实例探究 > Changing the rules of the game for cybersecurity

Changing the rules of the game for cybersecurity

公司规模

1,000+

地区

America

国家

United States

产品

Respond Analyst
Palo Alto Networks IDS/IPS
Vectra Threat Detection Platform
Nessus Vulnerability Scanner
ProofPoint Email Security Gateway

技术栈

Open Source IDS
Suricata
Next-Gen Firewall
DNS Filtering
Email Gateway Tools

实施规模

Enterprise-wide Deployment

影响指标

Customer Satisfaction
Employee Satisfaction
Innovation Output
Productivity Improvements

技术

网络安全和隐私 - 端点安全
网络安全和隐私 - 入侵检测
网络安全和隐私 - 网络安全
网络安全和隐私 - 安全合规

适用行业

教育

适用功能

商业运营
设施管理

用例

入侵检测系统

服务

软件设计与工程服务
系统集成
培训

关于客户

The University of Oklahoma (OU) is a prominent higher education institution with a large and diverse user base. It serves over 30,000 students and 7,000 full-time faculty and staff, in addition to providing user accounts to alumni, retirees, and distance learners. This results in approximately 90,000 user accounts accessing the university's IT infrastructure from over 120,000 devices each week during peak periods. The university's security team, led by Chief Information Security Officer Aaron Baillio, consists of 10 full-time employees and 3-4 student security analysts. The team is responsible for protecting the university's institutional data and guarding users against internal and external threats. Despite the small size of the team, they are committed to leveraging advanced technologies to enhance their security operations and provide valuable training opportunities for students interested in cybersecurity.

登录后查看完整内容

挑战

The University of Oklahoma faced a significant challenge in managing the vast number of security events generated by their network sensors. With over 80 million security events and 350 alerts per week, the small security team, consisting of 10 full-time employees and 3-4 student security analysts, struggled to monitor and respond to these events effectively. The high volume of false positives further complicated their efforts, making it nearly impossible to identify and address genuine threats promptly. The university's IT infrastructure, accessed by approximately 90,000 user accounts from over 120,000 devices, required a robust and efficient security solution to protect against internal and external threats.

登录后查看完整内容

解决方案

To address the overwhelming volume of security events, the University of Oklahoma implemented the Respond Analyst, an intelligent decision engine that automates the analysis and triage of network security data. This solution mimics a human analyst's decision-making process, allowing it to make escalation decisions with the same finesse and expert judgment as a human, but at machine speed. By integrating the Respond Analyst with their existing security tools, including open-source IDS, Palo Alto Networks IDS/IPS, Vectra Threat Detection Platform, and Nessus Vulnerability Scanner, the university achieved comprehensive sensor coverage and significantly reduced the number of false positives. The Respond Analyst's ability to filter and prioritize security events enabled the security team to focus on the most critical incidents, improving their overall efficiency and effectiveness. This automation allowed the team to devote more time to incident response workflows, threat hunting, and engineering and automating workflows, ultimately enhancing their ability to protect the university's IT infrastructure.

登录后查看完整内容

运营影响

The implementation of the Respond Analyst significantly reduced the alert volume, decreasing the number of escalated events from 350 per week to just 2-9 vetted incidents per week.
The security team experienced a reduction in alert fatigue, allowing them to focus on meaningful and actionable security events.
The automation provided by the Respond Analyst acted as a force multiplier, effectively adding the equivalent of 68 human security analysts to the team.
The university's security team was able to devote more time and effort to incident response workflows, improving their response times and overall efficiency.
The collaboration with Respond Software allowed the university to refine and develop more skills within the Respond Analyst, enhancing the effectiveness of their security automation software.

登录后查看完整内容

数量效益