Security Automation Case Study

Maricopa Community Colleges

Watch the full webinar replay

 Your Speakers

Rich Lang Tammy Sexton

Technical Director: Information Technology
Vice President
Security & Planning
LogicHub
Maricopa Community Colleges

Watch the full webinar replay

PHISHING HIGHER-ED
SOC AUTOMATION
 SOC AUTOMATION
• 2016 data – Higher Education hit across the country
Phishing attacks
• https://www.universitybusiness.com/article/college-
cyber-attacks-don-t-take-bait
• Important update from your IT Helpdesk – please login
and update your profile.
• TOR, Anonymous Proxies used by threat actors
• Postmortem review / findings
 SOC AUTOMATION

User Lucky (user.lucky@mysite.edu)

 SOC AUTOMATION
• Google’s recommendation for stopping suspicious
logins:
• Ask the user if they remember signing in.

• Have them check their last account activity.

• If you can’t establish the legitimacy of the

signin- follow the Admin security checklist.

• Google Cloud Support can’t investigate alerts

as they are considered sensitive and potentially
private.
 SOC AUTOMATION
• So what were you doing on the night of Friday the 13th
2 AM at IP address 10.10.1.20.

• Do you frequently log in from the Ukraine, Iraq or Brazil?

• Have you checked your last login activity?

• I noticed you are using a free proxy service.

• Are you aware your home computer may be infected?

 SOC AUTOMATION

• Avg daily number of employee Suspicious Logins – 50

• Avg daily number of student suspicious logins – 200

• Consider 250 events * 5 minutes / event handling

Appx two FTE dedicated to Suspicious login events
ROI less than 2 months
 SOC AUTOMATION
Save the patient!

Is the cure worse than the disease?

I am an adjunct faculty member traveling abroad through

Europe and you just shut my access down at the airport !!!

I am your CIO presenting to the board via a kiosk and you just
locked me out !!!

I am your board member, my wife installed a proxy service at

home for privacy.
 SOC AUTOMATION

Enter LogicHub for the SOC

If it has a webhook it can be automated.

SumoLogic great for log event triggers and integrated

access to Gsuite API’s.

CrowdStrike to provide malware confidence scoring

 SOC AUTOMATION

Lots of great data

and event Twilio for the win.
management but Right on their
how do we reach phone.
the customer!
 SOC AUTOMATION

Threat
Intelligence

Webhooks

Push notifications
 SOC AUTOMATION
Detect
Assess SMS

Respond
Response
Log
Action

Close
SOC AUTOMATION
 16

SOC AUTOMATION
• The alert is sent from
Sumo Logic into
LogicHub.
• Sumo Logic ,
CrowdStrike,
LogicHub,
• Twilio
• This flow captures the
work that would be
done manually if we
had the resources
 17

SOC AUTOMATION

• A text message is sent via Twillio.

• This flow can be modified, Example:
add action to send a text message
to IT security if the user is an admin, a
financial aid processor, or has
access to wire transfers
• Any action can be 24x7 or just during
the work day or school year.
 18

SOC AUTOMATION
• LogicHub created an action
that opens a case in
ServiceNow for purposes of
the POC.
• In the test case, Lucky User
had responded “yes” to the
text which is automatically
documented in the case
that LogicHub automatically
opened
• This action could be easily
modified to our Case
Management System via API
access
 SOC AUTOMATION
• Lucky User - The Information Security Office has
received notification of suspicious activity from your
account. IP: 72.216.244.24 Login Time: 2018-06-
12T14:17:30.000Z Please reply with “Y” or “YES” if this
WAS you. Please reply with a “N” or “NO” if this WAS
NOT you. Maricopa Community Colleges will never ask
you for your password, and you may contact the
Information Security Office to verify the validity of this
message at 480-7xx-xxxx
or informationsecurity@mysite.edu.
 SOC AUTOMATION
• Because the user has not entered a mobile phone
number, we are resetting their password.
Time: 2018-06-12T21:33:18.000Z UTC
Name: Lucky User
Title: Music Instruction Hrly
Suspicious login from: , United States
Login IP: 2600:8800:2c00:e430:4577:2b1d:f130:5a3f
• Because the user did not respond, we reset their
password
Time: 2018-06-12T16:21:22.000Z UTC
Name: Ima Teepot
Title: Tech Support Specialist
Suspicious login from: Ashburn, United States
Login IP: 54.208.84.215
 SOC AUTOMATION

Best Practices

Validate Data Integration Sources

Enlist Peers to Test the System

Scope The Prototype

Set Your Expectations

Fail Fast
 SOC AUTOMATION

Lessons Learned

Consider Event Timing / Synchronization

Build in Error Handling

Enlist Communications Team

Start with Modest Workflow

LogicHub Automates:
Logic

Alert Triage Reduce false positives by 95%

Incident Response Reduce response times (MTTR)

Threat Hunting Detect unknown threats

Next Generation Security Automation:

•Founded in 2015
•Headquarters: Mountain View, CA
Traditional SOA Vendors

Threat Hunting Alert Triage Incident Response

BILLIONS

THOUSANDS
HUNDREDS
TENS

Eliminate
Detection
False Incidents
Rules Alerts Positives

( Security Events )

Ignored
Notifications
Security Automation Platform:

End-to-End Intelligent Automation for Detection and Response

Alerts SIEMs
Automation

Integration Framework
Framework
Ingestion Framework

Log Aggregators Security Products

Deep
Threat Intelligence Ranking Case Management

Security Products Network Management

Human
Feedback
Cloud Logs Any API enabled system
LogicHub Integrations
90+ and counting, including:
Investigative Ticketing Systems Threat Intelligence Vulnerability Remote Access
Management

Identity Management Cloud

AWS Cloud Trail

VPC Flow Logs

freegeoip
Messaging
ICANN WHOIS SIEMs
Endpoint

dig
ET Intelligence
LogicHub Sample Use Cases
 Thank You!

Tammy Sexton

VP Sales
612-961-6672
tammy@logichub.com
Q&A