1. Information Security “The threats from within are increasing on a daily basis. 78% of all information security breaches happen internally”

2. Welcome to – Greater Mumbai Bank Private and Confidential - INNEFU LABS

3. Presentation format • Current Architecture • Secure Architecture - INNEFU’s AuthShield Private and Confidential - INNEFU LABS

4. Private and Confidential - INNEFU LABS

5. Current Assets • E-mail servers • Database servers • Core Banking Application / Application Servers • Intranet Applications • Web Applications Private and Confidential - INNEFU LABS

6. Current Architecture • Disparate Architecture • Servers on Public IP’s • No single Sign on • No DMZ • No Multifactor Authentication Private and Confidential - INNEFU LABS

7. Information security - current • Anti – Virus • Firewall • Unified Threat Management • People and Processes – • Security Policy • Processes to connect to the Internet • No authorization for Pen drives, CD’s, Laptops etc Private and Confidential - INNEFU LABS

8. Information Security • Single Sign on, authentication and Authorization – Open LDAP / AD integrated with RADIUS • Virtual Private Network for critical Third party Applications • Multifactor Authentication for – • Net Banking • Core Banking Applications • Third Party Applications • Technical Audit – Vulnerability Assessment and Penetration testing Private and Confidential - INNEFU LABS

9. Single Sign on Private and Confidential - INNEFU LABS

10. Advantages • User only has to remember a single password instead of multiple complex passwords • Reduces time spent re-entering passwords for the same identity • Increases security - Users select stronger passwords, since the need for multiple passwords and change synchronization is avoided • Security on all levels of entry/exit/access to systems without the inconvenience of re-prompting users Private and Confidential - INNEFU LABS

11. Radius Server Private and Confidential - INNEFU LABS

12. Advantages • Client Server Architecture • Once the user is authenticated, the client provides the user with access to appropriate network services • The Authentication Request is sent over the network from the RADIUS client to the RADIUS server • If the user name and password are correct, the server sends an Authentication Acknowledgment that includes information on the user's network system and service requirements. Private and Confidential - INNEFU LABS

13. VPN for Third Party Applications Private and Confidential - INNEFU LABS

14. Contd. Private and Confidential - INNEFU LABS

15. Advantages • Extended connections across multiple geographic locations without using a leased line • Improved security for exchanging data • Flexibility for remote offices and employees to use the business intranet over an existing Internet connection as if they're directly connected to the network • Savings in time and expense for employees to commute if they work from home • Improved productivity for remote employees Private and Confidential - INNEFU LABS

16. Multifactor Authentication Point of Attack Private and Confidential - INNEFU LABS

17. Identity Theft • Fastest growing white collar crime • 11 Million Americans affected in 2010-2011 • 900,000 new victims each year • Cost to businesses more than $50 billion • Cost per incident to company $6,383 • Hours spent per victim resolving the problem as shown by identity theft statistics: 30 • Irreparable loss to Company’s Brand/Image • Loss of Clientele Private and Confidential - INNEFU LABS

18. Private and Confidential - INNEFU LABS

19. Point of attack • Customers • Vendors • Development Team • Power Users/Key Users/Super Users • Agents • End Users • Employees… Private and Confidential - INNEFU LABS

20. Methods Of Attack • Phishing • Virus, Trojans, worms inside the company’s architecture or personal computer of users • LAN Attacks – Remote Sniffing • Web Vulnerabilities including SQL Injection, XSS attacks and Cookie capturing Private and Confidential - INNEFU LABS

21. Assets • Web Application • Application Servers • VPN/SSL • Intranet Applications • Database Servers • Local LAN / WiFi Private and Confidential - INNEFU LABS

22. MFID – Multifactor Authentication • Map the physical identity of the user to the server • Identify the user based on – • Something he knows (user name / password) • Something in the users possessions Private and Confidential - INNEFU LABS

23. Innefu’sAuthShield • Multi factor authentication system which uses either of the three authentication mechanisms • Soft Token • Hard token • Mobile Token • E-Token Private and Confidential - INNEFU LABS

24. Hard Token – Identifying the user on the basis of his Key Private and Confidential - INNEFU LABS

25. Protect VPN and Custom Made applications • Security device given to authorized users • The device displays a changing number that is typed in as a password • The password is based on a pre defined unbreakable randomized algorithm • Every time the user accesses a critical IT asset, the randomly generated number is matched with the server to verify users credentials Private and Confidential - INNEFU LABS

26. Soft Token – Identifying the user on the basis of his phone number Private and Confidential - INNEFU LABS

27. Mobile Token – Generating Token via Mobile Phones Innefu BlackBerry AuthShield for Web Clients– 4). Token Generated 5). Credentials Entered 2).Request Sent to BES Web Client – UN+PWD+TOKEN BES Private and Confidential - INNEFU LABS 1). User accesses the token generation application on his BB device 3). Request Forwarded to IAS IAS & AD 3). IAS 6). Access

28. Protect Internet Banking • The OTP is sent either via SMS or the OTP is generated by the smart phone itself • The user use the OTP to log into any web application or intranet application • Works on all smart phones with GPRS enabled • The system does not depend on the memory or the processor usage of the phones Private and Confidential - INNEFU LABS

29. Features • OS Independent Authentication Mechanism • Seamless Integration with the current business and security architecture • Works as a stand alone authentication mechanism or in connection with- • Microsoft AD • Firewall • VPN • Wi-Fi • Terminal services etc Private and Confidential - INNEFU LABS

30. Contd. • Increases the log on security for critical applications • Unbreakable encryption on the lines of those used by US Government • Prevent identity theft by up to 99% Private and Confidential - INNEFU LABS

31. Contd. • All logs are stored in a secured database (completely encrypted) for future analysis • Date and Time • User • Time Gap • Access to logs only available to Admin team • Privileges assigned to every users • IP Address of the user Private and Confidential - INNEFU LABS

32. Technical Audit • Vulnerability Assessment and Penetration testing • Internal Audit – Test all the IT assets of the organization with login privileges • External Audit – Test all the IT assets of the organization without login privileges • Identify all vulnerabilities • Penetration tests to remove false positives Private and Confidential - INNEFU LABS

33. THANK YOU Private and Confidential - INNEFU LABS QUESTIONS WELCOME AUTH-SHIELD LABS PVT. LTD http://auth-shield.com/ +91-11-47065864 / 66 contact@auth-shield.com