Tempered Networks’
New Identity Networking Paradigm
The Cure for IT Risk, Cost, and Complexity –unified secure networking made simple

Jeff Hussey
CEOAGENDA• A New Identity Networking Paradigm• Freeing IP from a role that was never meant - the cause of complexity, insecurity, cost, and inflexibility• Tempered Network’s Approach• An identity-first architecture with simple and instant policy orchestration• The Outcomes:• Accelerate provisioning by 97%. Reduce the attack surface by 90%. Reduce complexity and cost morethan 25%• Getting Started:• Simple and fast options to show Proof of Value (PoV)Tempered Networks’ Identity-Defined Network (IDN)
It’s never been possible, until now• Significant reduction in capex & opex
• Dramatically reduces business risk
• Simple and instant orchestration for
any connected “thing,” anywhere,anytime

ONE-CLICKSEGMENTATION: MICRO,
MACRO, CROSS-REALM

MOVE ANY IP RESOURCEGLOBALLY. NO CONSTRAINTS.

INSTANTLY CONNECT,DISCONNECT,REVOKENEW HOST IDENTITYNAMESPACEINSTANT VERIFIABLE
FAILOVER
CLOAK ANDENCRYPT• Unifies networking and security

3Reduce time to provision
AFTER
TEMPEREDBEFORETEMPERED
Week 7

GO LIVE!

Week 6

Implementation Review andSign-Off by InfoSec

Week 5

Implementation of Design byNetwork Ops

Week 4

Approval of Designby InfoSec

Week 3

Design Submitted to InfoSec
for review and approval

Week 2

Secure networking
time reduced by

97%
Resource added with explicit
trust segmentation, cloaked
and encrypted communication.

Design for Routing, Firewall,
VPN, and Switching Policies

Deployed by NetOps and easily
Week 1

Ticket submitted to Network
IT for new resources addition
to corporate network.

GO LIVE!

Ticket submitted to Network
team for new resource.
InfoSec approved.

verified by InfoSec.

Day 14

Traditional Networking is Complex, Costly and Fragile

DataCenterUsersUsers

Gateway

Data Center

RemoteVendor“We didn’t focus on how you could wreck this (IP) system
intentionally… getting this thing to work at Remote
all was non-trivial.”
Vendor- Vint Cerf, Washington Post, November
2016
Switch Block
IT Intranet

IT Intranet

IT Intranet

RemoteWorkerCorporate
Network

RemoteWorkerData Center

Site 1

Data Center
Site 15

Flawed identity, only complexity. Unsustainable.
Network and Security Policies
USE IP ADDRESSES as IDENTITY
DNS and routing
updates for failover

Routing policies,
VLANs andACLS overhead

Complex firewall andnetworking rule sets

VPN access
controls for each
network

100%
Use IP addresses as identity for policy–
This is the root cause of complexity,
network security vulnerabilities, poor segmentation,and lack of mobilityn(c n x r ) x p i = y*… per networked “thing”(clients x resources) x (net & sec policy) x updates = complexity*Inspired by, “An Attack Surface Metric,” Dr. Pratyusa K. Manadhata, Member, IEEE, and Dr. Jeannette M. Wing, Fellow,IEEE, IEEE Transactions on Software Engineering, 20106

A new Identity Networking paradigm is required
Internet 2.0 –“Network everything”

Internet 3.0 –“Network ONLY CRYPTO-IDENTIFIED things”

Application (L5-L7)

IP Address: Port

Application

Host Identity Tag: Port

Transport (L4)IP Address: Port

Transport

Host Identity Tag: Port

Network (L2-L3)

IP Address

Link (L1)

MAC address

To a secure,mobile andprivate Internet

Host Identity

Host Identity
Protocol (HIP)

NetworkIP Address

Link

MAC addressIdentity-Defined Networking (IDN) – the way forward
Securely network and orchestrate any thing, anywhere, anytime - instantly.
Tempered Networks’ IDN Conductor
Control based on unique crypto-identity for every networked thing. Seamless deployment, simple policy
orchestration and enforcement based on identity. Securely connect, cloak, segment, revoke, move,
failover and revoke instantly within the IDN’s encrypted fabric.

