Security:

Creating Trust in a Zero Trust World

CEO White Paper

Mark J. Barrenechea
OpenText CEO and CTO

Security: Creating Trust in a Zero Trust World

Contents
Introduction

2

The Growing Threat

3

A Zero Trust Approach to Security

7

Obstacles to Implementing Zero Trust

10

Proactive Security Technologies

14

Reactive Security Technologies

20

The Only Constant Is Change

241Introduction
At the dawn of the computer age, computers were not connected. Security was easy:
put the computer in a room and set up physical security to make sure only authorizedusers enter the room. That was all there was to it.
When computers could be networked with a central system, security became more
complicated. Still, protection was within reach. The idea of the physical perimeter
became abstracted; the model of perimeter cybersecurity was born. A company’s onpremises, enclosed network was its castle and perimeter security was the moat. Access
controls permitted authorized users over the moat and into the castle. And within the
castle, users were trusted to move freely.
With the advent of the internet, the perimeter became fuzzy. It was a new worldof widespread networking, remote access and rapid information exchange. New
technologies, like mobile devices and cloud, poked even more holes in the perimeter.
Today, cybersecurity is evolving again. The world is becoming increasingly connected
and complex in the fourth industrial revolution. Cyberattacks are dynamic, difficult
to predict and the stakes are higher. Cybercriminals have the latest technologies attheir disposal. Machines are deployed against the enterprise’s defenses, operating
at a galactic scale, with volume, speed and agility humans can scarcely comprehend.
Organizations need to counter machines with machines to have any hope of stymieing
today’s advanced threats. It is a machine versus machine world.
Figure 1:

A Simplified History of Cybersecurity

Physical
Perimeter

Network
Perimeter

Perimeter
Becomes
Porous

Machine vsMachineThere is no place for 20th century security models in a 21st century network.
Cybersecurity must evolve. The threat is growing—and so are the impacts.

2

Security: Creating Trust in a Zero Trust WorldThe Growing Threat
Digital transformation has changed the world, spurring the rise of new technologies,
new cultural paradigms and new business models. In this information age, data isconstantly flowing into and out of the enterprise from every imaginable source.
Endpoints are multiplying. Employees are working on-site, at home and in the coffee
shop. Supply chains are global. Everything is connected.
Unfortunately, everything that is connected can be hacked. Large scale data breaches
have become commonplace over the last decade. It is happening in every industry.
A global sportswear brand had 150 million accounts belonging to a subsidiary stolen
in a data breach. The company’s shares dropped almost 4%.1 Meanwhile, direct losses
of a huge data breach at a U.S. hotel group, in which half a billion customer records
were compromised, climbed as high as $600 million.2 On the heels of this breach, aquestion-and-answer site confirmed that its systems had been hacked. Weeks before,
hackers accessed the personal details of 29 million accounts from a major social
networking site.3
On October 2, 2019, the FBI issued a rare warning against high-impact ransomware
attacks threatening U.S. organizations and businesses.4 Ransomware (malware
that takes control of a system or business network and holds it hostage until aransom is paid) is becoming more targeted, sophisticated and costly. It threatens
every organization, from governments to industrial companies, healthcare to thetransportation sector. And everything in between.
Every day, another organization joins the club—those who have been hacked andthose who are about to be.
Accenture and the Ponemon Institute have reinforced that cybercrime is “increasing,takes more time to resolve and is more expensive for organizations.” In fact, aftersurveying hundreds of leading companies, they found that the average cost of
cybercrime to organizations rose 12% last year to $13M.5 Compared to mid-2018, thenumber of reported breaches was up 54%, and the number of exposed records was up
52%—setting up 2019 to be the “worst year on record.”6
While cybersecurity itself is indeed complex, the underlying reason for this rise inbreaches is simple: ever-growing risks combined with insufficient security practices.
Figure 2:

Escalating Security Risks 7 8 9 10 11

50%

$3.9M

53%

38.6B

300%

Companies thatexperienced abreach of sensitive
data within the last
12 months, up from
43% in 2015

The average costof a data breachin 2019, notincluding drops
in share value

Data breaches
caused by humanerror, not hacking

Internet-enabled
devices in use by
2025(Shred-it Report, 2019)(Strategy Analytics,
2019)

Increase in
privacy classaction lawsuits in
2020(Forrester, 2019)(Ponemon Institute,
2019)(Forrester, 2019)3

The attack surface grows with every passing day. Two-thirds of employees use
their own devices for work, with some using more than one (think cell phone,tablet, personal laptop, wearable technology…).12 This “bring your own device”(BYOD) trend is unstoppable and requires new security measures to manage these
myriad endpoints.
Further, the endpoints may be on or off the business network. Either way, theenterprise is responsible for them. Today’s technology users are digital nomads—
they are mobile, virtual. Right now, every large organization has employees sitting inStarbucks and Dunkin’ Donuts, working on open networks. You own that. Developers
are opening virtual machines on AWS or Azure. You own that, too. The enterprise must
protect business data from leaking to consumer applications, secure information on
open networks, and maintain privacy and compliance. It must be able to determine
whether any specific device can be trusted at any given time. It’s your edge—secure
it, protect it, isolate it, investigate it, defend it. Own it.
Figure 3:

It’s Your Edge. Own it.

Work
Smart
Speakers

Other
people’s
networks

Hotels

It’s Your Edge.
Own It.

Smart
DevicesHome

Airports

Cafés

Conferences

On top of BYOD, the Internet of Things (IoT) is creating billions of new endpoints andtransmitting massive amounts of information. As the amount of data grows, so too dothe opportunities for it to be compromised. If IoT devices are not adequately secured,
they serve as ideal entry points to the rest of the network—especially when they arewithin a perimeter security model.
At the same time, regulations, security and governance are all converging around datarequirements to comply with information privacy laws like the General Data Protection
Regulation (GDPR) in Europe, the Personal Information Protection and Electronic
Documents Act (PIPEDA) in Canada, the Health Insurance Portability and Accountability
Act of 1996 (HIPAA) and the Children’s Online Privacy Protection Act of 1998 (COPPA) in
the U.S. To keep up with these regulatory pressures, the enterprise needs adaptable anddefensible governance practices in place.

