SplunkLive! Austin Customer Presentation - Baylor
4 likes550 views
- Baylor University is a private Christian university in Waco, Texas with over 17,000 students. The CISO, Jon Allen, built the university's security program from the ground up over 17 years. - Before Splunk, it was difficult and inefficient for the security team to search logs and get the information they needed across different systems in a timely manner. - Splunk provided a single platform to integrate and search all their log data, allowing the security team to quickly gain visibility, troubleshoot issues, and meet compliance requirements. It also helped break down silos between different IT teams. - Splunk has improved operational efficiency by reducing the time to find information from hours to minutes. It also fosters
SplunkLive! Austin Customer Presentation - Baylor
- 1. Copyright © 2016 Splunk Inc. Baylor University Jon Allen Assistant VP & CISO
- 2. 2 About Baylor University • Chartered in 1845 • In Waco Texas, the state’s oldest institution of higher learning • Nationally ranked research institution • Private Christian university; world’s largest Baptist university • Tier 1 school among national universities • 17,000 students • 3000-3200 faculty / staff
- 3. 3 About Me • Assistant VP & CISO — First full time info security employee here at Baylor, here now 17 years — 13 years in information security — Started the security program & built it up from the beginning • BS, Political Science; Masters, Computers Science; CISSP • Forensic examiner, give 6-10 presentations a year, publications • Manage 3 full-time security analysts • Team runs Splunk environment; performs security reviews on new products, security awareness, instant-on response, forensics, vulnerability management, security compliance consulting
- 4. 4 Before Splunk: Highly Inefficient • It was hard to get the info we needed quickly — Had to log in to each domain controller separately — Local searches and for different roles were tedious • No ability to cross reference & make sense of data • Operating in traditional siloed IT groups • Vendors would decide what was important, and were often wrong • Experiencing account lockouts across domain controllers in high-use environments • End result = poor customer service “We had a good idea of what we needed to know, but it was very hard to get that information in a timely manner.”
- 5. 5 Choosing Splunk • Splunk started as a small PCI network project — Needed to meet login requirements for processing transactions • We were looking for more than the usual “compliance in a box” • We needed solutions for bigger problems, such as: — Identifying lockouts across domain controllers — Resolving horribly inefficient log, search, and service issues • Splunk gave us tools to pull our data together & cross reference it • Unlike other vendors, Splunk was flexible & allowed us to map risk for the education environment ourselves • It was clear from the beginning, Splunk was a very powerful tool — Ops team loved the applications for them — We helped get the net plus agreement in place (1st school to sign on) “Once our OPS guys got a little taste of Splunk, they were hooked.”
- 6. 6 Splunk Benefits • From a low headcount staff perspective, our savings have been in resources – people and saving time. Finding information has gone from hours to minutes. • Splunk puts everyone on the same page. Everybody has access to the same information, which breaks down silos. • Information security is about “protecting your treasure” as much as you can. With Splunk, we can quickly see if something is in isolation, a trend or requires action. • It’s not always how can I prevent breaches, but how can I minimize and control them. Splunk is a great tool for that. “Splunk has helped our team build credibility because we’re bringing something to the table that helps people get their jobs done and done well.”
- 7. 7 Splunk at Baylor University • 400 GB license • Large central IT organization • 30+ users: • Architecture: – Netflow and firewalls largest data sources (firewalls 40 percent of license) – 10 servers – 3 indexers; role-based access control 100+ Universal Forwarders 3 Indexers 3 Search Heads + 1 Deployment Servers
- 8. 8 Logs & Third-Party Apps at Baylor • DNS monitoring • Radius logs • Crashplan • Qualys • Box, Duo • Cloud services • CloudFlare • Office 365, Microsoft PA
- 9. Splunk Use Cases Security Visibility/Search/Analytics DashboardsOperational Efficiency Early Use Cases – PCI Compliance, Ops, Troubleshooting
- 10. 10 Splunk Early Use Cases • PCI compliance • Ops cases: — Mail logs and searches, authentication, AD, Shibboleth • Troubleshooting — Vendor “sent message claims” – easy to verify • Being able to visualize data with illustrations • Security (Phase 1) – SIEM (Security Information & Event Mgmt) “For us, the piece that’s a plus & a minus is you can do so much. You do the first 5 things & then it’s ‘Where does my imagination take me?’”
