Security On Network 24t5s

1

Online Fraud Detection, A Layered Approach

Issue 1 2

Approaching Fraud Differently, an Introduction from Christopher Bailey, CTO NuData Security Inc.

3

Putting Gartner’s Recommendations into Practice

5

From the Gartner Files: Market Guide for Online Fraud Detection

13

About NuData Security

Featuring research from

2 Approaching Fraud Differently, an Introduction from Christopher Bailey, CTO NuData Security Inc. On behalf of NuData Security, I am pleased to be able to offer you a complimentary copy of the 2014 Market Guide for Online Fraud Detection, which outlines a ‘five layer model’ of fraud detection capabilities. This is exciting for me personally, for reasons that will soon become clear.

“Our approach to continuous behavioral monitoring is why the largest companies in the world trust NuData Security for online fraud detection.” Christopher Bailey, CTO

Christopher Bailey

My team of developers, engineers and data scientists have always worked with a single goal in mind: create a product that predicts fraud and malicious behavior earlier, more accurately and faster than any other solution in the world. I believe that the secret to our success has been our approach, and the research that follows provides a comprehensive and independent confirmation of that belief.

Many fraud detection solutions reflect the structure of large siloed companies: excellent capabilities in one layer, but with a critical inability to communicate effectively with other layers. This is where our approach is different. NuDetect operates as a tightly integrated model because when you allow layers to communicate with each other you discover emergent patterns that are impossible to detect otherwise. “Within the first week, NuDetect discovered an exploit that had already cost us over $100,000” An International Goods Firm

Our approach to continuous behavioral monitoring is why the largest companies in the world trust NuData Security for online fraud detection. This independent research now makes our approach the expert recommended standard.

FIGURE 1 NuData’s Integrated Layers of Detection

us to hear about our latest developments, such as cross-channel behavior monitoring, or to learn more about how our turnkey solution protects against specific challenges, such as: • takeover; “Innovation in fraud prevention methods is imperative because thieves are increasingly circumventing old techniques, such as device identification.” Gartner, Magic Quadrant for Web Fraud Detection, Avivah Litan and Peter Firstbrook, 30 May 2013.

• New fraud; and • Use of stolen financial credentials. We are confident that our innovations of today will become the standards of tomorrow. Christopher Bailey NuData Security for further information: [email protected] +1 (604) 800-3711

Source: Approaching Fraud Differently, an Introduction from Christopher Bailey, CTO NuData Security Inc., NuData Security

3 Putting Gartner’s Recommendations into Practice Below is an overview of why you should implement Gartner’s key recommendations with NuDetect, and prevent your company from being a victim of Online Fraud.

FIGURE 2 Continuous Behavioral Profiling

Recommendation 1: “The ultimate goal of OFD is: continuous behavioral profiling of s, s and channels.” NuDetect continuously profiles s and s through their entire lifecycle across multiple channels, including: desktop and mobile web, mobile apps, and call center. By continuously profiling s behavior, NuDetect empowers two key capabilities. First, you can detect and respond to fraud sooner, reducing both risk and fraud loss, and second, when the does reach a transaction point, you have full context of all their previous actions and behavior to make a better decision on the transaction. This saves you money in three ways: 1. Stronger identification of fraud attempts, reducing the number of manual reviews;

Source: NuData Security

2. Detailed contextual behavior information to reduce manual review time;

• Use of stolen financial credentials.

3. Accept a greater proportion of orders, with confidence they will not result in fraud.

Recommendation 3: “Give priority to vendors that provide multiple layers of protection, s and profiling, and behavioral analytics.”

Recommendation 2: “Use a layered approach to detect online fraud in order to increase your chances of beating the fraudster.” NuDetect has capabilities across all three layers of fraud detection prescribed by the Gartner 2014 Market Guide (Endpoint, Navigation, & ). In addition to these first three layers, NuDetect also s cross channel analysis (Layer 4) and big data analytics and entity linking across our non-PII data network (Layer 5). By continuously profiling s across all five layers, NuDetect identifies anomalies, risks, and fraud attempts that simply aren’t visible to vendors that monitor fewer layers. Monitoring all layers is essential to providing strong detection for key types of fraud: • takeover fraud; • New fraud; and

