Can Security & Agility Co-Exist

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

Can Security and Agility Co-Exist?Arizona Technology Summit 2014Scott Carlson – PayPal – September 17, 2014

26CURRENCIES SUPPORTED

152MACTIVE REGISTERED ACCOUNTS

203MARKETS OFFER PAYPAL

80LOCALIZED MARKETING SITES

GLOBALLY

EUROPEAN UNIONEURO

AUSTRALIANDOLLAR

CANADIANDOLLAR

NEW ZEALANDDOLLAR

HUNGARIANFORINT

MALAYSIANRINGGIT

UNITED KINGDOMPOUNDS STERLING

HONG KONGDOLLAR

UNITED STATESDOLLAR

TAIWANNEW DOLLAR

CHINESERMB

SWEDISHKRONA

SINGAPOREDOLLAR

PHILIPPINEPESO

BRAZILIANREAL

RUSSIANRUBLE

NORWEGIANKRONE

JAPANESEYEN

MEXICANPESO

TURKISHLIRA

SWISSFRANC

CZECHKORUNA

ISRAELINEW SHEKEL

DANISHKRONE

THAIBAHT

POLISHZLOTY

$1.95B850M

$40.4B $14.7B

152M$55B

Revenue Total20% YoY

TotalTransactions

Merchant Services Payment 35% YoYVolume

Active Accounts

Net Total Payment29% YoYVolume

Volume

Marketplaces Payment

Q2 2014 Results

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

Compliant with PCI-DSS 2.0 StandardsCompliant with local country regulations

4

Compliance Statement: http://www.visa.com/splisting/viewSPDetail.do?coName=PayPal

5© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

secureIn safe custody or keepingassured; sure; certain; free from or not exposed to danger or harm; safe.

agilequick and well-coordinated in movement; marked by an ability to think quickly; intellectual acuity

http://www.dictionary.com

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

6

@ http://xkcd.com used with permission under Creative commons License

7© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

secureIn safe custody or keeping assured; sure; certain; free from or not exposed to danger or harm; safe.

preventBe patched, be compliant, be hardened, be layered, don’t let data leave your network

detect Log it all; parse it all; sesame street logic; leave no stone unturned

respondQuarantine; active defense; mitigate; high priority patches; bug fixes; block ports; kill data streams; sever connections

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

8

@ http://xkcd.com used with permission under Creative commons License

“Cyber Attack”

http://www.digitalattackmap.com

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

9

“Cyber Attack”

http://www.digitalattackmap.com

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

10

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

11

http://hackmageddon.com/2014/07/07/june-2014-cyber-attacks-statistics/

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

12

http://www.geekherocomic.com used with permission under Creative commons License

13© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

agilequick and well-coordinated in movement; marked by an ability to think quickly; intellectual acuity

washConsider everything dirty; examine it; spray the bad parts; clean it; use machines to do the dirty work

rinseRun traffic over it; verify assumptions; send it back to the wash if needed; deliver to customer; use it yourself

repeatCheck you work; check new versions; talk to new people; find all of the new and exciting ways people are doing things

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

14

http://www.lynnecazaly.com - used with permission

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

15

@ http://xkcd.com used with permission under Creative commons License

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

16

Compliant≠

Secure

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

17

Agile≠

Risky

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

18

Secure is nota permanent

state

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

19

Security can not work effectively unless you

have Agility

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

20

debate… decide…deliver

secure

© 2014 PayPal Inc. All rights reserved. Confidential and proprietary.

For more information, please contact:

Scott Carlson@relaxed137sccarlson@paypal.com