2016 01-05 csr css non-confidential slide deck

38
1 With dba Cyber Support Solutions Identity and Access Management (I&AM) A Presentation of our Capabilities to: Stop Data Breaches Allow Personal Liberties Reduce Costs Be in Compliance. A Non-Confidential Presentation January 5, 2016 * Confidential information has been removed or redacted.

Transcript of 2016 01-05 csr css non-confidential slide deck

Page 1: 2016 01-05 csr  css non-confidential slide deck

With dba Cyber Support Solutions

Identity and Access Management (I&AM)

A Presentation of our Capabilities to: Stop Data Breaches

Allow Personal LibertiesReduce Costs

Be in Compliance.

A Non-Confidential Presentation

January 5, 2016* Confidential information has been removed or redacted.

Page 2: 2016 01-05 csr  css non-confidential slide deck

2

HEADQUARTERS AND FACILITYCurrently we are planning to move to a new facility in a Marietta, GA Opportunity and HUBZone (see below). This location brings with it State and Federal financial and competitive advantages. Here we will be set up to comply with the American Disabilities Act (ADA), and Government FISMA and other related security requirements.

Page 3: 2016 01-05 csr  css non-confidential slide deck

3

VETERANS WITH DISABILITIES MAKE GREAT CYBER SECURITY & SUPPORT PERSONNEL

CSR employs physically Disabled Veterans, to be our Cyber Security Investigators with Security Clearances, because if you accommodate for a Veteran's disability, he or she will stay with you longer, become more expert at their job, earn a better wage, and because of this longer experience provide superior services to our clients. Secondly, Disabled Veteran are more cognizant of the impact of data breaches. Perhaps their disability was caused by the enemy finding out certain information that was to be a better kept secret?

We also offer a Remote Agent option, for home bound and trained Disabled Veteran Cyber Security Investigators. Our Cybersecurity solution provides the same high level of protection against data breaches at home, as if the Veteran was working from a secure government facility or in our offices.

Page 4: 2016 01-05 csr  css non-confidential slide deck

OUR EXPERIENCED MANAGEMENT TEAM ***Mostly U.S. Military Veterans***

Richard (Dick) Kaufman - CEO, Owner & Disabled Veteran with 30+ years experience in Customer Support , Telecom Systems & Services, Information Technology and Entrepreneurism.

Past clients include Fortune 10 companies and major Government entities.

Mr. Kaufman is also an accredited Expert Witness for State and Federal litigations.

Mark Collins - EVP Operations & Veteran – 17 years in Customer Support implementing, developing and managing groups delivering technical support and help desks services.

4

Page 5: 2016 01-05 csr  css non-confidential slide deck

EXPERIENCED MANAGEMENT TEAM (cont.)Bart Falzarano – CIO, has over 20 years of experience in technology, banking and federal regulatory compliance across multiple industries such as financial services, government, engineering consulting and nuclear technology and operations.

And he has strong Governance, Risk Management and Compliance (GRC) background and expertise across various frameworks including ISO27001, ITIL, CFR FDA, OCC, DOJ, NIST SP800, PCI DSS, HIPAA, NRC, INPO, etc.

5

Page 6: 2016 01-05 csr  css non-confidential slide deck

ADVISORSDr. Jon Anton – Veteran – 30+ years experience in Customer Support , plus an adjunct Professor and Director of benchmark research at the Center for Customer-Driven Quality at Purdue University.

Robert Deitz, II – Veteran – 30+ years of experience with a Top Secret Security Clearance. He has worked with government agencies including OSD, NSA, DHS, State Department, DOJ, CENTOM, SOCOM, DCMA, Joint Staff, Commerce, and the DOE.