4

Security: Creating Trust in a Zero Trust World

FINRA
Rule 2210

Conflict Minerals
Disclosure

HIPAA
Dodd Frank
Sarbanes-Oxley Act

IncomeTax Act

CCPA
SEC 17a-4
ISO/IEC 27001
FSMA

Basel III
BSI PD5000 Accord E-Verwaltung
GDPR
Patriot ActSÄHKE2(global)
PIPEDADoD 5015.2
EU Data Protection EU Pharmacovigilance
Directive

Evidence Act

Presidential Memorandum:
Managing Government
Records Directive
FDASIA
Federal Rules of
FOIA
Civil Procedures
FERC 18 CFR
Parts 35 & 284

GDPL

MoReq
2010

Solvency II

APPIInformation
Technology Act
GoBD
Personal Data
Protection Code

Promotion of Accessto Information Act VERS
AML/Anti-Corruption
Law 12846/2013 POPI

■ Data Protection & Privacy Rules■ Regulated Records Retention■ eDiscovery Requirements

Regulatory Pressures

MiFID II and
MiFIR

AODA

FATCA
PCI
FDA 21 CFRPart 11KYC/KYV

Figure 4:

Telecommunications(Data Retention) Act
National Security
Legislation
Amendment Bill■ Information Integrity & Authenticity■ Reporting Obligations

The enterprise no longer exists in isolation. The days of contained, on-premises
networks are long gone. Today’s organizations operate on and off-cloud. As cloudcomputing becomes the norm, enterprise infrastructure becomes increasingly
complex and distributed. Whether public, private or hybrid, cloud computing involves
new kinds of application deployments, microservices, containerization and serverlessfunctions. How do we secure a system that, by its very nature, we cannot put a wall (oreven a decent fence) around?
The classic perimeter strategy trusts those already inside the network and assumes
threats are external. Users are treated with “trust, but verify” policies, giving thembroad access once they are deemed “trusted.” Protection involves perimeters aroundall possible access points to the enterprise ecosystem, including networks, firewalls,
VPNs, gateways, endpoints and data centers.
However, none of this helps when the bad actors are already inside the network. The
average dwell time for threats in a corporate network is 100 days; the threat enters
the system and waits over three months before acting.13 Traditional security does nothave the tools necessary to root out these lurkers before they can do harm. Add thefact that 53% of breaches are caused by simple human error from the enterprise’s
own employees, and it is clear that giving users free rein once inside the perimeter is abad idea.14
Malicious insider threats—like disgruntled employees, corporate espionage or foreign
government agents—must also be guarded against. Everything must be monitored forsuspicious activity.
Traditional approaches also cannot effectively secure edges outside of theperimeter. Often, they cannot even determine how to handle BYOD devices within
it. They are blind in the distributed cloud. And when a user account is compromised,cybercriminals can walk straight through the front door and gain access to everything.
The castle-and-moat approach to cybersecurity is dead. The castle no longer exists,
rendering the moat moot. Vulnerabilities permeate all levels of business systems.

5With more sophisticated hackers on the rise, new technologies and data formats, anda plethora of regulations, how will the enterprise manage all of its data, secure it andensure that it is compliant?
Cybersecurity is in dire need of a reboot. Today’s threats cannot be fought withyesterday’s strategies.
The enterprise needs a new model of security: Zero Trust.

6

Security: Creating Trust in a Zero Trust World

A Zero Trust Approach to Security
Zero Trust is a network security model based on the idea of “never trust, always verify.”
Users and endpoints are not trusted until they are authenticated—and even then, they
only gain access to specific, limited applications and data. On top of that, they mustreauthenticate periodically to maintain their access. Smart threat detection technologies
patrol the network, analyzing patterns and flagging anomalous or suspicious behavior.
With holistic Enterprise Information Management (EIM) technologies, critical data iscentralized and protected within layers upon layers of security extending from the heartof the enterprise out to all endpoints. Protection is complete against all attack vectors,
external or internal.

A

fo

CRM

Secu ityr

Productivity

EIM at the Center of the Enterprise

Eco
Systems

N

r

m

EIM

et

Plat

Business
SystemsHR

Customersrk

ERP

Figure 5:

Trading Partners

Insights
l i ca t i on
pp
s

wo

Supply Chain

Suppliers
Vendors

Zero Trust is strict and vigilant.
It starts with the basics:
1. Let’s understand who the user is.
2. Let’s understand the endpoint being used for access and its security status.
3. Let’s enforce a conditional policy that specifies access.

Old security model

Zero Trust security model

Figure 6:
Zero Trust Is the Effective Security Model

Let’s understand
who the user isCastles and moats
are no longer
protecting your data

Let’s enforce a
conditional policy thatspecifies accessLet’s understand theendpoint being used
for access and its
security status

Understanding who the user is involves a technology foundational to the Zero Trustmodel: Identity and Access Management (IAM).

7

Before allowing access to company hardware and applications, IAM authenticates andauthorizes each user. An IAM system includes automated lifecycle management for
both internal and external users, comprehensive identity governance, privileged accessmanagement and integrated multi-factor authentication (MFA) capabilities. It stops
identity sprawl to third parties, centralizing and protecting identities.
However, securing identities is just the beginning. One of the most common ways bad
actors circumvent enterprise security protocols is through endpoints. All edges arevulnerable—servers (both on-premises and on-cloud), workstations, desktops, laptops,
tablets, mobile devices. That is why a Zero Trust security system must understandevery unique endpoint and its security status. It must have complete visibility andcontrol over any endpoint requesting access.
In a security landscape where business users (and their endpoints) have become
hyper-mobile, employees are digital nomads working from various geographies andtypes of locations. Certain places carry higher risks. Endpoint security applications helporganizations to keep pace with this new way to work by integrating with the enterprise
Virtual Private Network (VPN) and micro-segmenting to keep endpoints protected,
regardless of where they are. Remember: own your edge.
Micro-segmentation underpins successful endpoint security, and indeed, the entire
Zero Trust security approach. It calls for enterprises to segment based on users, theirlocations, the sensitivity of data and other categories. Once this is done, organizations
gain granular visibility into traffic and can enforce multiple layers of monitoring,inspection and access control based on the “who, what, where, when, why and how” ofdevices and users attempting to access the protected surface. This is known as “Layer
7” policy—and it is what makes Zero Trust security possible. Nothing gets in or out
without rigorous vetting.
With micro-segmentation, the entire threat vector changes. No one can get everything.
Proper separation prevents most data from even being in the crosshairs of hackers. The
only way bad actors can get to it is individually, which is difficult because they would
have to first identify each individual entry point. Further, threat detection technologies
are vigilant within this framework, watching for unusual behavior from any source, at
any level.
But if (or when) bad actors do succeed, the targeted endpoint is equipped with endpoint
detection and remediation technology that swiftly isolates, remediates and cleanses
the threat.
In knowing exactly who each user is and the status of each endpoint, Zero Trusttechnologies make it possible for the enterprise to effectively enforce conditional
access policies—also known as “least privilege access”—to restrict each user’s accessto only the resources they need. No more, no less.
This is done using IAM protocols, which allow the Zero Trust enterprise to set role-based
and attribute-based access controls (RBAC and ABAC). Different levels of security andaccess are applied to different types of accounts and users. Even the most privileged
users, like those with administrative privileges, are subject to access controls.
Least privilege lowers the risk of unintentional or malicious data leaks, either by internal
users or attackers using stolen credentials. As with micro-segmentation, no one canget everything.