HIPservers

HIPclients

HIPchip
PoS / ATMs

Applications
Databases
Containers
Cloud workloads

HIPswitch

IP cameras
Medical devices

IDN Fabric – Trusted. Cloaked. Segmented. Encrypted.
Public / Corporate Network (No Identity. Untrusted. Unmanageable.)8Flexible and Pervasive: Identity-Defined Networking
Solution
Tempered’s HIP Services/ IDN Endpoints

The IDN ConductorArchitecture

Any networked thing can be joined to the IDN’s secure and mobile fabriccreating a unified and common architecture spanning nearly all environments.

9Unique Identity-Defined Overlays (IDO) and Virtual Trust Segments (VTS):Macro and micro-segmentation is based on unique host identity and every IDO is cloaked and hardened.
Allowed VTS connectivity and communication is explicit, non-traversal, encrypted and verifiable
Corporate Network
Cloud ID Overlay
DBA Admin
VTSVendor / 3rd PartyID Overlay

DBAs
Building Automation
Vendor VTS

BuildingAutomation
SystemDatabases

Remote Employee
ID Overlay

Unmanaged
Network

Managed Device VTS

PublicCloud-US

Application-Database
ID Overlay

U.S. DevOpsVTS

Web Services
VTS

PublicCloud–DE

EU DevOps VTS

PublicCloud–KR

Korea DevOps VTS

IoT ID Overlay

Applications

Managed Devices

IoT Admins
VTS

IoT Virtual Trust Segments

Telemetry/Analytics VTS

Employee
ID Overlay

10The New Identity Networking Paradigm
Driven by Outcomes
Reduce networking
and resource
provisioning timeup to:

Increase in networkand security teamproductivity

Decrease IT
CapEx and OpEx
costs up to:

Make 100% of yourconnected IP
resources invisible

97%25%

25%

100%

Reduce attack
surface up to:

Improve time tomitigation, revocation,and quarantine up to:

90%

50%

Decrease failoverand disaster recovery
times to as little as:

1Second11

Deploy anywhere – Create a Unified FabricConnect, protect, and disconnect any resource anywhere, anytime – instantly.
Any Environment
PRIVATE CLOUD
PUBLIC CLOUD

Any Connectivity Medium
Ethernet | Cellular | Wireless | Radio | Serial over IPENTERPRISE
NETWORKS

WAN & LANREMOTE LOCATI ONS

Available in Cloud or PhysicalAny Form Factor

12Use Cases“SEGMENTED (QUARANTINED)VENDOR NET”

“EFFORTLESS SEGMENTATION,ENCRYPTION, AND IP MOBILITY”“SECURE MACHINE TO
MACHINE COMMUNICATION”“NETWORK AND IP RESOURCE
CLOAKING”“NETWORK VIRTUALIZATION &ORCHESTRATION RAPID PROVISIONING”“CLOAK AND PROTECTLEGACY SYSTEMS”“INSTANT DISASTER RECOVERY,REVOCATION & QUARANTINE”

13Rapid Network Provision | Cloaking | Segmentation•Auto-discovered devices•Create trust relationships•Explicit segmentation, non-traversal•

Kiosks in Seattle are invisible to ATMsLondon•

No connectivity or communication
between any untrusted systems in theIDO

Dynamic Networking with Failover•

Global or “micro” failover•

Failover can happen < 1 sec btw DCs
or resources•

Overcomes DNS and routing
convergence limitations•

Host Identity Tag (HIT) can be bound toIP addressInstant Revocation and Quarantine•

Instantly isolate or revoke a device orsystem•

Avoid having to update VLANs, ACLs,VPN policy and cert management, FWpolicies

Corporate Network & Resources

The Singular Root DefectThat affects all IP security and networking

Device 10
192.168.10.10

IP Addresses are used as Network and Device Identity•Hacker reconnaissance & fingerprinting via TCP/IP stack•
Listening TCP/UDP service ports•
All networking and security products use IP addresses forpolicy

Device 12192.168.10.12

192.168.10.1

Large Attack Surface•
IP, TCP/UDP Attacks: every connected thing is an entry point•
East / West lateral movement•
ACLs and VLANs ≆ segmentation

WAN / LAN

Lack of Mobility and Instant Failover• Policies tied to IP - creates inflexible mobility• IP conflicts• DNS TTL and Routing Convergence Delays
Networking and Security Costs• Many distributed, complex VLAN, ACL, VPN,
firewall policies• Controlling network routing• IPsec VPN cert management, connection limitations,failover issues• Expense of “next-gen” firewalls deployed on interior