- 11. 11 Splunk for Security • We gained proactive security vs. reactive ‘insecurity’ – Real-life fix: When we saw failed Box authentications, research revealed SNMP misconfigurations, not threats – Splunk helps us uncover & resolve those “non-threat” threats • Splunk provides a common language - everyone sees the same thing, independent of different tools • Splunk allows us to build strong relationships and support procedures (ie, we don’t run the firewall/IPS systems but we support the teams that do) • Dealing with the “noise” – IT security is challenged to find the valuable noise among all the noises (malware, phishing, spearing) – We can identify a problem source, talk to the right people & take action in minutes vs. hours (drastic time shrinkage) “In security, you’re not trying to find a needle in a haystack. You’re trying to find a needle in a pile of needles.”
- 12. 12 Splunk for Visibility/Search/Analytics • The “single pane of glass” is by far the most powerful thing about Splunk — Network logs, traffic logs, authentication are all visible from one screen — Cross referencing is easy and extremely useful — Everyone across the organization can see the same thing • Splunk supports visibility off campus where it’s typically lost – cloud, vendors, Box • Monitoring/real time analytics — Load balancers, firewall connection rates — Having screens up so you can see issues is very helpful “At the end of the day, Splunk is a sandbox for our data. We pull all our data in the sandbox and decide what kind of castle we want to build today.”
- 13. 13 Splunk for Operational Efficiency “We are all trusted to access read-only data so we know what everybody searches, which helps us move forward and build efficiency into the organization.” • We’ve built a very collaborative environment — Everyone gets “deputized” to do what needs to be done — We work with and support other teams working together (networking, firewall and server teams) — By nature, Splunk fosters collaboration • Splunk has opened up traditional IT silos – server / IT / firewall teams – efficient, effective searches build trust • Cloud computing — Most vendors don’t understand cloud computing -- you’ll lose visibility without the right tools — We know that’s the direction we’ll be going in — Splunk is working on those tools and can take us there
- 14. 14 Splunk for Dashboards “There can some time and investment in creating a custom dashboard, but the benefit of seeing all that data in one place is huge.” • Our PCI log review dashboard is a significant investment — Our analysts use open source tool OS X for file integrity monitoring; Microsoft log numbers, OS X specs, firewall info — Within a very short time our analyst created a dashboard that includes data to meet log review reqt’s – all in one place • We support many different custom team requests — SysOps needed a dashboard showing who hasn’t had a successful backup after 4 days — Vendor interfaces that normally don’t work easily, can be pulled into Splunk • Predictive analysis - 2 years ago, we created a dashboard that shows network pinch points needing > capacity
- 15. 15 Splunk A-Ha Moment • Now with Splunk, the security team doesn’t have to be the one pushing initiatives • Example: When we needed to move on a project: — In the past, would have required multiple meetings, hard conversations, going to the highest level — Now, they ask us “Why aren’t you doing this?” — Huge change! • This high-level buy-in only happens with a significantly useful, game-changing tool “The real power and value comes when I start understanding what I need to look like in the future or what may be coming down the line that I haven’t even thought of yet.”
- 16. 16 Users • Vice President, deputy CIO, associate VPs • OPS team; systems operations • Server and networking team • Web & marketing • Client services; helpdesk, desktop support • Mobile support • Administrative systems • ERPs, database management
- 17. 17 Splunk Words to the Wise…. • With Splunk, you can jump right in and get your feet wet quickly, but then you have to take that step back and understand what you really want to do. Then you start reaping the benefits more and more. • Avoid the pitfall of underestimating the size of the license you’ll need. • Similarly for your platform, make sure you have sufficient hardware capacity for what you want to do so Splunk can run efficiently. • Make the necessary investments so your platform will perform to meet your users’ needs.
- 18. 18 Splunking Ahead…. • Greater expansion into cloud services — Microsoft project • Fischer hosted identity management system • Looking for new ways to leverage the investment in Splunk — Potential in managed services — Augmenting staff resources • Greater participation with vendors and Splunk for their customers’ benefit
- 19. 19 Splunk Successes • Initially Splunk was another tool in the toolbox. Splunk is now our analytics tool, and we’re not renewing our traditional tools anymore. • With Splunk, there’s no finger pointing because we have a place where everybody knows to go for information and that’s been a huge value. It’s becoming a kind of universal expectation within the organization. • Splunk has helped our team provide a valuable service in helping the organization as a whole. 19
- 20. Thank You