8Security: Creating Trust in a Zero Trust WorldTo enforce least privilege/conditional access policies and effectively micro-segment, theenterprise needs to assess its data and data management policies in detail. Data must
be classified based on considerations like role access, risk tolerance, data sensitivity
and regulatory requirements.
Questions to ask in this exercise include: What data is sensitive to my organization?
Where is this sensitive data located? What devices possess sensitive data and how
can we keep a closer watch on them? Is there a system in place to alert the security
team when sensitive data changes locations? Who needs to have access to this data?
Are unauthorized users accessing this restricted data or storing it where it should not
be stored?
Segmenting like this also helps companies comply with increasing regulations for issues
like data privacy and data retention.
Assessing which obligations apply to the enterprise is a serious undertaking, given thecomplexity of evolving industry, regional, and international regulations as well as theharms of non-compliance. The costs of non-compliance (litigation, fines, stock drops,
loss of customer trust, etc.) far outweigh the costs of putting the necessary policies,
technologies and staff in place to ensure proper security and governance. This is true
across the board, but especially for industries like financial services, healthcare andgeneral government sectors that handle large quantities of sensitive data—a prime
target for cybercriminals.
As the amount of data collected has skyrocketed, so have laws about data retention anddisposal. Zero Trust helps the enterprise identify which data can be deleted and when,according to regulations for the defensible disposition of electronic data. Deleting datathat the organization is no longer obligated to retain also reduces the volume of datathat is vulnerable to attack. Less data means less risk.
Because perimeter-focused security policies have failed to protect enterprise data,
security professionals are losing the battle of protecting their networks, devices, apps
and people. The mindset of Zero Trust is data-centric “defense in depth.” It solves
cybersecurity problems by following the data, no matter where it travels.
Figure 7:
Defense in Depth

PolicyManagement

MissionCritical Assets

Operations

Fortunately, as enterprises weave cloud into their technology stack, Zero Trust
infrastructure becomes easier to deploy. Cloud has better visibility on endpoints, traffic,
users and data than legacy infrastructure. It also scales and updates more easily, lending
itself to micro-segmentation.
As with anything worth doing, implementing Zero Trust poses challenges.
9

Obstacles to Implementing Zero Trust
Although a Zero Trust approach is becoming necessary to combat growing
cybersecurity threats, transitioning is not always easy for the enterprise.
Overcoming Legacy Systems and Technical Debt
Most enterprise technology environments carry the burden of legacy applications,networks and protocols that were not built with agility or today’s needs in mind.
Reworking these systems takes significant effort, resources and investment—and
typically the older they are, the more of this “technical debt” they have accrued.
Looking specifically at cybersecurity needs, most legacy enterprise applications haveno concept of least privilege. For example, many legacy authentication models provide
single sign-on, which falls short of the Zero Trust standard. They cannot layer with othertechnologies, like IAM or endpoint security.
As another example, peer-to-peer (P2P) technologies popularized in the late 1990s
also tend to operate counter to Zero Trust. In Windows 10—used by most enterprise
workforces—P2P can allow unauthorized lateral movement that can expose sensitive
data, unless Windows Update sharing is turned off.
Mesh network technology relies on P2P communications, making it another potential
weak spot. Its trust model is based on keys or passwords; it does not have the ability for
dynamic Zero Trust authentication. As the latest breaches have made clear, protectinguser access to enterprise environments with keys or passwords alone is doomed to fail.
It is too easy for bad actors to get past these protocols and gain unlimited access.
Overcoming these legacy challenges requires investment in new technologies and atechnology partner that can help create and deploy a true Zero Trust strategy.

Lufthansa Systems

Leading airline IT provider Lufthansa Systems, a subsidiary of Lufthansa, is oneof the world’s leading providers of IT services in the airline industry. They deliver
innovative IT products and services to more than 350 customers worldwide. With
growing demand for air travel, limited airspace capacity and ever-increasing costs,
optimizing flight operations is a critical priority for airlines today. In response,
Lufthansa Systems designed the Lido portfolio of flight planning solutions, pilot
solutions and data solutions to help airlines improve operations. These products
provide integrated optimization in real time for flight dispatchers and crews, fromflight planning and execution to flight completion, while enhancing the safety of
every flight.

10

Security: Creating Trust in a Zero Trust World

Recently, the organization needed to replace its client access system for theroughly 4,000 users at 110 airlines who need to securely and reliably access the
Lido applications. With focus on operational stability, they needed the migrationfrom their legacy system to be seamless, so that it would not impact users.
As a result, Lufthansa Systems selected OpenText Exceed TurboX for centralizedadministration, robust security and solution stability. Exceed TurboX has delivered
important benefits behind the scenes at Lufthansa Systems, including robust
security, solution stability and valuable administrative abilities. In addition, Exceed
TurboX provides strong security on several levels to protect the system frominternal and external attacks. Keeping core applications in a central data center
ensures there is no unauthorized access and strong encryption is used for the data
traffic between the client browser and the Exceed TurboX web server, as well as forthe screen content stream between a node and the client.

Endpoint Explosion and the Internet of Things
The attack surface has grown, largely because of the rapid surge in endpoints andthe IoT. IoT is a major consideration for industries that already use a huge number ofconnected devices in their daily environments, as well as industries where this change
is imminent.
Healthcare is one such industry, with over 100 million IoT devices around the world.15
In the U.S., every hospital bed has 10 to 15 connected devices; yet, hospitals have losttrack of about 30% of their devices, leaving them open to cyberattack.16
With so many endpoints to consider, migrating to Zero Trust can be daunting. But thislarge attack surface is precisely why these environments must be secured with Zero
Trust technologies.
Enterprises tackling endpoint explosion can look to the cloud as a Zero Trust ally.
Critical data can be taken off the endpoint and put in the cloud. Bad actors cannot get
information from the endpoint if it is not there to begin with. Connecting to the cloud
can also replace connecting to headquarters (e.g. for remote employees), providing
better protection and visibility into traffic. Through cloud, Zero Trust can be enforced
without inserting a firewall in front of every resource. This approach simplifies thearchitecture and reduces the opportunity for attack. And don’t overlook the value ofa Layer 7 solution, which enables administrators to understand and control the who/
what/where/when/why/how of access to a cloud environment.
Regulatory ComplianceIndustry regulations create more obstacles for Zero Trust deployment.
Privacy, retention and enterprise data governance regulations lay down limits on how
data flows, how it is shared and how it should be protected. New requirements areconstantly emerging as legislators and other stakeholders struggle to keep pace withthe latest fourth industrial revolution trends and technologies—and the enterprise must
keep up too.

