Foundstone Enterprise 4.0 Detailed Product Presentation

1. Foundstone Enterprise 4.0Detailed Product Presentation

2. Agenda • Foundstone Solutions • Truly Enterprise-Class • Asset-based Vulnerability Management • Unmatched Assessment Horsepower • Life-cycle Threat Management • Stream-lined Remediation • Measurement & Benchmarking • Interoperability: Foundstone Link • Total Cost of Ownership • Competitive Comparison

3. Foundstone Product Family • Foundstone Enterprise v4.0 • Enterprise-class, award-winning vulnerability management system • Options include: • Remediation Module • Threat Correlation Module • Appliance-based • Feature-rich and the most scalable risk management system available • Low cost of ownership: automated download and installation • All updates Foundstone tested & approved • Foundstone On-Demand Service • Hosted system engineered to manage and mitigate risk • Integrated threat intelligence alerts and correlation • Zero-deployment; no administration or maintenance • Foundstone Professional TL • Designed for consultants and auditors • Enterprise-class functionality and scalability

4. Risk = A x V x T C C Risk = A x V x T C C The Foundstone Vulnerability Management (VM) Lifecycle

5. Enterprise-Class • Web-based, centralized management • Hierarchical user account system supports even the most complex organizations • Flexible role-based access control for scanning & remediation • Unprecedented performance & reliability: unique scanning architecture

6. Enterprise-Class

7. Enterprise-Class

8. Enterprise-Class

9. Asset-Based Vulnerability Management • Driven by agent-less asset discovery • Classify using detailed, flexible criteria • Scan by business function, geographic region, etc. • Tickets can be automatically assigned to group asset owners • Asset criticality can be used to focus remediation tasks on the most important systems

10. Asset Classification

11. Asset-Based Scanning

12. Asset-Based Remediation

13. Assessment Horsepower • Deep, agent-less assessment across all layers of infrastructure • Discovers and analyzes every system on the network, from database to router • Uses patent-pending OS identification and vulnerability analysis techniques • Based on the customizable Foundstone Scripting Language (FSL) • Unprecedented ease of use: • One-click quick scans • One-click scan performance / bandwidth optimization

14. Assessment Horsepower Beyond Traditional Vulnerabilities: Specialty Assessment Modules • Windows Module • Patch & policy testing • Trojan & spyware detection • Wireless Module • Discovery of access points & clients • Mapping & vulnerability analysis • Web Application Module • “Unknown” vulnerabilities within custom web apps. • Crawls, inventories & then intelligently analyzes • Examples: source code disclosure, SQL error handling, weak usernames and passwords, “hidden” sensitive files and archives

15. Life-Cycle Threat Management • Intelligence alerts on critical breaking threat events such as worms and exploits • Faster than a check– shows threat impact immediately without running another scan • Risk-ranking of assets prioritizes threat response so that the most important hosts are protected first • Threat response benchmarking by business unit • Measures response efforts vs. an established remediation goal

16. Threat Monitoring

17. Threat Analysis

18. Threat Scanning

19. Threat Benchmarking

20. Threat Compliance Tracking

21. Stream-Lined Remediation Workflow • VM Pioneers: Introduced integrated remediation workflow in early 2002 • Vulnerabilities automatically turn into easily managed tickets • Rules-based automatic ticket assignment using multiple, flexible criteria • “Ignore” vulnerability feature allows for creation of policy exceptions • Closes tickets for fixed vulnerabilities with no manual intervention

22. Automatic Ticket Creation

23. Automatic Ticket Assignment

24. Automatic Ticket Closure

25. Measure and Benchmark • FoundScore: intuitive 0-100 security scoring system based on vulnerabilities and asset criticality • MyFoundScore: customizable scoring that matches your policy • Risk Score: immediately visible statement of overall enterprise risk level • Considers impact of breaking threat events on assets and existing vulnerabilities • Interactive, executive dashboard for comparing business units/regions, platforms and tracking key statistics

26. Interoperability: Foundstone Link • Open architecture leverages current technology investments • Seamlessly integrates with existing database, network & system management solutions • Open database design works with 3rd party reporting tools & custom SQL queries • Web services-based • API set to allow external applications to leverage the power of FoundScan engines • Scan creation, scan management, scan results access • Authentication API for use with Netegrity Siteminder, RSA SecurID, LDAP and other technologies • Support for standards such as CVE, IAVA, & SANS/FBI Top 20

27. Total Cost of Ownership • Focus on interoperability and management results in overall low TCO • Vulnerabilities, threats and system can be automatically updated • No appliance patches to test or install • Does not require additional staff or skill sets • Comparison of TCO against competing vulnerability management services results in significant savings over a 5-year period Numbers based on projected pricing for a 10,000 system environment, HW/SW/Services included

28. - Full capability - Some capability (blank) – No capability Competitive Comparison