For government agencies he has assisted in developing and modifying information assurance programs to adapt to new technologies and business processes. For manufacturers he has helped them to comply with government requirements such as NIAP, FIPS, IPv6, Section 508, and others. Mr. Deitz has the experience and knowledge needed to help guide our efforts in Cyber Security and best allow us to offer needed solutions and services to the Federal Government. 6

Page 7: 2016 01-05 csr  css non-confidential slide deck

Management team members have a minimum of 15 years of experience in INFOSEC, IT, Telecom and CRM. Clients or employers include Mellon Bank, Citicorp, N.A., AT&T, Stratix, Bell South, GE Power, Hewlett Packard, NYC Housing Auth. Police & Emergency Services, General Motors, Walz, Endymion, & Blue Cross Blue Shield.

STRATEGIC PARTNERS & MANAGEMENT TEAMPAST PERFORMANCE

12 years of experience with scalable, cost-effective IP video monitoring and playback over a network. Clients include US Air Force, US Army, Lockheed, US Coast Guard, and Boeing.

Has very significant experience developing, testing, and fielding complex solutions in a variety of commercial industries and government organizations using a wide variety of technology tools. Examples include a comprehensive portfolio management system for a prominent global private equity firm, a flexible data interchange application for one of the world’s largest vehicle transporters, a complex human resources system for a European defense ministry under a DISA/US Army contract, and a productivity management system used by Microsoft, Symantec, Computer Associates, and others. 

In regulatory environments, TIG is has delivered programs that meet all mandates and restrictions, while developing optimal solutions. The TIG team has developing database architectures for effective data mining with advanced techniques in data presentation, for flexible and scalable web-based solutions.

7

Has 15 year of data compliance experience with the DOL, FDA, DHHS, FL DOH and AMEX addressing NIST 800 series, FISMA, HIPAA, FISCAM, ISO 17799, Sarbanes-Oxley, Policy development, Certification & Accreditation and others.

Page 8: 2016 01-05 csr  css non-confidential slide deck

We are in Compliance (1 of 2)

To make certain that everything we do is in compliance with all rules and regulations, we have retained the services of Leneer Data Assurance Solutions. Robert Lester and his team are an integral part of our operations and will continue to monitor and report on all activities regarding compliance from system and procedural design to continuous operations.

1. Understanding that a law exists that requires the use of a CAC (Common Access Card) and password be part of any multifactor authentication "(ii) something you have (e.g., cryptographic identification device, token)”, we will accommodate this factor as a component of our solution after we have biometrically authenticated a user.

2. It is also stated in HSPD-12 ".... Multifactor authentication requires the use of two or more different factors to achieve authentication. Since our modification of a notebook computer has the effect of creating a “cryptographic identification device” ("(ii) something you have…) ) we believe that we have solved the problem of getting rid of the expensive and ill performing CAC and password as part of any multifactor authentication procedure. Our next step will be to convince the National Institute of Standards and Technology (NIST) to accept this explanation.

8

Page 9: 2016 01-05 csr  css non-confidential slide deck

9

We are in Compliance (2 of 2)

3. Compliance with NIST SP 800-53 Rev 5 (updated 08/07/2015) – We continue to monitor and address upgrades to NIST regulations.

4. Cybersecurity Strategy Implementation Plan (CSIP) (10/30/2015) – in compliancea. Calls for all agencies to “....improve the identity and access management of user

accounts on Federal information systems to drastically reduce vulnerabilities and successful intrusions.“

b. Can provide best and equal data breach protection for cloud based hosting or on-site server applications.

5. National Archives and Records Administration (NARA):a. No current schedule exists for storage of screens and keystroke activity.b. Will keep all data (minimum of 6 years) or till the agency and NARA agree to a

schedule

6. Storage of classified information to Level 6 (Secret): a. Since we do not know in advance the level of the data we are capturing, we can store

all data as Secret (Level 6)b. We accommodate for Level 6 data on site, or at a contracted for Level 6 certified site.

9

Page 10: 2016 01-05 csr  css non-confidential slide deck

10

WE REDUCE COSTS (Page 1 of 2)

1. Our solutions makes for safe Tele-working, therefore increased mobility and productivity. 2. Since Tele-working lowers capital cost (building, cubicle) and recurring (electricity, water,

utilities, insurance) costs. It also makes for generally happier employees, reducing turnover and hiring costs.

