Our mission is to protect data from insider

Our mission is to protect data from insider threats and cyberattacks. The Varonis Answer GDPR and Cyber Attacks Matt Radolec - Security Architect Manager VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

Agenda Introduction GDPR Overview Trends in Cyber Attacks Varonis Overview Varonis Operational Plan VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

GDPR – The Basics Compliance must be achieved by May 25 Th 2018 Companies will appoint a DPO (Data Privacy Officer), point of contact for local authorities (or one stop shop) (Article 37 & 38 & 39) Violations shall be served within 72 hours The authorities have been provided with additional means (audit rights investigation to data controllers and their subcontractors, all overseen by the creation of a European Committee for data protection. Sanctions incident could reach 4% of global annual turnover the previous year or € 20 million. Please note, data processors are not the only ones responsible. . . contractors will be liable for violations as well. 3 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

GDPR has 2 Core Principles “Privacy by Design” Minimize collection of personal data. Delete personal data that’s no longer necessary. Restrict access. Secure data through its entire lifecycle. 4 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL. “Accountability by Design” Implement technical and organizational measures to properly process personal data Report Data Breaches involving Personal Data within 72 hours Conduct Data Protection Impact Assessments Provide clear documentation of implemented process Nominate Data Privacy Officer

High Level GDPR Roadmap ) Action Business Assign Ownership and Accountability for GDPR Compliance ✔ GDPR Readiness Assessment and Privacy Policy Development (DPIA) DPIA = Data Privacy Impact Assessment ✔ Data Discovery and Clean Up (Where does PII data exist? Is it required? Apply auditing? ) Document Data Flow Lifecycle Technology ✔ GDPR Guidance Establish GDPR Governance and Project team (Business and Technology) Interview key stakeholders responsible for EU Consumer, Artist and Employee data Develop strategic plan Awareness and Training ✔ Identify where data is and who has access Establish a secure environment to store and manage PII data ✔ Contact for controller, representative and Data Privacy Officer Purposes of processing Categories of personal data and data subjects Recipients of personal data when shared Retention period(s) for personal data “where possible” 3 rd party management MSA review (Who do we share our most sensitive information) ✔ Contracts must be in writing and must include obligations regarding breach, audits, etc. Data Breach detection and response processes ✔ Controllers must notify supervisory authority of personal data breach - within 72 hours Controllers must document personal data breaches to demonstrate compliance Create Online and Offline Notice and Consent ✔ Establish mechanisms to track notices/consent. Right to Object/Erasures “right to be forgotten” ✔ Individuals can request controller stop processing their personal data when: Used for direct marketing, including profiling Processed based on controller’s “legitimate interests” or public interests/exercise of official authority Processed for research and statistics (Who has access, where it came from and who we share it with? ) 5 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

Varonis and GDPR Discover GDPR eligible data Over 220 GDPR specific patterns GDPR data by country (all 28 EU countries) GDPR data by type National Identification Numbers, Drivers License, Credit Cards, IP Addresses, Blood Type, etc. GDPR data that is overexposed with open access Breach response within 72 hours Audit user activity against GDPR data Detect suspicious behavior Comply with existing retention policy to reduce footprint Right to be forgotten Search and discover GDPR eligible data tied to an individual Data subject access request 6 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

Ransomware is on the rise 7 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL. Source: Verizon 2017 Data Breach Investigations Report

More breaches are coming from the inside 8 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL. Source: Verizon 2017 Data Breach Investigations Report

Insider Threats are still taking too long to detect 9 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL. Source: Verizon 2017 Data Breach Investigations Report

Too much data is unnecessarily accessible Highlights from the 2017 Varonis Data Risk Report 47% 20% of folders open to global access groups had at least 1, 000 sensitive files open to every employee 12, 000 or more sensitive files open to every employee in 22% of organizations. www. varonis. com/data-risk-report-2017 10 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL. 24. 4 M folders with unique permissions 71% of folders contain stale data

Varonis Systems Started operations in 2005 VRNS on Nasdaq 6, 000 customers globally (Dec 2017) Software that protects data from insider threats and cyberattacks “ Varonis works across the whole organization. It works with our infrastructure, our Active Directory, it works with all the hardware and software we have. ” -- Wade Sendall, VP of IT, The Boston Globe 11 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

WINDOWS NAS UNIX/LINUX MS ACTIVE DIRECTORY LDAP SHAREPOINT NIS Data Stores 12 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL. EXCHANGE LOCAL ACCOUNTS OFFICE 365

Access Activity Content Discovery User & Groups Permissions & FS metadata Continuous Metadata Monitoring & Analysis 13 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

14 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

Starts with Free Varonis Risk Assessment Staleness Threshold 90 Days 22 million Folders 183 million Files 176 TB of Data 97% 607, 400 files contain sensitive data 4. 5 million folders open to Global Access 20% of all folders 3% of all files 157 TB of Stale Data 89% 97% 589 K stale sensitive files 167, 144 sensitive files (28%) open to Global Access 1. 4 million hit count 1 – Data on servers and in folders in scope for the risk assessment 15 21. 6 million folders contain stale data VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL. 87% Staleness Threshold 1 Year 19. 2 million folders contain stale data 83% 506 K stale sensitive files 126 TB of Stale Data 71%

Our mission is to protect data from insider threats and cyberattacks. Questions? 16 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.

Our mission is to protect data from insider threats and cyberattacks. Thank you! 17 VARONIS SYSTEMS. PROPRIETARY & CONFIDENTIAL.