NuDetect spans all five layers of fraud detection. Our non-PII data network analyzes over a billion events per month, linking entities and relationships through behavior metrics, device identity, IP address, and email address. NuDetect’s tightly integrated model allows each layer of fraud detection to communicate seamlessly with the others, identifying behavior and relationships that aren’t visible when considering each layer independently. As a result you can detect more fraud and reduce false positives, both of which saves you money. To find out more about putting Gartner’s recommendations into practice or NuData Security’s approach to fraud detection in: e-commerce, financial services, digital goods and online marketplaces, us: [email protected]. Source: NuData Security

“We rely on NuData to protect us from fraudulent activity but we see as much value from the trust NuDetect establishes between us and our community” A Global Technology Company

4 From the Gartner Files:

Market Guide for Online Fraud Detection

“Use a layered approach to detect online fraud in order to increase your chances of beating the fraudsters” Gartner, Market Guide for Online Fraud Detection, 2 June 2014.

The online fraud detection market has substantially transformed in the past two years, trying to keep pace with rapid advances and expansions in cybercrime. This Market Guide will help fraud managers navigate this amorphous space so they can make “rightsize” fraud detection purchasing decisions.

Strategic Planning Assumption Key Findings • The Web fraud detection market has transformed into the broader online fraud detection (OFD) market, which absorbs fraud detection for Web, mobile and telephony-based (that is, call center and voice response unit [VRU]) commerce. • Identity-proofing functions are integrating with OFD technology, reflecting the need to continually assess the risk of individuals using internal and external identity information.

“Give priority to vendors that provide multiple layers of protection, s and/or profiling and behavioral analytics” Gartner, Market Guide for Online Fraud Detection, 2 June 2014.

• Use a best-of-breed approach to combat advanced cyberattacks, if you have the resources to integrate different products and services into a common alert management system that correlates and prioritizes fraud events.

• The OFD market is characterized by multiple point solutions and innovative niche vendors, along with vendors trying to provide “one-stop shop” fraud detection services. • One-stop fraud detection solutions don’t always have the most advanced “weaponry” on the market for combating advanced attacks. Recommendations Fraud managers: • Use a layered approach to detect online fraud in order to increase your chances of beating the fraudsters. Incorporate endpoint-centric (Layer 1), navigation-centric (Layer 2) and /-centric (Layer 3) fraud detection functionality. • Give priority to vendors that provide multiple layers of protection, and/or profiling, and behavioral analytics. • Give extra weighting and consideration to vendors that bring actionable external identity or threat intelligence to the OFD application, once you have the initial fraud detection layers implemented.

By 2017, ive biometric analysis will become a standard feature of at least 30% of one-stop fraud detection solutions — up from less than 1% today. Market Definition This document was revised on 7 July 2014. The document you are viewing is the corrected version. The OFD market is composed of vendors that provide products or services that help an organization detect fraud that occurs over the Web, mobile or other telephony-based channels (that is, call center and VRU) by: • Running background processes (that s cannot see or detect) that use up to hundreds of attributes — such as geolocation, device characteristics, behavior, navigation and transaction activity — to determine the likelihood of fraudulent s or transactions • Comparing this information to expected behavior using machine learning or statistical algorithms, or rules that define “abnormal” behavior and activities (see Note 1) OFD vendors detect online fraud as transactions occur, one at a time. They provide solutions for the Web, mobile or telephony channels from one or more of the first three layers of Gartner’s fivelayer fraud prevention — that is, endpoint-centric (Layer 1), navigation-centric (Layer 2) and - or -centric for a specific channel (Layer 3; see Note 2 for a description of the five layers of fraud prevention). OFD systems typically return alerts and results (such as scores with ing data) to enterprise s that enable the enterprise to take appropriate follow-up action, such as:

5 • Suspending the transaction if actual behavior is out of range with what’s expected • Conducting further review and investigation of the transaction, as warranted • Triggering automated authentication and transaction verification functions that interact with the in order to determine the legitimacy of the or transaction OFD applies mainly to three use cases: • Detecting takeover, which can occur when credentials are stolen or authenticated sessions are hijacked (for example, via malware-based attacks)

that enables integrated solutions. The OFD market will further consolidate by 2016 as larger vendors in the call center, identity proofing, and banking and e-commerce fraud detection businesses acquire one-third of the niche or smaller startup players of 2014. These separate (but related) requirements include the need for the following functions (see more on these below in the Market Analysis section): • One-stop fraud detection solutions • Continuous identity proofing • External threat intelligence

• Detecting new fraud (for example, when a fraudster sets up a new using a stolen or fictitious identity)

