliance needs -Long-term reporting/archiving needs in Enterprises  Data Redundancy -Faster data retrieval, event investigation -Storage reliability  Safety of logs, reports in case of disk failure  Reliable support through telephone, chat and email -8x5 and 24x7 support -Annual Maintenance Contracts

29. Features of Cyberoam iView Log Management  Near real-time log retrieval  Archival and Search facility Forensic Analysis  Reconstructing sequence of events in a security breach  Reporting stands in the face of legal scrutiny Compliance Management  Reduces compliance costs  Single click access to reports - Simplified compliance management  Easy visibility into access by users Security Management  iView dashboard – Shows network attacks on single screen  Drill-down reports – 3rd level drill-down for attack details  Identity-based logging and reporting – Pinpoints the user  1300+ Reports

30. Security Benefits  Centralized control  Identifies attacks based on – -Attack Reports (Type of Reports) -Deviation from norm in access or usage of resources  Allows quick investigation and determination of cause of breach Compliance Benefits  Access and Usage logs of -Activity in critical applications, databases -Data transmitted to external entities  Enables setting user identity-based thresholds for acceptable use Productivity Benefits  Shows deviation in resource consumption Financial Benefits  Low capital requirements  Low technical manpower requirements Benefits of Cyberoam iView

31. Thank You Thank you!