1. OIT Security Operations
November 10th, 2016

2. OIT Security Operations
The Enterprise Security Operations team is responsible for the day-to- day security operations for our state agency customers. The team works with other OIT teams to ensure the State’s security position is balanced between business needs and the current threat to technology resources.

3. Enterprise Support
The Enterprise Security Operations team works hand in hand with the Office of Information Security and implementing the Secure Colorado initiative.
The CIS 20 Critical Security Controls are part of the Secure Colorado Initiative. The implementation strategy relies heavily on the security layered defense model.
The four tiered (Endpoint Security, Network Security, SOC Services, Threat and Vulnerability Services) organization structure aligns with the CIS 20 Critical Security Controls strategy providing service at each layered defense level.
The Enterprise Security Operations team is currently assigned to planning, architecting/designing, implementing, and running the security control/layered defense within the state infrastructure.

4. Enterprise Security Operations Services
Endpoint Security Services
McAfee EPO
Virus Scan Enterprise, Endpoint Encryption
Policy Auditor
Host Intrusion Prevention System (HIPS)
Host Data Lost Prevention
Anti-spyware, Application Whitelisting
CIS Benchmark scanning
Web Filtering - Agency Based
Content Monitoring - Agency Based
Threat and Vulnerability Management Services
Vulnerability scanning ( Web, Application, DataBase)
External and internal Pen testing
Threat Intelligence
Network Security Service
Firewall
Change Request- installation, modification and monitoring
External DNS
VPN - Site to Site, Client based remote access
Security Operations Center Services
Perimeter monitoring
Incident response
Intrusion Prevention System/Intrusion Detection Systems administrator
Log management and correlation of state network traffic

5. Tools and Technologies
Intel (McAfee) Security Suite: Virus Scan Enterprise, Host IPS, Enhanced endpoint Policies, Global Threat Intelligence, Nitro - SIEM
Palo Alto – Vulnerability protection, Application ACL inspections, DDOS protection, WildFire
MS-ISAC Albert (IDS) services, US-Cert notification,
Currently review tools for Advanced analytics and threat detections

6. Current and Future Metrics
Current Metrics:
The ratio of managed to unmanaged assets
Security Incident recorded in ticket system
Number of machines patched
Trending reports from SIEM
Monthly Threat report from Cyber Joint Task Force
Maturity Metrics:
The ratio of managed to unmanaged assets
The mean time to patch critical vulnerabilities
The mean time to remediate an incident
The percentage of systems that that meet compliance standards
The percentage of users who fail selected social engineering tests

7. Key Factors for Maturing Threat Detection and Incident Response
Educate employees and IT staff – Currently providing quarterly security training for employees and IT staff. Additional training for IT staff focusing on first responders ability to identify a security event and elevation of security incident
Incident Response Table Top exercises – The state Office of Information Security and Security Operations are performing monthly table top exercise during our Security All Hands meeting. In order to familiarize ourselves with our incident response plans, identify gaps and improvements. Additionally, the state is participating in table top exercises with the national guard and educational partners
Alleviate admin burden (reduction of manual process) - Currently we are investing in solution to help automate incident response. The Intel (McAfee) MAR (McAfee Active Response), TIE/DXL, and ATD ( Advance Threat Detection) are in planning stages and will be identify threat and automate incident response. The state is also currently review Incident Response tools to help with tracking and providing standard operating procedure for handling security incidents.
Reduce poor security practices and behavior – This is a cultural change for the state in which we are working with the IT team to think security while developing solution. This is a continuous effort which we are beginning to see significant improvement.
North/South and East/West visibility - The state is beginning to posture itself to have visibility north, south, east, and west in each security zone. The initial phase was implemented two years ago when replacing the state perimeter and logically separating executive branch traffic from non-executive branch traffic.

8. Questions