11

One major example is the General Data Protection Regulation (GDPR) of 2016. Any
corporation doing business in the EU or that has EU persons’ data in its possession
needs to comply with stringent GDPR privacy requirements—like disclosing privacy
breaches to impacted individuals within 72 hours of identifying the breach, a turnaroundtime that many organizations struggle with. Non-compliance with the GDPR results inheavy fines.
The Health Information Portability and Accountability Act (HIPAA) is another important
regulation, which applies to organizations doing business in the U.S. The healthcare
industry collects a lot of sensitive personal data about nearly everyone, making it a big
target for cybercriminals. HIPAA outlines restrictions on the use and disclosure of healthinformation, to maintain high data privacy and safety standards across the industry.
Every healthcare organization must have a dedicated privacy official responsible foradhering to HIPAA in collaboration with the Chief Information Security Officer (CISO) andlegal counsel.

OCHIN
OCHIN, one of the largest, most successful health information networks in the
United States, supports more than 500 organizations and 10,000 clinicians who
serve more than 37 million patients nationwide. OCHIN’s members use fax as partof their regular patient information exchange process, especially for services thathaven’t yet caught up with common electronic health record (EHR) data-sharing
technology or are on an external system.
Fax system inefficiencies, health information security concerns and rising costs
resulted in organizational challenges and didn’t reflect the best standards inpatient care. To address these challenges, OCHIN sought a secure, centralized
fax solution that would integrate with its existing EHR. As a result, they decided
to deploy OpenText™ RightFax™, a centralized fax server solution for powerful,secure and compliant faxing capabilities across an entire health organization. As
a result of this deployment, OCHIN and its member clinics have seen improved
operational performance, enhanced productivity and security, reduced costs andincreased integration. By automating the exchange of fax information directly into
the EHR, RightFax accelerated the flow of information to health care providers on
OCHIN’s system.
The financial industry is also a top target for cybercriminals. The Payment Card Industry
Data Security Standard (PCI DSS) addresses the protection of credit cardholder data.
The requirements are applicable to all system entities and components involved in
Cardholder Data Environment (CDE)—that is, users, process workflows, and networkor system devices that store, process and transmit cardholder or authentication
data. Given the complexities of the PCI DSS, the enterprise needs to enlist its legal,
information security, IT, risk, and operations teams to make sure that all angles
are covered.
12Security: Creating Trust in a Zero Trust World

Twelve Requirements for PCI DSS Compliance1

Install and maintain a firewall configuration
to protect cardholder data.

3

Protect stored cardholder data.

5

Protect all systems against malware and regularly
update antivirus software or programs.

7

Restrict access to cardholder data bybusiness need to know.

9

Restrict physical access to cardholder data.

11

Regularly test security systems and processes.

2

Figure 8:
PCI DSS Requirements

Do not use vendor-supplied defaults for system
passwords and other security parameters.

4

Encrypt transmission of cardholder data
across open, public networks.

6

Develop and maintain secure systems
and applications.

8

Identify and authenticate access tosystem components.

10

Track and monitor all access to network
resources and cardholder data.

12

Maintain a policy that addresses information
security for all personnel.

These are just a few of the regulations to be aware of when conducting business intoday’s digital economy. Each industry, region and country has its own set of regulations
and standards that must be followed.
And it is not only your company that must be compliant. Businesses working with noncompliant third parties can be liable for damages along with the at-fault company. To
protect the enterprise and its customers, every third-party vendor’s privacy, risk andcompliance programs must also be vetted.
The enterprise needs technologies that enforce governance and regulatory compliancepolicies from end-to-end and that can be updated as new standards emerge.
Such technologies protect the enterprise before an issue arises, falling under the
category of proactive Zero Trust technologies.

13

Proactive Security Technologies
In the Zero Trust model, nothing is more important than proactively safeguarding
enterprise data. Fortunately, many technologies exist to do just this.
Zero Trust technologies must work closely together to offer full coverage from threats.
While they can be broken out individually, a true Zero Trust solution requires an intricate
web of protection, arranged strategically for the enterprise’s unique needs across all
attack vectors.
Figure 9:
Top Security Technologies—Proactive

Cloud Workload
Security

Cloud Security
Gateway

DDos
Mitigation

Email
Security

Encryption

Endpoint
Security

IAM

Microsegmentation

MobileSecurity

Network Security
Policy Management

Next Generation
Firewalls

Risk Management& Compliance

Threat Intelligence& Detection

Two-Factor
Authentication

Web-Application
Firewalls

Cloud Workload Security
Cloud workload security technologies protect workload execution in Infrastructure-as-aService (IaaS) and Platform-as-a-Service (PaaS) environments. These solutions provide
automated and layered controls to secure the configurations, network, applications andstorage of hybrid cloud hypervisors and workloads.
Cloud Security Gateway
This technology provides visibility into how data moves to and from cloud services. It
also enforces usage policies to cloud traffic and data by applying a proxy. Cloud security
gateways reduce operational and investment costs while increasing business agility.
DDoS Mitigation
A distributed denial-of-service (DDoS) attack overwhelms a targeted system by flooding
it with traffic and requests from multiple sources, making it unresponsive to its intended
users. This type of cyberattack is carried out by machines or “bots.”
DDoS mitigation solutions drop the bad traffic before it affects end user experience.
For industries that rely on significant revenue from ecommerce or online transactions,
DDoS mitigation technologies are essential. They ensure customer-facing sites andapplications are resilient and protect revenue-generating transactions.