• Telephony-based channel fraud detection

• Detecting the use of a stolen financial (for example, a stolen credit card) by a fraudster when he or she makes a purchase

• Smarter risk scoring models — self-adjusting and self-learning

Market Direction This OFD Market Guide replaces Gartner’s “Magic Quadrant for Web Fraud Detection,” reflecting the fragmentation, consolidation and expansion of the OFD market. These market dynamics were witnessed during several mergers and acquisitions in 2012 and 2013, while, at the same time, many new entrants emerged from different corners of the market. For example, in 2012, RSA, The Security Division of EMC, acquired Silver Tail Systems and Diebold acquired Gas Tecnologia. In 2013, Experian acquired 41st Parameter, F5 acquired Versafe, IBM acquired Trusteer and NCR bought Alaric Systems. (All acquisition targets except Versafe — a relative newcomer — were covered in Gartner’s Web Fraud Detection Magic Quadrants.) At the same time as the market was consolidating, requirements in an increasingly complex online world under cyberattack have driven innovation in separate (but related) fraud detection capabilities, which are needed to stay ahead of evolving criminal methods.1 Over time, these disparate capabilities and the vendors that them will come together in a consolidated market

• Mobile-centric fraud detection

• ive biometric analysis In the end, the ultimate goal of OFD is: • Continuous behavioral profiling of s, s and entities across online channels. • Enriching that profile with internal and external identity information. • Ingesting and integrating external threat intelligence with fraud detection analysis and operations. • Using these rich data sources (from the three preceding bullets) to compare incoming transactions across online channels to existing profiles and norms of or entity behavior in order to detect fraud. As noted above, fraud detection uses rules, statistical models or both. Market Analysis Gartner separates the OFD market into three main buyer segments, based on the sectors that vendors target with their products:

“The ultimate goal of OFD is: continuous behavioral profiling of s, s and entities across online channels” Gartner, Market Guide for Online Fraud Detection, 2 June 2014.

6 • Banking: This also includes payments between all parties that accept, transmit or process payments. “Most organizations cannot keep up with the latest attack vectors” Gartner, Market Guide for Online Fraud Detection, 2 June 2014.

“Prefer vendors that provide solutions covering as many of the three layers of OFD as possible” Gartner, Market Guide for Online Fraud Detection, 2 June 2014.

“Continually monitor and analyze behavior, as soon as a relationship with an individual begins until it ends, because the life circumstances of the individual may change, or the identity may have been bad to start with” Gartner, Identity Proofing Revisited as Data Confidentiality Dies, Avivah Litan, 12 December 2013.

• E-commerce: This also includes e-commerce payments between online retailers or other online payment acceptors and the payment networks. • Sector-neutral: This includes, for example, banking, payments, e-commerce, gaming, social networking, telecom, e-government, education, transportation and other sectors. Within each of these segments, vendors offer various categories of fraud detection capabilities. These categories reflect the focus of particular vendors and how they approach the OFD market: • One-stop fraud detection solutions: Most organizations cannot keep up with the latest attack vectors and what is needed to mitigate attack damage, and therefore prefer vendors that provide solutions covering as many of the three layers of OFD as possible. This way, s can meet most of their fraud detection needs by engaging with one supplier. • One-stop fraud detection managed services: Some enterprises want to outsource the review and management of suspect transactions. Emerging managed services guarantee payments on reviewed transactions in return for a percentage of the value. This service can be particularly useful for internally declined transactions that could benefit from additional review for potential acceptance, and also for international transactions in which companies have little experience with fraud detection. • Continuous identity proofing: External identity information needs to be checked and analyzed in conjunction with activity within the organization to help inform when an identity “goes bad” because of changes in life circumstances, or perhaps when an identity (or parts thereof, such as a device or email address) is hijacked by a fraudster. Here, we see vendors helping to assess the risk of an identity by correlating an identity’s attributes with external information based on:

• Public records, including personally identifiable information (PII) data from data aggregators, credit bureaus, news feeds, driver’s license databases and more. PII data is regulated. • Non-PII data networks, which identify entities and relationships associated with suspect or fraudulent activities using non-PII data (such as endpoint device identities, IP addresses, email addresses, phone numbers and so on). Non-PII data typically is not regulated, but there are restrictions in some countries (for example, in Europe) in associating IP addresses with people’s names. • Public social network information from networks (such as Facebook and LinkedIn) that assess an individual’s social footprint and associated risk. Use of publicly available social network information is not regulated. • External threat intelligence integrated directly into OFD: Organizations benefit from intelligence culled about cybercriminals and potential attacks, which is available in the criminal underground and shared across potential victim organizations. For example, most cyberattacks employ malware that is either targeted against a specific enterprise or has been used before to attack companies in a specific sector (for example, retail or financial services). Vendors with capabilities in malware identification and analysis, and in threat intelligence, have moved into the OFD market. They make their intelligence actionable in the fraud detection system — for example, by integrating blacklists of URLs, malware signatures or “bad” IP addresses. • Telephony-based channel fraud detection: As enterprises tighten up controls across various points of entry (such as Web channels, kiosks and points of sale), fraudsters are more frequently exploiting traditionally less protected telephony channels, including call centers and VRUs. Large financial services companies report that about 30% of their fraud occurs via compromises of multiple channels that include the telephony channel, and several vendors now sell solutions to stop telephony-based fraud. This type of fraud can be automated or conducted by a human.

7 • Mobile-centric and multiple aspects for fraud detection: Mobile commerce has presented significant effectiveness and usability challenges to existing ways of identifying end s and their devices, which worked relatively well on desktop and laptop computers. As such, enterprises are looking for fraud detection solutions that do not inconvenience mobile s, but do ensure that applications are accessed only by legitimate, authorized s. (For example, device fingerprinting is ineffective on most mobile devices, while it considerably helps to detect fraud originating from desktops and laptops; however, it is becoming less effective at detecting access via proxy servers.) Mobile-centric fraud detection looks for signs of fraud at the device, application and level. • Smarter risk scoring models — selfadjusting and self-learning: • Self-adjusting models: These reduce the burden on s to help keep vendor risk scoring models up to date by informing the model on confirmed fraud events. Such participation has often been difficult to maintain, so vendor models often get out of date and, therefore, are unable to recognize new fraud trends. Self-adjusting models are enabled by baselining online activity and looking for anomalies relative to the baseline, with the assumption that most online activity is “good” or legitimate. • Self-learning models: Ultimately, s want to be able to throw their data into a modeling system that can find fraud patterns they have never even considered. In other words, s want an application that can figure out which activities are suspect or fraudulent without them or the vendor having to tell the application anything. Some people refer to this as “artificial intelligence,” which is starting to appear in the OFD market. • ive biometric analysis: Here, biometric analysis is done “behind the scenes” and is transparent or unknown to the (unless an organization chooses to tell the it is occurring). There is no enrollment necessary. Over time, the system is trained on a ’s biometric “signature” so that it can compare the signature to a fraudster’s on a blacklist, or to ongoing behavior to determine whether the legitimate is

being impersonated. The use of ive voice recognition and ive gesture dynamics — that is, behavioral techniques in which movements on a device are tracked and measured — have already proved to be very useful in the OFD market. Representative Vendors

The vendors listed in this Market Guide do not imply an exhaustive list. This section is intended to provide more understanding of the market and its offerings. Representative vendors are listed by market category, as described in the Market Analysis section above. Their categorization is based on their native technology, not on any partner solutions they have integrated or can potentially integrate. (The only exception to this is with identity-proofing vendors, whose core mission is largely based on their ability to aggregate different identity intelligence data sources.) Below is a list of representative OFD vendors. Table 1 depicts the sectors these vendors target, and Table 2 depicts the functional capabilities of these vendors: • Accertify • ACI Worldwide • Agnitio • Ayasdi • BAE Systems Applied Intelligence • BioCatch • CA Technologies (Arcot Systems) • Solutions • CustomerXPs • CyberSource • Digital Resolve • Easy Solutions • Experian (41st Parameter) • F5 (Versafe) • Feedzai

“ive biometric analysis: here biometric analysis is done “behind the scenes” and is transparent or unknown to the ” Gartner, Market Guide for Online Fraud Detection, 2 June 2014.