3. Our solutions allows the agency to reduce costs by safely moving applications into the cloud which results in an overall higher level of security with lower infrastructure costs.

4. Currently, when a government contractor is hired to help with applications, many government agencies have to purchase & provide special access terminals for these contractors. With our solution the outside contractor will use his existing notebook computer.

5. Notebook computers get old and applications require more processing power. In our environment a user’s access device (the notebook computer) operates on applications inside of a VDI session on a secure server. The processing speed of the notebook is no longer an issue while the properly equipped servers of today have faster processors and graphic accelerators to make processing speed faster, than that could normally be done on a local PC. Essentially, the higher speed processing power has been moved to the server and the user’s notebook does not need to be improved upon, again saving money by lengthening the life of the existing notebook computer.

Page 11: 2016 01-05 csr  css non-confidential slide deck

11

WE REDUCE COSTS (Page 2 of 2)

6. We can eliminate the need for the expensive use of personal identity verification (PIV or CAC) cards. Our solution is more reliable , reduces the average time for authentication, and allows for more user productivity.

7. Our solutions identify questionable activities by users in real-time and issue alerts or terminate a session immediately. The computer driven alert provides cause that a user may need to be monitored closer. These computer alerts therefore limit the number of persons to be investigated instead of the more costly way of investigating everyone all the time.

8. InfoSec departments have had to increase staff and use outside contractors to identify vulnerabilities / holes and patch these same holes. By using our subscription services, for users who have a need to access data and applications on a confidential server, the problems of finding holes and then patching them is dramatically reduced if not eliminated.

9. It could be argued that more people will be needed when we identify and stop persons who are seeking to do us harm. If we detect questionable events that need further investigation the agency will need to conduct more staff to investigate - Not so. Our investigators all have the appropriate security clearances and can be used on a on-demand to assist agencies when problems develop. Our rates are lesser than the agency’s own staff costs. A CSI (Cyber Support Investigator) can be hired by the hour with no long term contract.

10. Lost and stolen CAC cards present a security risk, which itself leads to costly responses. A card-not-present approach completely eliminates this possibility.

11

Page 12: 2016 01-05 csr  css non-confidential slide deck

12

Flaws in Biometric Authentication Facial Recognition:

1. Is the camera looking at a live face or a picture of the authorized user? The system can recognize that some of the metrics are changing, such as

xxxxxxxxxxxxxxxxxxx.

2. Are there obstructions that mask the measurable points for recognition like long hair, a telephone handset or large sun glasses? The user knows that it is advantageous to make sure there is nothing blocking facial

metrics, because it would cause additional time for authentication.

3. Is there sufficient lighting to quantify the distances between facial points? The user knows that it is advantageous to make sure there is sufficient lighting

because if not, it would cause additional time for authentication.

12

Page 13: 2016 01-05 csr  css non-confidential slide deck

13

Flaws in Biometric Authentication Voice Recognition:

1. Was a recording played that is exactly the same as when the user was initially registered in the system? During the log in we ask the user to make a unique sign in, such as the current date

and time: "This is Bob logging in Monday, June 22nd at 14:00".

2. A users voice varies from day to day, and also may sound different when under stress or sick.

3. Some users do not like or want to speak sufficiently loud, especially in a public location, like in a airport waiting lounge or public library. A finger print reader could be an alternative to voice, if the user expects to spend

lots of time in these kinds of public spaces.

4. Accents are at times difficult to distinguish as being unique to a specific person. The same accent could give more than one person a high score.

