McAfee Enterprise Information Security Overview

OVERVIEWMcAfee Enterprise InformationSecurity Overview2019

OVERVIEWTable of Contents3445566778899999102The McAfee PledgeIntroductionOffice of the Chief Information Security Officer (OCISO)Information Security Management SystemInformation Security Risk ManagementSecurity Is Everyone’s ResponsibilityWorking on a Secure NetworkCloud SecurityData ProtectionLawful Transfer of Personal DataDeveloping Secure ProductsMaintaining AvailabilityMcAfee Cybersecurity Fusion CenterIncident ResponseReportingLearn MoreAbout McAfeeMcAfee Enterprise Information Security Overview

OVERVIEWThe McAfee PledgeWe are McAfee.We make the world a safer place. This is our pledge. Our cybersecurity expertise is foundationalto how the world views McAfee. The outcomes we drive matter. That’s why each and every daywe use our talent to create technology that safeguards human progress. We consistently, reliably,and effectively protect all that matters through leading-edge cybersecurity, from the workplace tothe home and everywhere in between. But we are known for more than what we do. We also arerevered for who we are. Our integrity informs every action we take and every word we speak. Youare the reason our brand is trusted to protect companies large and small, as well as organizationsand governments around the globe, not to mention hundreds of millions of people connectedthrough the transformational power of technology.How we do business defines us. That’s why we steadfastly draw on our courage to fight cybercrime,even as our adversaries relentlessly turn the promise of technology against all of humanity. Wegladly collaborate with competitors for the higher good. And we partner with the U.S. government,national agencies, and international law enforcement to ensure our deep knowledge andcompelling innovations have the greatest impact in efforts to defend our country and the freeworld.How we treat one another and our stakeholders—from customers and partners to suppliers andthe communities where we work and live—is characterized by our core values. That’s why each ofus is responsible for living our Code of Conduct, which includes deliberate and full compliance withthe letter and spirit of the law as well as ethical behavior. Our Code of Conduct ensures that ourvalues inform every project, every team, every office, and every relationship that we earn aroundthe world. Not only do we make the world a safer place, but by making a personal pledge to acthonestly, ethically, and with full diligence in support of our Code of Conduct, we also make theworld a better place.Chris Young CEO, McAfee3McAfee Enterprise Information Security OverviewConnect With Us

OVERVIEWMcAfee Enterprise InformationSecurity OverviewIntroductionThis document provides an overview of the McAfee Enterprise Information Security Program.Office of the Chief Information Security Officer(OCISO)Information security is at the core of McAfee and hasthe full support and commitment from our CEO and topexecutives.McAfee has implemented a centralized, globalinformation security program led by the Office of theChief Information Security Officer (OCISO). The OCISOorganization is comprised of five main sub-organizationsto support the confidentiality, integrity, and availability ofMcAfee information, assets, products and services, andthose that are entrusted to us. Those sub-organizationsare: Governance and Assurance Security Architecture Security Engineering: Device, Network and Cloud 4The OCISO organization is customer zero at McAfee.We use our own McAfee products throughoutthe enterprise to prevent, detect, and respond tocyberthreats that affect our business. By operatingas customer zero, we are able to provide our productmanagement teams valuable feedback which helpsto ensure that the McAfee products we deliver to ourcustomers are best in class.With CEO and top executive commitment to informationsecurity and a global CISO-led security organization,McAfee engages, trains, and expects the entireworkforce to exercise security in their daily role, assecurity is everyone’s responsibility.Security Intelligence: Fusion Center, Physical Security,and Industrial SecurityProduct Security and Vulnerability ManagementMcAfee Enterprise Information Security OverviewConnect With Us

OVERVIEWInformation Security Management SystemInformation Security Risk ManagementThe McAfee Information Security ManagementSystem (McAfee ISMS) is at the core of the globalinformation security program. It is designed to ensurethat a risk-based approach is taken for the selection,implementation, and monitoring of appropriate securitycontrols throughout the organization.As part of the McAfee ISMS, McAfee InformationSecurity Risk Management (McAfee ISRM) is critical forongoing identification of threats, vulnerabilities and risksto the enterprise.The McAfee ISRM consists of three tiers:The baseline security controls that comprise the McAfeeISMS are based on National Institute of Standardsand Technology (NIST) Special Publication (SP) 800-53revision 4 and are further derived into management,operational, and technical categories. Industrystandards, best practices, and additional securitycontrol frameworks may be used for specific zones andproducts beyond the McAfee baseline, such as PaymentCard Industry Data Security Standards (PCI DSS),FedRAMP, ITGC/SOX, and others.A set of internal policies and procedures govern theimplementation, monitoring, and effectiveness of thesecurity controls.Governance of the McAfee ISMS is maintained bymanagement system reviews and operational reviews,focused on security operational control monitoring.The McAfee ISMS aligns and is certified to ISO/IEC27001:2013.5McAfee Enterprise Information Security OverviewTechnologyThird PartyOrganizationEach tier comprises of four phases to complete theMcAfee ISRM process:IdentifyEvaluateAssessManageEach tier of the McAfee ISRM is built into existingbusiness processes to provide continuous identificationand management of risks. Information security risks arecaptured into a risk register and reported. McAfee ISRMprovides input into the McAfee ISMS baseline securitycontrols.

