Rapid7 > Case Studies > InsightUBA on a University Campus

InsightUBA on a University Campus

Company Size

1,000+

Region

America

Country

United States

Product

Rapid7 Nexpose
Rapid7 Metasploit
InsightUBA

Tech Stack

Vulnerability Management
Threat Detection
Incident Response

Implementation Scale

Enterprise-wide Deployment

Impact Metrics

Customer Satisfaction
Digital Expertise
Productivity Improvements

Technology Category

Analytics & Modeling - Predictive Analytics
Cybersecurity & Privacy - Endpoint Security
Cybersecurity & Privacy - Network Security

Applicable Industries

Education

Applicable Functions

Business Operation
Facility Management

Use Cases

Intrusion Detection Systems
Predictive Maintenance
Remote Asset Management

Services

System Integration
Training

About The Customer

The University of Texas at Dallas (UT Dallas) is a major public research university located in Richardson, Texas. It is part of the University of Texas System and has a diverse student body of over 28,000 students, along with a significant number of faculty and staff. The university is known for its strong emphasis on research and innovation, particularly in the fields of science, engineering, and technology. With a sprawling campus and a large network infrastructure, UT Dallas faces unique challenges in maintaining robust cybersecurity measures to protect its digital assets and ensure the safety of its community.

The Challenge

The University of Texas at Dallas faced significant challenges in managing vulnerabilities across its campus network. The primary goal was to reduce vulnerabilities, detect and investigate security incidents faster, and manage threat exposure effectively. The security team needed a solution that could provide comprehensive visibility into information security risks, correlate user behavior with events, and improve incident response times. Additionally, they wanted to ensure that new technology purchases underwent thorough security assessments before going into production.

The Solution

UT Dallas implemented a suite of Rapid7 products, including Nexpose, Metasploit, and InsightUBA, to address their cybersecurity challenges. Nexpose was used for vulnerability management, allowing the security team to conduct ad hoc scans and vet new technology before deployment. The tool was extended to other departments, enabling them to run their own scans while security provided education and context. Metasploit was employed for proof of concept conversations and to demonstrate system vulnerabilities, enhancing the importance of proactive patch management. InsightUBA was added to provide an additional layer of visibility into information security risks, correlating user behavior with events and improving incident response times. The combination of these tools allowed UT Dallas to manage threat exposure more effectively, prioritize vulnerabilities, and streamline incident response processes.

Operational Impact

The implementation of Nexpose allowed UT Dallas to extend vulnerability management capabilities to other departments, fostering collaboration and education across the campus.
Metasploit proved invaluable during proof of concept conversations, enabling the security team to demonstrate the real and exploitable nature of vulnerabilities quickly and effectively.
InsightUBA provided a much-needed level of visibility into information security risks, allowing the security team to correlate user behavior with events and improve incident response times significantly.
The reporting features within Nexpose helped UT Dallas prioritize vulnerabilities and manage risk more effectively, enabling productive collaboration with departmental technicians.
InsightUBA's quality alerts, without the noise typically generated by SIEMs, allowed the security team to provide more protection without increasing headcount, enhancing overall efficiency.

Quantitative Benefit

Over a six-month period of using Nexpose, UT Dallas achieved a 32% reduction in vulnerabilities.
InsightUBA reduced the time required to correlate user behavior from two to three business days per incident to just 60 seconds.