8 • Fox-IT • GBGroup • Guardian Analytics • IBM (Trusteer) • IDology • InAuth

Table 1. Target Sectors Vendor

Banking

Accertify ACI Worldwide

E-Commerce

x

Agnitio

x

Ayasdi

x

BAE Systems Applied Intelligence

x

BioCatch

x

CA Technologies (Arcot Systems)

x

x

Solutions

• Inform

CustomerXPs

x x

CyberSource

• Intellinx • iovation • Kaspersky Lab • Kount • LifeLock (ID Analytics) • mSignia • NCR (Alaric Systems) • Nice Actimize • NuData Security

• Plus-TI • ReD • Riskified • RSA, The Security Division of EMC • SAS • Sift Science • Signifyd • Socure • ThreatMetrix • Trustev • Verint Systems (Victrio)

x

Digital Resolve

x

Easy Solutions

x

Experian (41st Parameter)

x

F5 (Versafe)

x

Feedzai

x

Fox-IT

x

x

GBGroup

x

Guardian Analytics

x

IBM (Trusteer)

x

IDology

x

InAuth

x

Inform

x

Intellinx

x

iovation Kaspersky Lab

• Pindrop Security

Sector-Neutral

x

x x

Kount

x

LifeLock (ID Analytics)

x

mSignia

x

NCR (Alaric Systems)

x

Nice Actimize

x

x

NuData Security

x

Pindrop Security

x

Plus-TI

x

ReD

x

Riskified

x x

RSA

x

SAS

x

Sift Science

x

Signifyd

x

Socure

x

ThreatMetrix

x

Trustev

x

Verint Systems (Victrio)

x

Source: Gartner (June 2014)

9 Table 2. Functional Capabilities and Focus

Accertify

x

ACI Worldwide

x x

Ayasdi

x

BAE Systems Applied Intelligence

x

BioCatch

x

CA Technologies (Arcot Systems)

x

x x

Solutions

x

CustomerXPs

x

CyberSource

x

Digital Resolve

x

Easy Solutions

x

Experian (41st Parameter)

x

F5 (Versafe)

x x x x

x

x

Feedzai

x x

x

GBGroup

x

Guardian Analytics IBM (Trusteer)

x

x

x

x

x

IDology

x

InAuth

x

Inform

x

Intellinx

x

iovation

x

Kaspersky Lab

x

Kount

x

x x

LifeLock (ID Analytics)

x

mSignia

x

x

NCR (Alaric Systems)

x

Nice Actimize

x

NuData Security

x

x x

x x

Pindrop Security

x

x

Plus-TI

x

ReD

x

x

Riskified RSA

x x

x

SAS Sift Science

Managed Fraud Detection Svc. x

Agnitio

Fox-IT

Self-Learning Models

Gestures

ive Biometric Analysis

Voice

Voice Response Units

Call Center

External Threat Intelligence

Telephony Channel

Public (PII) Information

Social Networks

Non-PII Networks

Mobile Platform Multiaspect

/Centric (Layer 3)

EndpointCentric (Layer 1)

Multiple Layers (1-3)

Identity Proofing

x

x x

x

Signifyd

x

Socure ThreatMetrix Trustev Verint Systems (Victrio) Source: Gartner (June 2014)

x x

x x

x x

x

10

“Give priority to vendors that provide multiple layers of protection, s and/or profiling, and behavioral analytics” Gartner, Market Guide for Online Fraud Detection, 2 June 2014.

Market Recommendations

Evidence

Fraud managers:

1 Each year, Gartner fields several hundred inquiries from clients worldwide regarding fraud detection and prevention. These calls unearth common requirements and trends across the globe in relation to combating fraud.

• Employ a layered OFD approach, and, at a minimum, use solutions that integrate endpoint-centric (Layer 1) with - and -centric (Layer 3) fraud detection.

Note 1 • Give priority to vendors that provide multiple layers of protection, and/or profiling, and behavioral analytics using statistical models and rules. • Give extra weighting and consideration to vendors that bring actionable external identity or threat intelligence to the OFD application. • If you already have a strong installed base of fraud detection software, then consider using just the external intelligence data from other OFD vendors to strengthen your existing fraud detection systems. • Recognize that resolving difficult challenges and stopping advancing attacks in the online channel will require piecing together niche solutions. Most of the innovation that addresses rapidly evolving criminal techniques is introduced by small niche vendors, not the ones that offer one-stop platforms. • This will only be a practical option if your enterprise has considerable resources to devote to this exercise, and already has a significant installed base of fraud detection software and services. • Integrate disparate point solutions into a common alert management system wherein alerts and their attributes can be weighted and correlated to highlight the most suspect alerts and events that need immediate attention. • Otherwise, you will have too many alert management systems to manage, and your organization will not benefit from correlating the different events that are alerted. • Feed fraud data into a big data warehouse to get an enterprise view of fraud and security issues, and to Layer 5 fraud detection.