OVERVIEWSecurity Is Everyone’s ResponsibilityThe high level of security at McAfee relies on a welltrained workforce.Where permitted under applicable law, McAfeeemployees are screened prior to hire, includingundergoing and passing background checks. McAfeepersonnel are required to acknowledge and consent toMcAfee security and privacy policies once onboarded,including confidentiality obligations.Once onboarded, McAfee personnel receive annualsecurity awareness and data protection training as wellas more detailed, role-based training where appropriate.In addition to training, ongoing security awarenessactivities based on identified risks and best practice areconducted throughout the year, such as the McAfee Immersive Phishing Program. As part of this program,McAfee personnel receive, at a minimum, one monthlysimulated phishing email. Those who fall susceptiblereceive targeted training focused on identifying andreporting phishes.Working on a Secure NetworkThe McAfee network is based on a segmentedarchitecture, where certain zones are authorized forcertain types of data processing, which then correspondto specific security controls.6McAfee Enterprise Information Security OverviewChange management and security management enableMcAfee to stay up to date on patches using centrallymanaged tools for deployment. In addition, productionchanges are run through the McAfee Change AdvisoryBoard (McAfee CAB) for documentation and approval asnecessary.Computer systems on the McAfee networks andcomputer systems used for McAfee business purposeshave current, approved security and malware protectionmeasures in place. McAfee implements malwareprotection at a variety of locations, including, but notlimited to the network, data centers, endpoints, servers,and email infrastructure. Logical access means aretested to determine their resistance to attacks and helpto avoid any degradation or unwanted deletion.McAfee performs vulnerability scanning monthly, at aminimum, against the internal infrastructure and at aminimum weekly externally to help ensure the latestcontent operating system and application level updatesare applied.Attack and penetration (A&P) testing is generallyperformed annually and performed quarterly in certainzones with critical data (such as the PCI zone) on existingservices. New services are tested prior to productionimplementation. A&P testing is conducted using acombination of internal McAfee resources and externalservice providers.

OVERVIEWRemediation of vulnerability scans and A&P is prioritizedbased on the severity of the vulnerability.Third parties are not granted access to internal McAfeesystems without appropriate contractual agreementsand security processes in place to appropriately protectMcAfee data and assets.Mobile devices connected to the McAfee networkand information are required to be managed, helpingto ensure that our mobile security controls areimplemented and monitored. Additionally, mobiledevices are not allowed to connect to our segmentedproduction environments where customer data may bestored, processed, or transmitted. It is against companypolicy for McAfee information to be transferred orotherwise copied to a non-managed application orservice.Cloud SecurityMcAfee understands that cloud data security is critical.The security team works closely with our IT, engineering,and legal teams to understand and implement therequired security controls for the relevant frameworksassociated with cloud computing.Cloud management plane access is restricted followingidentity and access management (IAM) best practices,including utilizing multifactor authentication (MFA).7McAfee Enterprise Information Security OverviewAsset discovery tools are implemented, and relevantdata security technologies are used to protect McAfeeinformation, including that of our customers, in McAfeecontrolled environments. Technologies implementedinclude data loss prevention (DLP) and encryption(client-side and server-side), as well as obfuscation,anonymization, tokenization, and masking. Continuousauditing occurs to highlight and help prevent possibledata exposures.External-based perimeter assessments are performedat least weekly to significantly limit the attack vector andreduce the attack surface.Data ProtectionData protection is a high priority for McAfee. Regardlessof whether data is processed (collected, used, retained,disclosed, disposed, or otherwise acted on) on theMcAfee network, on a third-party vetted and approvedcloud network, or on a “bring your own device,” securitycontrols are in place that are designed to ensureprotection.McAfee requires the use of appropriate cryptographiccontrols to protect personal data—also known aspersonally identifiable information (PII) and personalinformation—in transit and at rest on removablemedia. This includes hard disk encryption on endpoints,including laptops.