Knowing What You Don’t Know – Tideway Foundation within Credit Suisse

1. Knowing What You Don’t Know –Tideway Foundation within Credit Suisse Andreas Werder Director, Technology & Infrastructure Services Credit Suisse

2. About Credit Suisse Credit Suisse Group is a world-leading financial services company, advising clients in all aspects of finance, around the world, around the clock Headquartered in Zurich, Switzerland Three divisions Private Banking Investment Banking Asset Management Key financial figures (Y/E 2007) Net revenues 31.8 bn USD Net income 7.1 bn USD Total assets 1,236 bn USD Return on Equity 18.0 % BIS Tier 1 ratio 11.1 % Number of employees 48,100 Credit Suisse Information Technology Global (One Bank) IT organization since 2006 CIO Karl Landert Divisional IT (App Dev), 2 shared services sub-divisions plus CTO, COO Major hubs in Zurich, New York, London, Singapore, Pune Technology and Infrastructure Services (TIS) provides shared IT services and runs 10 hub site data centers globally Key figures Number of employees in IT 8,000 Number of servers 23,000 Mainframe MIPS 57,000 Installed storage 6 Petabyte Changes per week 2000 Credit SuisseA Global Financial Services Company

3. Why Tideway Foundation? At Credit Suisse Information Technology… • We have several legacy Configuration Management Databases • We have a convergence roadmap to migrate to oneCMDB • We have multiple desktop and server discovery tools • We have a convergence roadmap to migrate to one agent-based discovery tool Why then did Credit Suisse IT decide to license Tideway? It’s All About the Data!

4. Configuration Data Quality Today Insufficient quality of CM data Incomplete global server inventory Software asset inventory unusable for license reporting No closed loop management of configuration data Various discovery tools, no converged solution Discovery agent-based Agent-based discovery function bound to standard OS builds Discovery with gaps Secure zones and DMZ out of scope of current toolsets Goals for Agent-less Discovery Provide accurate server data for entire estate Focus on hubs, include hosts outside datacenters later Reconcile server data with Atrium CMDB Provide accurate software asset inventory for entire estate Include vendor software as well as in-house developed business applications Provide capabilities for finger-printing Support Business Application Mapping Map physical software assets to logical application models Configuration Management – Challenges

5. Presentation IT Portal Reporting Tools Data Consolidation IT Data Warehouse Domain DB1 Domain DB2 Domain DBn Data Mgmt Process specific DBs Configuration Mgmt DB Product Portfolio Project Portfolio Atrium Planning IT PlanView Contract DB Service Catalog Data Feeds Agent-less Discovery Agent-based Discovery Tideway Foundation Marimba Discovery Tivoli Discovery Foundation Credit Suisse IT Reference Model Configuration Management Data Architecture

6. Roadmap Goals for 2009 and 2010 Implement dependency mapping b/w Infrastructure & Applications Management of product lifecycles end-to-end (including end of life) Facilitate server software license reporting Decommissioning of legacy inventory products Support IT Service Level & Cost Management Continue integration between Incident, Problem, Change and Release Management Contribution of Tideway Foundation Unique application mapping function Knowledge base of vendor product (release) fingerprints growing fast Reporting of usage rather than installed binaries Discovery of hosts not based on standard build; closing of gaps now Again, usage reporting Helps to establish closed loop change & configuration management through reconciliation Configuration Management Value Proposition

7. Implementing Tideway Foundation at CS Project Milestones Achieved Global Tideway Foundation deployment project started 01/08 System specification and IT risk assessment completed in 04/08 Tideway base infrastructure built in London 05/08, New York 06/08 First scans performed in pilot mode during 06/08 and 07/08 Start of production rollout in London and New York in 08/08 Project Milestones Ahead Start of scans in Asia/Pacific in 10/08 80% success rate for host discovery within Investment Bank by 12/08 Start of scans in Switzerland in Q109 Reconciliation of Tideway data with Atrium CMDB in Q209 September August October Rollout Schedule New York 08/04/2008 08/18/2008 09/01/2008 09/29/2008 10/10/2008 ID Creation & Credential Deployment (4 weeks) Level 2/3 Scans(2 weeks) Training and Initialization of Application Mapping(on-going) Definition of Scope & Config of Scans (2 week) Level 1 Scans & QA(2 weeks) IB NY Server DiscoveryComplete RfC to be raised

8. AM (tbd) IBD PB (tbd) Enterprise (Email Servers, SharePoint etc) FID Domain 1 Equity Domain 2 Domain 3 Domain 4 Non-Hub Sites 7 4 5 6b 6d 6a 6c Rest of World London / NY Equities 3 8 6 Production Pre-Production / DR 2 8 FA & O TIS PKS 1 1a 1b Communication Rollout StrategyInvestment Banking Streams London and New York Fundamental Rules • Align rollout plans and priorities with business areas • Less critical areas (subnets) first, most critical last • Know your baseline for discovery • Use weekend for initial scans Priorities • Start with Development • D/R before Production • Back office before front office

9. Tideway Foundation Use Cases SupportedFrom Stand-alone to Integrated Technology Area Global Server Inventory Global Software Asset Inventory Support Business Application Mapping Capabilities with integration (Q209) Integrated, periodic reconciliation with Atrium CMDB Reporting on global server estate based out of Atrium Global reports on specific server configurations Compliance checks across divisions and regions Global software assets/license counts Synchronization of application mapping with Product Portfolio (PlanningIT) Decomposition of global (cross-divisional/cross-regional) IT services • Capabilities until Q109 • Manual reconciliation of specific subnets/areas (e.g. reconciliation of CSAM CMDB) • Report specific host properties for regional IB subsets • Report sets of hosts having specific properties (e.g. single corded boxes) • Report specific configurations (e.g. patch level for Solaris hosts) • Count installed software assets • Scope is IB and Asset Mgmt only • Piloting of application mapping (e.g. PrimeServices) • Decomposition of specific regional/divisional IT services

10. Implementing Tideway Foundation at CSLessons Learned Engage early with your stakeholders Involve them in hands-on training and pilots Provide full transparency of your implementation of Tideway The roll-out process is the critical part of a Tideway project Define the roll-out strategy early You must understand the relationship between business applications and your network to minimize the risks during the roll-out Start with a solid baseline of your IT estate Tideway agent-less discovery is a very structured process It‘s an iterative process Tideway will help you improve your intelligence on your installed assets gradually

11. Why Tideway? Superior product and technology! • Provides excellent and rich data • Data quality is mission critical • Robust technology • High availability, scalability good and continues to improve • Very transparent documentation of scanning approaches • Helpful when it comes to risk assessments, security reviews and stakeholder communication • Innovative and approachable vendor • Frequent TWF release updates with new functionality • Responsive to our needs Other areas of application currently being investigated • Security compliance and risk monitoring of server configurations

12. Questions? Thank you for your time.