14Security: Creating Trust in a Zero Trust World

Email Security Technologies
This is particularly important because of the trend to migrate from self-managed onpremises email to cloud email, such as Office 365. Email security technologies generally
include anti-spam, anti-phishing, anti-malware (including ransomware), data leakprevention and encryption techniques. These solutions also monitor outbound email
traffic to thwart data loss and encrypt sensitive data.
Encryption
Encryption is a must. It is one of the most effective implementations of data security
to prevent theft and protect privacy. Through a secret key known only to the intended
recipient, encryption renders data unreadable to unauthorized parties.
Endpoint Security
Endpoint security solutions protect endpoint devices like laptops, mobile phones, IoT
devices and servers. Deploying endpoint security is one of the most practical ways toenforce Zero Trust measures—including least privilege policies, user access control, andlocation and traffic monitoring.
Endpoint detection and response (EDR) is an important subset of endpoint security
that should be implemented on all enterprise endpoints to monitor for threats. Once a
threat is detected, this technology alerts the cyber security team, isolates the endpoint
and remediates it, returning the IT environment to a trusted state. EDR is the last line ofdefense against digital theft. It focuses on uncovering and remediating issues before
they escalate into more intrusive data breaches.
This approach to protecting endpoints eases the burden on the security team to track,
detect and respond to threats. By alerting the team to the most relevant and criticalsecurity information first, and automating manual and repetitive tasks, security teams
can use their resources where it matters most.
Identity and Access Management (IAM)
Figure 10:

IAM

Customers

Devices

Everything Needs an Identity

Corporate
apps

Businesses•

Digital profiles•

Authorizations••

Relationships
Lifecycle

Cloud
apps

Partnerapps

IAM manages all digital identities that request access to enterprise systems andapplications, a key principle of Zero Trust. It centralizes and automates the governanceof the identity lifecycle. And by increasing transparency and limiting access to sensitive
data and apps, security teams can prevent incidents (or, limit the damage causedby them).
15

IAM technology is comprehensive. It provides role management and access governanceto enforce least privilege, identity administration self-service, separation of duties,
remediation, access request management, and compliance and audit support.

Auto Club GroupThe Auto Club Group (ACG) – the second largest AAA club in North America – hasselected OpenText to support a unified identity and access management solution
for their 9 million members.
Using the OpenText Covisint platform, ACG can create a single digital member
identity across all business units to reduce complexity, increase security, andstreamline the digital experience for customers. OpenText Covisint provides theleading IoT and identity platform for digital business transformation. Working
with ACG to create a single digital member identity will support ACG’s strategic
digital program objectives, including improving the overall user experience for theorganization’s AAA customers.
As organizations embrace digital transformation, identity and access management
becomes essential for connected experiences. By securely connecting
ecosystems of people, systems and things, companies like ACG can enable
new service offerings, optimize operations, develop new business models, andultimately, enable the connected economy.

Micro-segmentation
Micro-segmentation solutions subdivide networks into secure enclaves where
granular security can be applied to data based on its sensitivity and value. This
technology prevents attackers and insiders from moving across data centers and cloud
deployments, limiting the impact of a breach to only the compromised segment.
Micro-segmentation is essential for an identity- and data-centric Zero Trust
security model.
Mobile Security Suites
Mobile is here to stay. To keep environments secure, the enterprise must defend against
mobile threats such as jailbroken devices, vulnerable software and sensitive data that
could be traveling through unencrypted channels.
Mobile security applications protect devices, data and apps, making it easier for theenterprise to manage mobile holistically. They also increase visibility and help enforce
compliance with corporate policies.

16Security: Creating Trust in a Zero Trust World

Network Security Policy Management
Most network device configurations have old, unnecessary and sometimes conflicting
rules that impede device performance and provide bad actors with attack avenues.
Network security policy management technology tackles this problem by automating
network device configuration tasks, keeping everything up to date as security teams
add new rules to support business processes.
Next Generation Firewalls
These multi-purpose security solutions replace standalone appliances for firewalls,
intrusion prevention systems (IPS) and other security controls. With a hardware-based
approach, they create micro-perimeters in Zero Trust network architecture design. By
combining core security technologies with other functionalities into a single solution,next generation firewalls significantly simplify network architecture and management,along with reducing the cost of managing multiple security appliances.
Risk Management and Compliance Software
The amount of data stored by the enterprise has exploded exponentially, with new data
constantly introduced. This data must be classified and tracked, for both complianceand security purposes.
Records, data governance and data remediation technologies are therefore among the
top proactive measures that organizations can take. Risk management and compliancesoftware is designed specifically to identify, classify and remediate sensitive data acrossthe enterprise. It allows the enterprise to repeatably and defensibly manage the data
lifecycle from collection to disposition.
Threat Intelligence and Detection Software
To sniff out external attack attempts, lurking bad actors and insider threats, threat
intelligence and detection software analyzes behavior in real time. This software canstop an attack before it happens by flagging suspicious activity, blocking malicious
inbound traffic and phishing attempts, and staying ahead of the latest malware. Whenthe software finds an issue, the Zero Trust security environment can be immediately
hardened against the threat.
Figure 11:

Insider Threats
Downloading
substantial
amounts of data
to external drives

Monitoring Insider Threats
Installing
unapproved
softwareWatch out for these
suspicious behaviors

Accessingconfidential data
not relevant to auser’s role
Frequently
accessing theworkspaceoutside of normal
working hours

Requests forclearance orhigher-level accesswithout need

Excessive useof printers andscanners

Attempts to
bypass security
controls

Emailing
sensitive
information toa personalaccount17

Two-Factor Authentication
Because passwords are not secure enough in today’s cybersecurity landscape, twofactor authentication is a must-have. Offering substantially stronger protection thanpasswords alone, it should be used to safeguard critical data and applications, prevent
data breaches and ensure audit compliance.
Some of the options for two-factor authentication include: physical biometrics (finger,
face and voice), behavioral biometrics, software and hardware tokens, push notifications,
one-time passwords (OTPs) and certificate-based authentication.
Web-Application Firewalls
A web-application firewall detects and blocks attack attempts from web applications.
Applying security policies based on attack signatures, protocol standards and anomaly
detection, it protects against basic bots, DDoS, Layer 7 attacks and data leakage.
This technology can also satisfy regulatory compliance requirements, provide layered
protection and defend zero-day vulnerabilities (weaknesses that have been found but
not yet patched) until the environment can be strengthened against them.

Mastercard

Mastercard, a technology leader in global payment industry, has partnered with
OpenText to help companies increase financial efficiencies across global supply
chains, starting in the automotive industry. Given that B2B has become a hugepriority for the company as it looks to expand services beyond credit cards,
Mastercard realized that payments is just one piece of the puzzle. There is often apatchwork of processes and lack of interoperability in the whole B2B space which
results in a lack of trust within the auto industry ecosystem.
The new solution from OpenText and Mastercard will streamline many of theoperations processes while providing peace of mind to business buyers. The
goal is to increase the speed, compliance and security for business information,
payments and financing in the automotive supply chain. It is designed to facilitate
integrated payments and to enhance the management of vendor master data,
enabling suppliers to better manage risk for trade finance, accelerate cash
flow for outstanding invoices and secure financial transactions with enhanced
digital identity. This collaboration further advances a connected and scalable
digital ecosystem, allowing companies, irrespective of size, location or technicalcapability, to build increased trust and security into trading partner relationships.