5. Background Noise can effect accuracy making it difficult to distinguish the users voice.

13

Page 14: 2016 01-05 csr  css non-confidential slide deck

14

Flaws in Biometric Authentication Fingerprint Recognition:

1. Not all government issued notebook computers (our recommended terminal) have finger print readers.

2. Some users do lots of work with their hands and their fingerprints become worn down over time.

3. Certain nationalities have a finger print that is finer others, making it difficult to distinguish properly.

4. A good fingerprint can be hampered by dirt or oils.

14

Page 15: 2016 01-05 csr  css non-confidential slide deck

15

Initial Biometric Authentication The Initial biometric authentication uses a minimum of 2 Factors (Facial and Voice or Fingerprint):

1. Since facial, voice and fingerprint recognitions are not correlated; if a bad guy could be accepted on one of two recognitions, the odds of being accepted on two recognitions go down by many magnitudes. Equally the odds of being accepted by two recognitions increases the level of security also by magnitudes.

2. Because security increases by magnitudes when two biometrics are used, xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, making it faster and easier to achieve recognition without significantly adding any additional risk.

3. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. 98% + of legitimate authentications take no longer than 5 to 8 seconds.

15

Page 16: 2016 01-05 csr  css non-confidential slide deck

16

The Third Biometric Authentication Factor

CONFIDENTIAL REDACTED

16

Page 17: 2016 01-05 csr  css non-confidential slide deck

RECOMMENDED TERMINAL FOR SECURE ACCESS AND PERSONAL LIBERTIES

• We adjust the user’s government issued standard notebook computer (Confidential) so that the user can have an encrypted VPN tunnel into a confidential and secure host VDI .

• We Continuously Monitor, Control and Record all activities in the secure session. This session requires low bandwidth and can accommodate significant latency (Confidential).

• The user is allowed complete personal liberties on the same terminal, without causing a data breach (Confidential).

A Standard Notebook computer with:• Camera for facial recognition, • Finger print reader and / or microphone for second

biometric recognition,• Fast Dual Biometric Authentication with 95%+ accuracy. • If Dual Biometric Authentication does not confirm user then

a Third Biometric Factor (Confidential) is used for 100% accuracy and validation.

17

Page 18: 2016 01-05 csr  css non-confidential slide deck

REGISTRATION FOR MULTI-FACTOR BIOMETRIC AUTHENTICATION AND AUTHORITIES PROFILE

1. After the user’s terminal has been adjusted (Confidential) he or she must be registered in our system (Confidential). Registration can take place from anywhere at any time (Confidential).

2. As part of registration we will also establish a behavioral profile. During future sessions we look for changes that may give us cause to send out an alert (Confidential) .

3. The collected biometric information will now be used for automated 2 Factor Biometric Authentication.

4. If automated 2 Factor biometric authentication fails, a Third Biometric Authentication Factor, will be used (Confidential) to confirm or reject Authentication.

5. Lastly, the CSI will contact the designated Agency Security Officer to confirm in writing the users Authentication Profile, and add the users authorities, to then be programmed into our control database.

18

Page 19: 2016 01-05 csr  css non-confidential slide deck

19

COPYRIGHT © Bart Falzarano Consulting

COPYRIGHT © Bart Falzarano Consulting

COPYRIGHT © Bart Falzarano Consulting

COPYRIGHT © Bart Falzarano Consulting

THREE FACTOR AUTHENTICATION:

3) The User is now asked to authenticate via finger print reader, voice and/or camera (facial) for Automatic Two Factor Biometric Authentication. If Automatic Authentication fails then a Proprietary Third Biometric Factor (Confidential) is implemented to be the final arbitrator that will accept or reject the user.

Internet2) Internet Connectivity Established

4) Upon Successful Authentication (Login), a Secure AES-256 bit Encrypted VPN Tunnel is established through the Cyber Support Solutions Central Server to the Government Host VDI session (Confidential).

5) In a few seconds the workstation user or remote agent (AGENT 12) gains access to the Government’s Host VDI Secure Server and its authorized applications.

6) Once the user is online, Desktop screens are pushed to the workstation from the Government Host VDI. The user’s activity (screens and keystrokes), from this point onward, are monitored, controlled and recorded, based on the authorized user’s profile (Confidential).

