ObserveIT - Record and Replay RDP, Console, Terminal and Citrix Sessions.

1. ObserveIT – Record & Replay Terminal, Citrix and Console Sessions January 2010

2. The Company in a Nutshell Founded in 2006 Focused exclusively on People-Auditing software products First GA product release – 2007 Current product version - v5.0 Global Presence Partners in 5 Continents Official Distributor in Malaysia Comwise Internetwork SdnBhd 78A, JalanRenang 13/26 Section 13, 40100 Shah Alam, Selangor. Contact : Mr TS Teh – 019-263 7311 tsteh@comwise.com.my Kent Ng - 019-325 3248 kentng@comwise.com.my

3. Our Product in a Nutshell Record and Replay of user sessions Like a ‘security camera’ on your servers Software-based solution Playback any Remote Desktop, Citrix, VMWare or any other remote access session Fast search and navigation to find user actions, without lengthy playback

4. Hundreds of Enterprise Customers Financial IT Services Education/Gov’t/Healthcare Manufacturing Telecommunications

6. Audit people, not just apps

7. Total application coverage that grows with your growth

8. Bulletproof evidence

10. Improve security, accountability and policy messaging

11. Transparent SLA and billing validation

13. Immediate root cause determination

14. Alerts from within Network Monitor Tools

15. Defeat the ‘Oops’ factor Who accessed the salaries spreadsheet in the past 24 hours? And what did they do? Without ObserveIT With ObserveIT Check the file system logs Check the HR app audit Check the finance dept. audit Check admin support app log Unified reporting of all user activity on the HR spreadsheet I wonder if there are other access points? Instant playback of exact user actions ?? ?? ?? ??

17. Audit people, not just apps

18. Total application coverage that grows with your growth

19. Bulletproof evidence

21. Improve security, accountability and policy messaging

22. Transparent SLA and billing validation

24. Immediate root cause determination

25. Alerts from within Network Monitor Tools

26. Defeat the ‘Oops’ factor Why use ObserveIT ? What did SupportCorp do on our servers yesterday? Are they responsible for the data deletion event? Without ObserveIT With ObserveIT Find the exact user session I have no idea…… Finger pointing accusations Lengthy SLA review Session playback eliminates any doubt Is there anywhere we can find this information? ?? ?? ??

28. Audit people, not just apps

29. Total application coverage that grows with your growth

30. Bulletproof evidence

32. Improve security, accountability and policy messaging

33. Transparent SLA and billing validation

35. Immediate root cause determination

36. Alerts from within Network Monitor Tools

37. Defeat the ‘Oops’ factor Why is our server broken? And how can I fix it? Without ObserveIT With ObserveIT Check the event log Check the database log Immediate identification of cause of outage Check the registry Check the network cable Attention all admins: Who touched this server?!?%!? ?? ??

38. Video Replay of User Sessions Clicking on video icon launches the video replay (see next slide) ObserveIT lists every user session Jump straight to the precise action. Replay only what you’re interested in. Within each session, details of every action taken

39. Video Replay of User Sessions See an exact video playback of the entire user session (including mouse movements, selection of UI elements and text entry) Navigate quickly within the recording (including jumping between each activity, as the user launches a new app or opens a new window)

41. Date of Session

43. Date of Session

45. Date of Session

47. Window Titles

48. UI Elements

49. User generated contentSearch results highlight exact location of user action within the user session timeline

50. Policy-Based, Event-Driven Recording Define policies to handle each session

52. What metadata to capture

53. If user identification is required

55. What metadata to capture

56. If user identification is required

58. What metadata to capture

59. If user identification is required

62. Data Filtering

64. Data Filtering

66. Data Filtering

68. Data Filtering

70. User Identification User logs on as generic “Administrator”

71. ObserveIT requires username identification prior to granting access to system Active Directory used for authentication

72. Each session is now tagged with an actual name Login userid: administrator Actual user: daniel

73. Real Time Playback “On Air” icon shows that a session is currently active

74. Video replay of session is launched in Real-Time mode, with continuous updates until the session ends Video replay of session is launched in Real-Time mode, with continuous updates until the session ends

75. Enterprise-Ready ArchitectureComplete Coverage Agnostic to network protocol and client application Captures all Remote Sessions and also Console Sessions Terminal

76. Small Footprint Ultra-efficient data storage Less than 250GB/year for high-usage, 1000 server environment Minimal Agent CPU utilization 0% CPU when no console active 1%-2% CPU, 10 MB RAM during session

77. Integration with System Monitors Instant-replay from within your network management environment Microsoft SCOM, CA-Unicenter, IBM Tivoli, HP OpenView Real-time alerts On file access/deletion, Network share, Registry edit , RDP open connection, URL access etc. ObserveIT alert in CA-Unicenter ObserveIT alert in MS SCOM Trigger automatic email alert delivery Click on alert to see ObserveIT video playback

78. Pervasive User Permissions Granular permissions / access control Define rules for each user Specify which sessions the user may playback Permission-based filtering affects all content access Reports Searching Video playback Metadata browsing Access to ObserveIT Web Console is also audited ObserveIT audits itself Satisfies regulatory compliance requirements

79. System Components Agent Corporate Server HTTP Traffic (by default -TCP 4884) SQL Traffic (by default -TCP 1433) Agent Switch Application Server Web Console using IIS on Windows Server 2003/2008 Database Server using MS SQL Server 2000/2005 on Windows Server 2003/2008 Corporate Server How it Works Each monitored desktop or server runs the ObserveIT Agent The Agent encrypts information about user activity and sends it to the Application Server Application Server analyzes data and stores it in the Database Server Web Management Console is a web-based interface for searching and reporting on captured user activity HTTP Agent ObserveIT Admin using a Web Browser Corporate Desktop

80. Deployment Architecture:Remote Access Gateway (Agent-less Servers) Published Applications Putty.exe RDP Traffic VPNTraffic Corporate Servers (No Agent installed) VPN ICATraffic Corporate Servers (No Agent installed) Terminal or Citrix Server with ObserveIT Agent Win2008 TS Gateway RDP over SSL Traffic Telnet/SSHTraffic Corporate Servers (No Agent installed) App Server Web Console DB Server

82. Supporting 60,000 ATM machines

83. Clearing 90,000,000 transactions per day

84. Control access to system resources, including shared privileges between two merged corporate entities during period of merger

85. Achieve common system management and visibility

86. 2008- ObserveIT deployed to monitor and audit serve activity during merger activity

88. Customer support process requires remote session access to deployed systems

89. Strict HIPAA compliance regulations must be enforced and demonstrable

90. In addition, SLA commitments require visibility of service times and durations

91. ObserveIT deployed in a Gateway architecture

92. All access routed via agent-monitored Citrix gateway

93. Actual systems being accessed remain agent-less

94. Toshiba achieved 24x7 SLA reports, including granular incident summaries