18

Security: Creating Trust in a Zero Trust WorldAs threats mount and enterprise environments become increasingly complex, proactive
security technologies are converging onto holistic security platforms—most notably, on
Endpoint Protection Platforms (EPP)—to ensure unified protection at a level impossiblefor distributed and federated systems. EPPs are emerging that integrate the most vital
Zero Trust technologies, including anti-malware, exploitation prevention, detection,
isolation, remediation and behavioral threat detection.
Detection

Isolation

Response

Privacy Management
Share with
Confidence
Forensics

Threat Hunting

Endpoint
Protection
Platform

Figure 12:
An Integrated Zero Trust
Security Platform

Threat IntelligenceContinuous
Monitoring
Data Protection

An ounce of prevention is worth a pound of cure—but it is still wise to have the cure athand. Likewise, the enterprise needs to be ready to respond to breaches if (and when)
they occur.

19

Reactive Security Technologies
Even in a Zero Trust environment, organizations should have strong reactive security
technologies. No matter how fortified a business is, new methods of breaking
through cybersecurity are concocted every single day. It is like playing whack-a-mole:cybercrime constantly rears its ugly head and sometimes it breaks through. When that
happens, organizations need to act fast. Decisively.
In the event of an intrusion, the enterprise needs technologies that can quickly isolate
the compromised data sources, execute all legal hold notice policies, and begin theforensic examination process to measure the depth and breadth of the breach.
Figure 13:

Top Security Technologies—Reactive

Digital Forensics& InvestigationeDiscovery

Digital Forensics and Investigation
Digital forensics software allows for discreet, off-the-network and forensically-soundcollection. It enables investigation, whether litigation, internal or in response to an
administrative proceeding.
To protect its value as evidence, organizations need to follow forensic investigatory bestpractices when collecting data, like avoiding altering the data, documenting everything,making forensic copies of all digital evidence as quickly as possible, and only reviewing
the evidence via these forensic copies. Whether working with a third-party forensic
expert or using internal resources, these precautions will lead to the best outcomes aswell as minimize allegations that evidence has been withheld, destroyed or altered (akaspoliation claim).
Figure 14:
Expand toadditonal exposed
entry points (IoT, cloudand identity)

Mitigate data
privacy, security
and compliance risks

Best-in-classdigital forensics

Investigate
everywhere

Protect the most
exposed entry point,
the endpoint

20

Digital Forensics

Security: Creating Trust in a Zero Trust World

Technologies evolve quickly. Cloud, virtual networks, BYOD, social media applications,
IoT, artificial intelligence… the list goes on. On top of this technological quagmire,
add the vast and growing amount of digital information. All of this complicates theidentification of relevant evidence, and the process of preservation and forensic
investigation. Investigators must have the tools to cover all devices and operating
systems, reach all data, and work discreetly and globally while ensuring a fast, efficient,repeatable and forensically-sound investigative process.
When assessing which security technologies to acquire, organizations should consider
software and hardware that will address the broadest array of applications and scenarios
within the business. The enterprise needs court-proven forensic collection tools builtwith the investigator in mind. It needs to reduce the window between incident detection
and remediation. It needs to be holistic, going both deep and wide to protect theenterprise’s most valuable assets.

Banner Health

Banner Health is one of the largest nonprofit healthcare systems in the U.S., withclose to 500 medical facilities across six states, including hospitals, urgent carefacilities and rehabilitation centers. In a single year, Banner Health sees more thana million emergency room visits, runs close to five million blood tests and delivers
more than 30,000 babies.
With both cybersecurity threats and litigation on the rise, Banner Healthdetermined its existing systems could not meet the company’s increasingly criticalneeds and sought other methods to accelerate data security response. To support
the organization’s commitment to patient care, Banner Health made the decision toemploy OpenText EnCase eDiscovery and OpenText EnCase Endpoint Investigator.
This helped to accelerate their eDiscovery processes and data security byproviding the organization with a 360-degree visibility across all endpoints,
devices and networks to enable forensically sound data collection for litigation.
The automated EnCase eDiscovery solution allows the company to collect andpreserve potentially relevant data from multiple data sources, with a processthat ensures strict chain of custody and executes legal hold in a defensible
manner. In addition, EnCase Endpoint Investigator collects and analyzes datafor incident response and investigation. When a security alert is received, thesolution’s advanced digital forensic tools collects relevant data to quickly assess
the situation and respond accordingly. Automating and accelerating many timeconsuming processes, such as information collection, has enabled Banner Healthto significantly improve its efficiency across all fronts.

21

eDiscovery
Once the forensic collection process is complete, all potentially-relevant data must be
reviewed to find the answers to critical questions, such as: How did the breach occur?
What endpoints were compromised? What enterprise data was targeted and/or stolen?
Were data privacy laws violated, and if so, what notice requirements are triggered bythis breach?
This is the eDiscovery phase, and it broadly covers the data processing, document
review and analysis, and production stages.
Figure 15:

Information
GovernanceUni

fi e d G ove r n a n ce
B u s in e s s

l

Lega

lic

y I n t e g ra t ionvacy &Pri curity
Se

Po

o
Pr
co
Re rm
o g
Inf na
Ma

ce

ss

cy

Data
Lifecyclera ds
em tioen ntElectronic Discovery Reference Model17

Tr a n s p a r

enProcess
Preserve
Identify

Review

Produce

Present

Collect
AnalyzeIT

VOLUMERELEVANCEThe goal is to determine, out of all the data collected during forensics, what must be
produced to investigators (internal, external, law enforcement or administrative) or
opposing counsel as a result of a breach. The process includes a data reduction step
where the data population is reduced by date range, key custodians and keyword
search terms into a smaller set of potentially-relevant information (most often emails,
e-documents, etc.).
The best eDiscovery technologies include AI-driven analytics and automation that canhelp to intelligently extract, organize and narrow down the huge volume of documents tojust those that are meaningful. This data is then put into a document review application
so that legal teams, both internal and external, can easily review it.

22

Security: Creating Trust in a Zero Trust World

Serious Fraud Office

The Serious Fraud Office (SFO) leads the UK’s fight against serious and complex
fraud, bribery, and corruption. Its investigations cross international borders, involve
multi-million-pound (GBP) losses and huge volumes of data and correspondence
across all document types to determine if criminal activity has taken place.
The SFO uses OpenText Axcelerate and OpenText EnCase to achieve nextgeneration, forensically-sound, AI-driven investigations. OpenText’s visualized
data analytics and predictive coding help the SFO’s multi-disciplinary caseteams tackle exponentially growing data volumes by automating key aspects of
document analysis, enabling them to expedite investigations efficiently with limited
resources. The SFO is leading the way in the use of digital technology for criminal
investigations and considers OpenText their most important technology partner
moving forward.