Device 11192.168.10.11

192.168.30.1

192.168.20.1
Field Technicians
Remote Employees

Device 20
192.168.20.20

Device 21
192.168.20.21

Remote Unmanaged Network

Device 30
192.168.30.30

Device 31
192.168.30.31

Device 32
192.168.30.32

Remote Site Managed NetworkHow we do what we do
SIMPLE POLICY-BASEDORCHESTRATION ENGINE

HOST-BASEDCRYPTOGRAPHIC IDENTITIESHOST IDENTITYNAMESPACE

IDENTITY-DEFINEDOVERLAYS

FAST, FLEXIBLE DEPLOYMENT OFIDN ENDPOINTS (HIP SERVICES)EVERYWHERE

SOFTWARE- DEFINEDSEGMENTATIONVIRTUAL TRUSTSEGMENTSCLOAKED, SEGMENTED & MOBILE
Corporate Network & Resources

A New Identity Networking Paradigm
Unique Host Identity Approach• Host Identity Protocol (HIP): IETF ratified April 2015
• True SDN overlay –little to no changes to network, security, orapplications• Unshackles IP from serving as identity - frees IT from complexity• In production since 2006

Device 11

Device 10

Made Simple

192.168.10.10

192.168.10.11

Conductor

Device 12192.168.10.12
HIPswitch
192.168.10.100

192.168.10.1

Rapid Provisioning, Revocation, IP Mobility and Failover• Effortless segmentation & cloaking• One-click orchestration to connect, disconnect, move or failover any“thing”• Less than 1 second failover between any IDN endpoint• Build ID overlays (IDOs) on-demand based on situation

10.0.9.2

WAN / LAN

192.168.20.1
Significantly Reduced Attack Surface• No trust? No connectivity. No communication. No data.
• VLAN ”segmentation” traversal is now impossible.
• Based on explicit device trust- all systems are invisible• 2048 bit Identity-Based connectivity, AES 256
encryption by default
Lower Costs, Simpler Environment• CapEx and OpEx decrease• Eliminate or reduce interior “next-gen” firewalls, VPNs,
complex policies, ACLs, VLAN complexity, cert mngt

Field Technicians
Remote Employees

192.168.30.1
192.168.30.100

HIPclient
Device 20
192.168.20.20

Device 21
192.168.20.21

PROTECTED, SEGMENTED,ENCRYPTED, & MOBILE

Device 32
Device 30
Device 31
192.168.30.30 192.168.30.31 192.168.30.32
Remote Site Networks & Resources

CLOAKED, SEGMENTED, & MOBILE

Conductor’s “Visual Trust Map” – Instant Verification
Visualize trust relationships
between HIP Services andwhitelisted endpoints

Availability, Status, Configurations, Versioning – Know the StateHIP Services:• Activity• Models• Versions• Static or dynamic config• Current IP address• Gateway• DNS server• Custom routes• Link status• Port configuration [ifavailable]

Users may now check which HIP
associations (secure tunnels) exist
on a HIPswitch and check available
bandwidth as well for availability andsizing understanding.

Connectivity State –Obtain Cellular Data, Check Availability of HIP Services

Reduce time to provision
AFTER
TEMPEREDBEFORETEMPERED
Week 7

GO LIVE!

Week 6

Implementation Review andSign-Off by InfoSec

Week 5

Implementation of Design byNetwork Ops

Week 4

Approval of Designby InfoSec

Week 3

Design Submitted to InfoSec
for review and approval

Week 2

Secure networking
time reduced by97%
Resource added with explicit
trust segmentation, cloakedand encrypted communication.

Design for Routing, Firewall,VPN, and Switching Policies

Verified by InfoSec.
Week 1

Ticket submitted to Network
IT for new resources addition
to corporate network.

GO LIVE!

Ticket submitted to Network
team for new resource.
InfoSec approved.

Day 1

23

Our Customers Increase Productivity
Because time to provisioning andattack surface is reduced…

25%
Increase in networkand security teamproductivity• They can now focus security efforts on what else really mattersinstead of managing certificates, complex FW rules, ACLs, andVLAN “segmentation” playing whack a mole.