COPYRIGHT © Bart Falzarano Consulting COPYRIGHT © Bart Falzarano Consulting

1) Workstation is powered up and seeks a Wired or Wireless Network (Confidential) , to connect with Authentication and Continuous Monitoring, Control and Recording Server

Page 20: 2016 01-05 csr  css non-confidential slide deck

After 3 factor authentication we continue to monitor, control, record and look for attempts

to violate given authorities with the subsequent generation of Alerts.

Details are removed in this non-confidential slide deck.

AFTER THREE FACTOR BIOMETRIC AUTHENTICATIONAND ENCRYPTED ACCESS TO THE SECURE VDI SERVER

20

Page 21: 2016 01-05 csr  css non-confidential slide deck

21

AUTOMATIC ALERTS PROVIDE “CAUSE”:

1. We automatically and continuously monitor a secure session looking for “Cause”. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.

2. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

3. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

4. These Alerts provide an automatic and objective reason to look further at a user, as a cost effective alternative to the very expensive approach of continuously monitoring everyone WITHOUT CAUSE. Alerts may also be considered legal CAUSE to investigate further.

Page 22: 2016 01-05 csr  css non-confidential slide deck

22

TELE-WORKING WITH CONFIDENTIAL AND SECRET INFORMATION

Our solution improves on the performance of a user when traveling or away from his or her office, working on secret

or confidential information.

The details of how we accomplish this has been removed from this non-confidential slide deck.

Page 23: 2016 01-05 csr  css non-confidential slide deck

23

IDENTIFY CHANGES IN BEHAVIOR IN REAL-TIME (1):

We identify changes in behavior in real-time, seeking to determine if a user has undergone changes that may cause harm to others (i.e. Edward Snowden and Andreas Lubitz, the Co-Pilot of the Germanwings airplane).

All items regarding how and what we identify in behavioral changes, have been removed from this non-confidential slide deck.

Page 24: 2016 01-05 csr  css non-confidential slide deck

24

IDENTIFY CHANGES IN BEHAVIOR IN REAL-TIME (2):

All items regarding how and what we identify in behavioral changes, have been removed from this non-confidential slide deck.

Page 25: 2016 01-05 csr  css non-confidential slide deck

A MONITORING WORKSTATION AT CSS

20 Workstations Shadowed with 19 logged into a VDIand one off line

Managers desktop and 2 Shadowed desktops that are Shadowing 8 others each.

25

Page 26: 2016 01-05 csr  css non-confidential slide deck

24/365 REMOTE DESKTOP MONITORING Monitoring can be done locally or remotely wherever there is an internet connection. The Client can choose to do all live monitoring by themselves or contract with CSS personnel, having Security Clearances, to do live monitoring based on set parameters.

This screen shot is a place holder. It will have this plus a screen close up that is being monitored.

26

Page 27: 2016 01-05 csr  css non-confidential slide deck

RECORDING AND PLAYBACKIn the world of Customer Service Representatives (CSR) the recording of an agent’s screen and voice and their playback is a normal part of their training and the quality control process. This capability can also be used to improve on the work performance of government workers.

Furthermore, this CSS recording capability generates an audit trail of all end user activities and provides for legal support against any misuse of agency resources.

On March 14, 2014: “U.S. intelligence officials are planning a sweeping system of electronic monitoring that would tap into government, financial and other databases to scan the behavior of many of the 5 million federal employees with secret clearances…”. “…Intelligence officials have long wanted a computerized system that could continuously monitor employees, in part to prevent cases similar to former National Security Agency analyst Edward Snowden. His disclosures bared secretive U.S. surveillance operations…”.

CSS’s capabilities, as presented herein, directly address what U.S. intelligence officials want (above) for a lesser cost than what the government currently spends.

27

Page 28: 2016 01-05 csr  css non-confidential slide deck

RECORDER PLAYBACK OVER CLIENT PORTAL

28

Page 29: 2016 01-05 csr  css non-confidential slide deck

29

AUG. 7, 2015 - FEDERAL SYSTEMS INTEGRATOR IN CYBERSECURITY FOR IBMAUGUST 18, 2015 A BUSINESS PARTNER OF IBMAUGUST 26, 2015 IBM PRESENTED OUR SERVICE TO 30 IBM ACCOUNT REP’S.OCTOBER 19, 2015 IBM BEGAN TO PROMOTE A PILOT PROGRAM TO DHS FOR US.