The enterprise needs a good defense and a good offense in the war against cybercrime.
Especially when the battlefield is changing all the time.

23

The Only Constant Is Change
Cybersecurity will never stand still. As technology becomes more sophisticated, so do
threats. Risk escalates in lock-step with the amount of data that needs to be protected—
and today we are creating more information than we ever have before. And, less than weever will again. The attack surface is growing and changing every day.
Consumers have already embraced the cloud, using it to store data about their entire
lives—including their most sensitive personal information. Businesses, although slower
to adjust, are also adopting the cloud en masse. Ninety-four percent of enterprises use
at least one cloud service, and within a year, 83% of all enterprise workloads will be in
the cloud.18 While the cloud has disrupted traditional cybersecurity, it has great ability toenable Zero Trust security in the information era.
Only in the cloud can big data and analytics be leveraged over huge networks of
endpoints to predict and manage threats in real time. Only the cloud can be updated
effortlessly and automatically with the latest security upgrades, keeping it a step ahead.
The more pervasive cloud becomes, the better it can mobilize to confront threats assoon as they are discovered. Consider an extensive cloud infrastructure that predicts athreat, isolates it before it can do any harm, then immediately updates itself to protect
every customer organization against similar threats. This will be completely automatic,
happening with the speed and scale required to compete in an environment of machines
versus machines.
Data is moving fast (and faster still) within the cloud, through machine-to-machine (M2M)
communications and between endpoints. 5G is coming and it will bring with it a wave of
new devices that will be able to transmit and receive information with unprecedented
density, speed and efficiency. 4G was designed for humans; 5G is designed formachines. At today’s 22 billion devices, we are only seeing the beginning of the Internetof Things. By 2025, that number will almost double to 41.6 billion.19 20 The IoT and 5G will
dramatically shift the world’s infrastructure to connect everyone and everything. The
impact on the cybersecurity landscape will be enormous.
45000

Figure 16:

40000

IoT Will Change the World
within Five Years

35000

Millions

30000
25000
20000
15000
10000
5000
0
2007

2009

2011

2013

2015

2017

Enterprise IoT

24

2019

2021

2023

2025

Security: Creating Trust in a Zero Trust World

With 5G speed and the sheer volume of connected devices in the IoT, it is obvious thatboth legacy systems and human oversight will be (and already are) utterly inadequate.
Machine-speed attacks are increasing and cannot be stopped with human-dependent
defenses. Enter: artificial intelligence. AI and machine learning can analyze big
data from across the enterprise in real time, recognize patterns, make predictions
and automatically respond to deviations and threats. Businesses are taking note.
Eighty-three percent of organizations in the U.S. believe that they will not be able
to stop cyberattacks without AI.21 As machine learning becomes more integrated
in cybersecurity defenses, it will become smarter and smarter in identifying andresponding to threats.
Moving further into the future, the impact of quantum computing cannot be overstated.
Quantum will change the game yet again. Today’s encryption standards—2048-bit RSA
encryption—would take the world’s current computing power, working together, millionsof years to break. In all practicality, this encryption is currently unbreakable. However,quantum computing operates according to different rules. In about 25 years, there will
be a quantum computer that can break the encryption in only eight hours.22 What does
this mean for cybersecurity? We will need new information security standards using
post-quantum codes that cannot be cracked by quantum computers.
Cybersecurity will continue to evolve with the technology. To handle tomorrow’s threats,
security technologies are becoming integrated, converging on solutions like Endpoint
Protection Platforms. The enterprise cannot afford to let its security infrastructure
lag behind.
Figure 17:

DigitalForensics

SIEMs

EDR

BinaryAnalysis

Converged Security Platform

Endpoint
Management

DLP
EPP

ThreatIntelligence

Vulnerability
Assessment

Endpoint
Protection
Platform

Consider the adage: “You can’t step in the same river twice.” The Zero Trust
cybersecurity environment is like a river—with a constant ebb and flow of new threats,changing data formats, evolving compliance requirements and emerging technologies
altering the ecosystem with every passing moment. There will never be a point in time
when we can say: “That’s it. Our information is secure. We are done.”
Organizations need to act. They can protect themselves by staying current andchoosing technology partners with best-in-class holistic security solutions. To succeed,change must be embraced. That means taking cybersecurity seriously and committing
to continuous improvement. It means being proactive. It means fighting machines withmachines. It means implementing a Zero Trust infrastructure. It means jettisoning old
ways of thinking.
Zero Trust security is not just a new set of policies and technology deployments. It is a
new paradigm for approaching the protection and governance of the enterprise’s mostvaluable asset—information.
25

Endnotes
 ick Statt, “Under Armour says 150 million MyFitnessPal accounts
Ncompromised in data breach,” The Verge, March 29, 2018,https://www.theverge.com/2018/3/29/17177848/under-armourmyfitnesspal-data-breach-150-million-accounts-security (accessed
November 2019).

1

2

 udy Greenwald, “Direct cyber incident losses from Marriott breachJ
up to $600M: AIR,” Business Insurance, December 18, 2018, https://www.businessinsurance.com/article/20181218/NEWS06/912325732/
Direct-cyber-incident-losses-from-Marriott-breach-up-to-$600million-AIR-Worldwi (accessed November 2019).

3

 ussel Brandom, “Facebook hacker accessed personal details for 29
Rmillion accounts,” The Verge, October 12, 2018, https://www.theverge.
com/2018/10/12/17968302/facebook-hacker-personal-details-29million-accounts (accessed November 2019).

4

 avey Winder, “FBI Issues ‘High-Impact’ Cyber Attack Warning—What
D
You Need To Know,” Forbes, October 3, 2019, https://www.forbes.
com/sites/daveywinder/2019/10/03/fbi-issues-high-impact-cyberattack-warningwhat-you-need-to-know/#79bb2fea40af (accessed
November 2019).

5

 elly Bissell, Ryan M. Lasalle and Paolo Dal Cin, “Ninth Annual Cost ofK
Cybercrime Study,” Accenture, March 6, 2019, https://www.accenture.
com/us-en/insights/security/cost-cybercrime-study (accessed
November 2019).

6

 amantha Ann Schwartz, “Data breaches up 54% YOY, 2019 set toS
be ‘worst year on record’,” CIO Dive, August 21, 2019, https://www.
ciodive.com/news/data-breaches-up-54-yoy-2019-set-to-be-worstyear-on-record/561359/ (accessed November 2019).

 ennifer Adams, “Security Outlook 2019: Modest Growth, But SomeJ
Sectors Will See Double-Digit Increases,” Forrester, June 18, 2019.

