Education case study: protecting against cyber attacks with security monitoring
Security monitoring for a training provider: learning platform, administration and endpoints in one analysis, with defined reporting and response paths.
A further education provider wanted to know whether it would notice an attack on its learning platform and administration at all. The answer, at first, was no.
Brief and scope
Three sources, one analysis, defined reporting paths.
Environment
A provider of seminars and further education with a learning platform, administrative systems and a growing number of endpoints.
Brief
Build security monitoring that evaluates the three areas together and reaches someone when something happens.
Constraint
A small team with no security department of its own. Whatever gets built has to stay operable without specialists.
Data present, no analysis
Log data was produced in all three areas and evaluated in none. A login attempt from abroad, a new administrator account or an unusual data retrieval would have been recorded technically but seen by nobody.
On top of that came the question of responsibility: without a defined reporting path, even a detected event would not have reached someone who could act.
Start small, but complete
The learning platform, the administration and the endpoints were connected and normalised onto a common schema. The use cases were deliberately limited to a few scenarios that hold up: access outside the usual times and places, changes to permissions, unusual data retrievals.
Alongside them, reporting paths with named responsible people and a short instruction per scenario. For a team without a security department, that is the decisive part.
What you can take from this
Monitoring does not have to be complete to work. Five scenarios that hold up, with clear reporting paths, are worth more than fifty rules nobody assesses.
The question is rarely whether the data exists. It almost always does. The question is whether anyone looks, and whether that person knows what to do next.
Related to this case study.
A similar project?
Referenzdetails nennen wir nach Freigabe und im persönlichen Gespräch.