• Greater focus on new network designs and policies that improve
quality of service, monitoring and uptime, not figuring out how toprovision new resources.

• Simpler and faster way to test and verify disaster recovery andfailover at a macro and micro-service level with minimal
disruption – no more 2 am change windows thank goodness.

24and Decrease IT Expenditures
Simplify, unify, replace, and reduce. Identity-defined networking (IDN) allows
better offloaded segmentation, connectivity, access, and encryption reducing
capex cost and complexity. Unconstrained provisioning, mobility, instantrevocation and failover lowers opex.
BEFORE TEMPERED

AFTER TEMPERED25%VPN
Router/Switch“segmentation” overheadInternal Firewall deployments“segmentation” &management
Server connectivity, controls,security, mobility, failover

IDN

Decreased IT CapEx
and OpEx costs

IDN Fabric25

Cloaking makes 100% of Connected IP Resources Invisible
BEFORE TEMPERED

AFTER TEMPERED

IT Intranet

RemoteWorkerCellularNetwork•

No other solution on the market cancan be implemented as quickly, withlittle to no disruption•Unlike others, IDN can be deployed
across all environments -physical,virtual, cloud, mobile, or embedded.

RemoteVendor

RemoteSite 4

CorporateNetworkSite 1

IDN is the only technology based on
the Host Identity Protocol (HIP).
Unique device identity is native tonetworking; simple to orchestrate.

Network & Security
Management

Data Center

Users•

Site 326

Reduce the Attack Surface
Attack surface reduction allows greater security focus and depth on the otherareas Tempered Networks doesn’t address, like endpoint or code-level security.
BEFORE TEMPERED

AFTER TEMPEREDUp to:90%
Because of cloaking,identity-based
segmentation, nontraversal, automatic
encryption, and instantrevocation.

27

Improve Time to Mitigate, Revoke, and Quarantine•

Revocation of any resource within the IDN fabric is one
click or an automated API call from a security analytics
system. It can happen instantly, is verifiable, andpermanent - until you say otherwise.

•Even if a user’s credentials were stolen and still valid, ifthey’re not on an authorized device – no access.

•The alternative? Complexity. Check all VPNs, Firewall
rules, ACLs, and directory services. Analyze other policies
to ensure that system is in fact quarantined or revoked.

By:

50%
Time to mitigation,revocation, andquarantine is improved
with greater confidence.

28

Decrease Failover and Disaster Recovery TimeTo aslittle as:1

secondFailover and Disaster
Recovery times
reduced to as little as
one second.

•Every IDN endpoint or HIP Service is based on
unique host identities, not an IP address or hostmaking IP-based failover ’mobile.’•Failover can be applied from an entire
datacenter (represented as a unique hostidentity), down to a container (represented as aunique host identity).

•If one goes down in the IDN fabric, a simple
automated API call or one-click manual updateto the fabric will reconnect instantly to thedesignated IDN failover endpoint.

29

Secure Networking Made Simple
Global Orchestration andNetwork Provisioning

Trust-Based Unique
Cryptographic Identities (CID)• Host Identity Namespace - Global IP Mobility• Prevent IP Address Spoofing and MiTM attacks• Dynamic Device-Based Traffic Management• Assign IDN Endpoints and Networks an Identity• Instant Failover• Encrypted Fabric Extends all the Way to• Automated (API-driven) or Manual ControlIDN Endpoints

The Cure to IT Complexity
Visual Orchestration Simplifies,
Reduces Complexity & Errors

Reduces CapEX and OpEx as much as 25%• Unified single-pane-of-glass management• Build secure segmented networks instantly• Rapid point and click trust-based segmentation• Eliminate errors caused by complexity• Centralized governance, compliance, and• Faster and most cost-effective failover

policy enforcement• Simplified auditing and access control

Tempered Networks Solution –control any connected thing, anytime, anywhere
Integrates unique device identity from the startInstantly connect, cloak, segment, revoke, move, or failover

Fast deployment. Simple policy orchestration. Non-disruptive.

Provisions secure networks and resources rapidly32

Next Steps (Examples Only. Sales People Tailor to Prospect)

Schedule a 30
minute quick
overview anddemo withadditional
stakeholders

Send IDN
Whitepaperand slidedeck forfurther
research

Schedule 30– 60 minutemeeting todiscuss anddocument
PoV Success
Criteria

Other?

Thank you!