78

 arry Ponemon, “What’s New in the 2019 Cost of a Data
L
Breach Report,” Security Intelligence, July 23, 2019, https://securityintelligence.com/posts/whats-new-in-the-2019-cost-of-adata-breach-report/ (accessed November 2019).

9 eera Narendra, “Human error remains the main cause of dataM
breaches,” PrivSec Report, June 20, 2019, https://gdpr.report/
news/2019/06/20/human-error-remains-the-cause-of-databreaches/ (accessed November 2019).
“ Strategy Analytics: Internet of Things Now Numbers 22 Billion
Devices But Where Is The Revenue?” Strategy Analytics, May
16, 2019, https://news.strategyanalytics.com/press-release/iotecosystem/strategy-analytics-internet-things-now-numbers-22billion-devices-where (accessed November 2019).

10 atemeh Khatibloo, Heidi Shey, Enza Iannopollo and Stephanie Liu,F
“Predictions 2020: Privacy And Data Ethics,” Forrester, October30, 2019.

1112

 eyan G., “41 Stunning BYOD Stats and Facts to Know in 2019,”
D
TechJury, April 17, 2019, https://techjury.net/stats-about/byod/(accessed November 2019).

13

 hase Snyder, “What Is Dwell Time in Cyber Security?” ExtraHop, MayC21, 2019, https://www.extrahop.com/company/blog/2017/dwell-timenew-security-metric/ (accessed November 2019).

14

 eera Narendra, “Human error remains the main cause of dataM
breaches,” PrivSec Report, June 20, 2019, https://gdpr.report/
news/2019/06/20/human-error-remains-the-cause-of-databreaches/ (accessed November 2019).

15

 tatista Research Department, “Estimated healthcare IoT deviceS
installations worldwide from 2015 to 2020,” Statista, May 26,
2016, https://www.statista.com/statistics/735810/healthcare-iotinstallations-global-estimate/ (accessed November 2019).

16

 eljka Zorz, “Healthcare’s blind spot: Unmanaged IoT andZ
medical devices,” Help Net Security, July 22, 2019, https://www.
helpnetsecurity.com/2019/07/22/healthcare-iot/ (accessed
November 2019).

“ EDRM Model,” EDRM, https://www.edrm.net/resources/frameworksand-standards/edrm-model/ (accessed November 2019).

17“ Cloud Adoption Statistics for 2019,” HostingTribunal.com, https://
hostingtribunal.com/blog/cloud-adoption-statistics/ (accessed
November 2019).

18“ Strategy Analytics: Internet of Things Now Numbers 22 Billion
Devices But Where Is The Revenue?” Strategy Analytics, May
16, 2019, https://news.strategyanalytics.com/press-release/iotecosystem/strategy-analytics-internet-things-now-numbers-22billion-devices-where (accessed November 2019).

19“ The Growth in Connected IoT Devices Is Expected toGenerate 79.4ZB of Data in 2025, According to a New IDC
Forecast,” IDC, June 18, 2019, https://www.idc.com/getdoc.
jsp?containerId=prUS45213219 (accessed November 2019).

20

 on Tolido, Anne-Laure Thieullent, Geert van der Linden, et al.,R
“Reinventing Cybersecurity with Artiﬁcial Intelligence,” Capgemini
Research Institute, July 2019, https://www.capgemini.com/wpcontent/uploads/2019/07/AI-in-Cybersecurity_Report_20190711_
V06.pdf (accessed November 2019).

21“ How a quantum computer could break 2048-bit RSA encryption
in 8 hours,” MIT Technology Review, May 30, 2019, https://www.
technologyreview.com/s/613596/how-a-quantum-computercould-break-2048-bit-rsa-encryption-in-8-hours/ (accessed
November 2019).

22

Security: Creating Trust in a Zero Trust World

OpenText Locations
AMERICAS

EMEA

Canada:Austria:••••

Ontario - Ottawa
Ontario - Richmond Hill
Ontario - Waterloo
Quebec - Montreal

USA:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

Arizona - Scottsdale
Arizona - Tucson
California - Irvine
California - Pleasanton
California - San Mateo
California - Santa Barbara
Colorado - Denver
Florida - Tallahassee
Florida - Tampa
Georgia - Alpharetta
Kansas - Overland Park
Kentucky - Lexington
Maryland - Gaithersburg
Massachusetts - Boston
Michigan - Southfield
New Jersey - Tinton Falls
New York - Latham
New York - New YorkNew York - Rochester
Ohio - Hilliard
Tennessee - Brentwood
Texas - Austin
Texas - Dallas
Texas - San Antonio
Utah - Draper
Virginia - Arlington
Washington - Seattle• Klagenfurt• WienCzech Republic:• Prague

Finland:• Helsinki• Tampere

France:• ParisGermany:
•
•
•
•
•
•
•
•
•
•

Düsseldorf
Frankfurt
Hamburg
HannoverHürth-Efferen
Kempten
Konstanz
Munich (Grasbrunn)
Oldenburg
Rheinbach

United Arab Emirates:• Dubai, UAE

United Kingdom:••••

LondonPrestonReading
St. Albans

APJ
Australia:• Melbourne• Sydney

Greater China:••••

Beijing
Guangzhou
Hong Kong
Shanghai

India:• Cork• Bangalore• Hyderabad• New Delhi

Italy:

Japan:• Rome, IT

Netherlands:••••

Amstelveen
Hoofddorp
PuttenRotterdam

Poland:Mexico:Russia:• Mexico City

• Baden

Ireland:

Brazil:• São Paulo

Switzerland:• Poznań
• Moscow• St. Petersburg

South Africa:• Johannesburg

Spain:• Tokyo• Osaka• Nagoya

Korea:• Seoul

Malaysia:• Kuala Lumpur

New Zealand:• Wellington

Philippines:• Manila

Singapore:• Singapore• Barcelona• Madrid

Sweden:• Gothenburg• Stockholm

27

Security: Creating Trust in a Zero Trust World

About OpenText
OpenText, The Information Company, enables organizations to gain insight through market leading information management
solutions, on-premises or in the cloud. For more information about OpenText (NASDAQ: OTEX, TSX: OTEX) visit opentext.com.

Contact
Sales
Email: sales@opentext.com
Partners
Email: partners@opentext.com
Media Relations
Email: publicrelations@opentext.com

opentext.com/contact

Copyright © 2021 Open Text. All Rights Reserved. Trademarks owned by Open Text.
For more information, visit: https://www.opentext.com/about/copyright-information • 09/21 | SKU18255