We have agreed to became a Federal Systems Integrator and Business Partner to IBM, for our proprietary and most advanced Cybersecurity services and signed the appropriate documents. In this relationship:1. Our computer platform will be relocated to their two “Government Only”

FedRAMP data centers, ASAP for servicing their government clients.2. CSR-CSS can also service their own Federal Government clients from here.3. IBM will also promote our services as part of selling their own services.4. CSR will also resell IBM’s “Bare Metal” hosting and other products & services.5. IBM, will include CSR in their bidding on a $5 billion appropriation in Continuous

Diagnostics & Mitigation (CDM) where $1+B will be for “Identify and Access Management” (our specialty) for the Dept of Homeland Security (DHS).

6. IBM will also try to get us added on to existing contracts they have with DHS.7. IBM has offered us additional assistance in many other areas.

Page 30: 2016 01-05 csr  css non-confidential slide deck

30

OUR FEDRAMP CLOUD NETWORK SOLUTION

Page 31: 2016 01-05 csr  css non-confidential slide deck

31

OUR CLOUD NETWORK PLATFORM FOR ENCRYPTED TUNNEL ACCESS BY

FEDERAL GOVERNMENT CLIENTS• Our monitoring, controlling, analysis and recording servers will be in IBM’s most advanced

FedRAMP data centers in both Ashburn, VA and Richardson, TX. • These FedRAMP data centers are designed to meet all Federal Security and other

requirements:− FedRAMP 2.0− Agency ATO with the FCC− NIST SP 800-53− FISMA Moderate/DISA Impact Level 1-2− SOC 2 Type II/SSAE 16− HIPAA and PCI-DSS compliant− 99.999% High Availability− Centralized Management− Secure AES-256 bit Encrypted VPN Tunnel Usage

• The above two FedRAMP data centers, are for US Government usage only, and are inter-connected by leased fiber with no bandwidth sharing.

Page 32: 2016 01-05 csr  css non-confidential slide deck

32

OUR CLOUD NETWORK PLATFORM FOR ENCRYPTED TUNNEL ACCESS BY

COMMERCIAL CLIENTS• Our authentication, monitoring, controlling, analysis and recording capabilities for

commercial customers are located in multiple data centers (for redundancy) within IBM’s growing network of 38+ commercial data centers and network nodes in Asia, Europe, South America, Australia and the US. This latter data centers are interconnected network and also use IBM leased and dedicated optical fiber (no bandwidth sharing), to achieve the lowest latency for our commercial clients who seek our Access and Identity Management services from anywhere in the world.

• Furthermore these IBM commercial data centers are also designed to offer many additional features for access to our services including:− SSL and PPTP VPN access via Amsterdam, Atlanta, Dallas, Houston, San Jose, Seattle,

Singapore & Washington DC− Encrypted secure access to a client host server’s VDI sessions via AES-256 bit

Encrypted tunnels− Port data speeds from 100 Mbps to 10 Gbps for access to our clients secure VDI

sessions− 99.999% High Network Availability with 7 x 24 maintenance support.

Page 33: 2016 01-05 csr  css non-confidential slide deck

India

ChinaTokyo

Hong Kong

Singapore

Melbourne

Seattle

San Jose

Los Angeles

Mexico City

Denver

Chicago

Dallas

Houston

TorontoMontreal

BRAZIL

New York City

Washington D.C.

Miami

London Frankfurt

Amsterdam

Paris

Sydney

Atlanta

THE CYBER SUPPORT SOLUTION’S (CSS) GLOBAL FOOTPRINT

Secure Government Workloads can be hosted in IBM SoftLayer’s (2) FedRAMP data centers, or in their own data centers with CSS support. Non-government servers can be located in 38 other IBM fiber interconnected data centers or in their own data centers, also with CSS support.

