Security Automation Case Study Maricopa Community Colleges. Watch the full webinar replay

Transcription

1 Security Automation Case Study Maricopa Community Colleges Watch the full webinar replay

2 Your Speakers Rich Lang Technical Director: Information Technology Security & Planning Maricopa Community Colleges Tammy Sexton Vice President LogicHub Watch the full webinar replay

3

4 PHISHING HIGHER-ED

5 2016 data Higher Education hit across the country Phishing attacks Important update from your IT Helpdesk please login and update your profile. TOR, Anonymous Proxies used by threat actors Postmortem review / findings

6 User Lucky

7 Google s recommendation for stopping suspicious logins: Ask the user if they remember signing in. Have them check their last account activity. If you can t establish the legitimacy of the signin- follow the Admin security checklist. Google Cloud Support can t investigate alerts as they are considered sensitive and potentially private.

8 So what were you doing on the night of Friday the 13 th 2 AM at IP address Do you frequently log in from the Ukraine, Iraq or Brazil? Have you checked your last login activity? I noticed you are using a free proxy service. Are you aware your home computer may be infected?

9 Avg daily number of employee Suspicious Logins 50 Avg daily number of student suspicious logins 200 Consider 250 events * 5 minutes / event handling Appx two FTE dedicated to Suspicious login events ROI less than 2 months

10 Save the patient! Is the cure worse than the disease? I am an adjunct faculty member traveling abroad through Europe and you just shut my access down at the airport!!! I am your CIO presenting to the board via a kiosk and you just locked me out!!! I am your board member, my wife installed a proxy service at home for privacy.

11 Enter LogicHub for the SOC If it has a webhook it can be automated. SumoLogic great for log event triggers and integrated access to Gsuite API s. CrowdStrike to provide malware confidence scoring

12 Lots of great data and event management but how do we reach the customer! Twilio for the win. Right on their phone.

13 Threat Intelligence Webhooks Push notifications

14 Detect Respond Assess Log Response SMS Action Close

15

16 16 The alert is sent from Sumo Logic into LogicHub. Sumo Logic, CrowdStrike, LogicHub, Twilio This flow captures the work that would be done manually if we had the resources

17 17 A text message is sent via Twillio. This flow can be modified, Example: add action to send a text message to IT security if the user is an admin, a financial aid processor, or has access to wire transfers Any action can be 24x7 or just during the work day or school year.

18 18 LogicHub created an action that opens a case in ServiceNow for purposes of the POC. In the test case, Lucky User had responded yes to the text which is automatically documented in the case that LogicHub automatically opened This action could be easily modified to our Case Management System via API access

19 Lucky User - The Information Security Office has received notification of suspicious activity from your account. IP: Login Time: T14:17:30.000Z Please reply with Y or YES if this WAS you. Please reply with a N or NO if this WAS NOT you. Maricopa Community Colleges will never ask you for your password, and you may contact the Information Security Office to verify the validity of this message at 480-7xx-xxxx or informationsecurity@mysite.edu.

20 Because the user has not entered a mobile phone number, we are resetting their password. Time: T21:33:18.000Z UTC Name: Lucky User Title: Music Instruction Hrly Suspicious login from:, United States Login IP: 2600:8800:2c00:e430:4577:2b1d:f130:5a3f Because the user did not respond, we reset their password Time: T16:21:22.000Z UTC Name: Ima Teepot Title: Tech Support Specialist Suspicious login from: Ashburn, United States Login IP:

21 Best Practices Validate Data Integration Sources Enlist Peers to Test the System Scope The Prototype Set Your Expectations Fail Fast

22 Lessons Learned Consider Event Timing / Synchronization Build in Error Handling Enlist Communications Team Start with Modest Workflow

23

24 LogicHub Automates: Logic Alert Triage Reduce false positives by 95% Incident Response Reduce response times (MTTR) Threat Hunting Detect unknown threats

25 Next Generation Security Automation: Founded in 2015 Headquarters: Mountain View, CA Traditional SOA Vendors BILLIONS Threat Hunting Alert Triage THOUSANDS Incident Response HUNDREDS TENS Detection Rules Alerts ( Security Events ) Ignored Notifications Eliminate False Positives Incidents

26 Security Automation Platform: End-to-End Intelligent Automation for Detection and Response Alerts Log Aggregators Threat Intelligence Security Products Cloud Logs Ingestion Framework Automation Framework Deep Ranking Human Feedback Integration Framework SIEMs Security Products Case Management Network Management Any API enabled system

27 LogicHub Integrations 90+ and counting, including: Investigative Ticketing Systems Threat Intelligence Vulnerability Management Remote Access Identity Management Cloud AWS Cloud Trail VPC Flow Logs freegeoip Messaging ICANN WHOIS SIEMs Endpoint dig ET Intelligence

28 LogicHub Sample Use Cases

29 Thank You! Tammy Sexton VP Sales

30 Q & A