Risk Scoring and Modeling Optimally, vendors should and entity profiling — that is, a or entity’s ongoing behavior is captured in a profile, against which new activity can subsequently be compared to determine the likelihood that the activity is legitimate. This anomaly detection is accomplished using statistical models, rules or a combination of both. In addition, one of each type of statistical model, as described below, should be deployed for best results. Statistical models are based on either: • Confirmed fraud and “bad” behavior, which s need to tell the model about. • “Normal behavior,” most of which is assumed to be “good.” This type of model is best when there is no history of confirmed fraud, or when fraud analysts or other enterprise s want the model to be self-maintaining. There is no need for s to tell the model what is normal; rather, it can figure this out by itself by baselining various activities and entity behaviors. Anomalies will be detected because they will stand out relative to the baseline. Not all anomalies represent fraud. Note 2 Five Layers of Fraud Prevention Gartner breaks down fraud prevention into five layers: • Layer 1 is endpoint-centric; it involves technologies deployed in the context of s and the endpoints they use. Layer 1 technologies include secure browsing applications or hardware, as well as transactiong devices. These devices can be dedicated tokens, telephones, PCs and more. Out-of-band or dedicated hardware-based

11 transaction verification affords stronger security and a higher level of assurance than in-band processes do. The technologies in this layer typically can be deployed faster than those in subsequent layers, and go a long way toward defeating malware-based attacks. • Layer 2 is navigation-centric; it monitors and analyzes session navigation behavior and compares it with navigation patterns that are expected on that given site, or uses rules that identify abnormal and suspect navigation patterns. It’s useful for spotting individual suspect transactions, as well as fraud rings. Generally, this layer can also be deployed faster than Layers 3, 4 and 5, and it can be effective in identifying and defeating malware-based attacks.

• Layer 4 is - and -centric across multiple channels and products (for example, online sales and in-store sales). As with Layer 3, it looks for suspect or behavior, but also offers the benefits of looking across channels and products as well as correlating alerts and activities for each , or entity. • Layer 5 is big data analytics. It enables the analysis of relationships among internal and/or external entities and their attributes (for example, s, s, attributes, machines and machine attributes) to detect organized or collusive criminal activities or misuse. Source: Gartner Research, G00260461, Avivah Litan, 2 June 2014,

• Layer 3 is - and -centric for a specific channel (for example, online sales); it monitors and analyzes or behavior and associated transactions, and identifies anomalous behavior using rules or statistical models. It may also (optimally) use continually updated profiles of s and s, as well as those of peer groups, for comparing transactions and identifying those that are suspect.

12 About NuData Security: NuData Security uses behavioral analysis to prevent fraud online, protecting businesses from brand damage and financial loss caused by fraudulent or malicious attacks. NuData Security monitors behavior continuously; across every page, and every visit. Fraud is a chain of events, so, by analyzing every visit NuDetect sees the beginnings of fraud the moment it starts - before the transaction. Businesses achieve improved customer trust by keeping their online brand safe. Reduced costs are realized by lowering reliance on expensive and inefficient security controls such as manual reviews and remediation. The NuDetect platform also allows firms to accept more transactions, with a greater confidence that they will not result in fraud. Operating ively, there is no impact to the experience.

Head office: 999 Canada Place - Suite 550, Vancouver, British Columbia, V6C 3T4 Canada Phone: +1 (604) 800-3711 Email: [email protected] Website: www.nudatasecurity.com LinkedIn: www.linkedin.com/company/nudata-security

Online Fraud Detection, A Layered Approach is published by NuData Security. Editorial content supplied by NuData Security is independent of Gartner analysis. All Gartner research is used with Gartner’s permission, and was originally published as part of Gartner’s syndicated research service available to all entitled Gartner clients. © 2014 Gartner, Inc. and/or its s. All rights reserved. The use of Gartner research in this publication does not indicate Gartner’s endorsement of NuData Security’s products and/or strategies. Reproduction or distribution of this publication in any form without Gartner’s prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. The opinions expressed herein are subject to change without notice. Although Gartner research may include a discussion of related legal issues, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner is a public company, and its shareholders may include firms and funds that have financial interests in entities covered in Gartner research. Gartner’s Board of Directors may include senior managers of these firms or funds. Gartner research is produced independently by its research organization without input or influence from these firms, funds or their managers. For further information on the independence and integrity of Gartner research, see “Guiding Principles on Independence and Objectivity” on its website, http://www.gartner.com/technology/about/ombudsman/omb_guide2.jsp.