33

Page 34: 2016 01-05 csr  css non-confidential slide deck

34

SUMMARY - SUBSCRIPTION SERVICE OFFERING INCLUDES:1. 3 Factor Biometric Authentication 24 x 365 globally (Proprietary & Cost Saving).2. After passing authentication all activities in a secure VDI session are automatically

continuously monitored, analyzed, controlled and recorded (Proprietary).3. After passing authentication the user is given access to only pre-authorized

applications, with control use of files and other capabilities (Proprietary).4. Attempts at unauthorized activities, automatically cause ALERTS to be sent to be

sent to SOC officials - (Proprietary).5. The behavior of the authenticated person is analyzed in real-time to determine if

there has been a change from the users base-line behavior pattern to one where we determine if the changed behavior may be harmful to others (Proprietary).

6. Automatic ALERTS also provide "CAUSE" to monitor a user closer instead of indiscriminately monitoring every user – a cost saving feature.

7. After authentication all recorded session activity can be played back by authorized personnel (the Client’s SOC officer or our CSI’s) – a cost saving feature.

8. An agency can order 1 or a thousand subscriptions, with no long term commitment, to test our services – a cost saving feature.

9. CSS can contract to provide Cyber Security Investigators (CSI’s), with appropriate security clearances on an as-needed basis, thereby reducing full-time staff needs, plus associated costs and personnel responsibilities – a cost saving feature.

Page 35: 2016 01-05 csr  css non-confidential slide deck

35

SILOS – SMALL SUPPORT CENTERS WITH LOWEST FEDERAL AUTHORIZED WAGES

• CSS’s technology considers all users, even in our headquarters site, as Remote Workers. • By using our screen, voice and CCTV capabilities we can create a Silo (a small support

center) in small towns or areas with high unemployment rates (a HUB Zone), where the lowest approved government wage rates exist. It goes without saying that these Silos could also be within government facilities.

• Management control and training at Silos are accomplished remotely from the CSS “Principal Office”, utilizing the same techniques of screen shadowing / monitoring / recording, listening to business related phone calls, and using whisper coaching. One-on-one training is conducted using the camera in the notebook computer alongside, a standard 27” LCD monitor.

• Other CCTV cameras and microphones can also be used for group training, supervision and general observations.

• Using the above technique for a pending client, we may have an opportunity to locate a Silo in a Kentucky coal mining town, where the mine has shut down.

• This capability allows us to grow most cost effectively (in HUBZone and Opportunity zones) and locate support groups near clients.

Page 36: 2016 01-05 csr  css non-confidential slide deck

36

CSR-SUPPORT LLC & CYBER SUPPORT SOLUTIONS FOUNDED BY THE TELECOMMUNICATIONS

CONSULTANCYCSR-Support and its dba Cyber Support Solutions was founded by the Telecommunication Consultancy. This company has been providing its consulting services for over 30 years (www.TelConsultancy.com).

Past clients include:• The City Of New York and its Housing Authority (police force of 2,700+,

emergency services for over 3.5 million residents and all other administrative functions.

• The Federal Communications Commission and the State of Louisiana for a Rural Health Care Network.

• Other non-government entities to include General Motors, AT&T, and Dreyfus / Mellon Bank among numerous others.

Mr. Kaufman, the Managing Director and owner, is also an Expert Witness, Founder and Past President of the Society of Communications Technology Consultants International.

Page 37: 2016 01-05 csr  css non-confidential slide deck

37

Contact information Richard N. (Dick) Kaufman - POC• Office Direct…770-628-0211• Mobile………..770-309-9678• Email………….RNK@CSR-

Support.com

• GSA Schedule 70 (GS-35F-0437V)*

• 8(a) certification*

* In partnership with Exalt Integrated Technologies, LLC

Page 38: 2016 01-05 csr  css non-confidential slide deck

38

QUESTIONS?NEXT STEPS?