Techfite Case Study

Techfite Case Study A. Summary of the Organizational Need Techfite manufactures medical devices for space programs and is looking to grow internationally. Techfite is looking to invest in a new system that automates log correlation for both host-based and network appliances. Techfite generates a large amount of log data due to the multiple firewall and honeypot security system currently in place and does not have the manpower to manually audit the log data. Techfite is looking for a system capable of scanning the log data for potential attackers after systems have been compromised, the system administrators would like to be alerted by a new system that meets FISMA regulations when potential attacks are occurring on host and network systems. B. Solution Keeping the business needs of Techfite in mind, while also staying in compliance with FISMA and NIST, I believe that Elastic Cloud provided by Amazon Web Services and powered by Amazons i3 infrastructure would be the best option. According to aws.amazon.com, Elastic Cloud on AWS gives users the ability to run pre-built SaaS solutions for Enterprise Search, Observability (logging, APM, metrics), and Security. Elastic's Security solution includes SIEM and Endpoint capabilities and has been used throughout the world for everything from straightforward incident visualization to advanced cybersecurity. Elastic Cloud also comes with Kibana, a customizable dashboard and reporting application, for real time event log reporting and monitoring. Kibana is capable of viewing real time and archived events and trends as well as using machine learning to respond to events and alert or notify administrators of potential threats. C. Adoption Process Techfite must weigh the benefits and the risks moving forward with a new technology. Any change in an IT environment, especially one with such strict security requirements, brings with it the possibilities of adopting an out of date or unsecure technology or process. AWS is a solid choice as it is one of the most popular services due to the face that it is secure and easy to adopt. Adopting this new service will benefit Techfite by: Decreasing the man hours spend auditing logs. Ensure Techfite stays within FISMA compliance. Has support from the service supplier (Amazon) moving forward, Increasing the security of Techfite’s network Keep Techfite InfoSec manager up to date on any potential risks and vulnerabilities. C1. Adoption Steps SCOPE: Techfite needs a new service for auditing logs as well as working as an IPS/IDS for the increasing amount of data due to going international. Techfite will also have to stay in compliance with FISMA moving forward. TRACK: Techfite is seeking out a emerging technology that can keep in compliance with FISMA while also meeting their needs of log storage and automated log auditing. RANK: Techfite will compare the two technologies (Elastic cloud and Splunk) and determine which is a better fit for their company. Choosing the tech that fits with Techfite is an important step because implementing the wrong tech can be costly and cause serious harm to Techfite. EVALUATE: Techfite will pilot the technology determined to be the best fit for them. Piloting a new technology is important as this is a hands-on test run of Elastic Cloud. EVANGELIZE: Techfite will need to overcome any organizational resistance when in the implementation phase. People are often resistant to change and this step is important in pushing through the resistance and continuing with the adoption process. TRANSFER: Techfite will need to begin the implementation process once the company has come to terms with the new service. The work will be handed over to an implementation team to work on integrating the service into the existing network. D. Impact When adopting new services and technologies, the company always hopes that the new service fixes all their problems with out adding any additional ones. That if hardly ever true. Most new technologies, services and processes bring about their own unique suite of problems and issues. The best course of action is hoping the new service opens LESS issues and problems than you had before the adoption process. Changing the network to make room for the new tech could affect the infrastructure in many negative ways. It could leave a different part of your network vulnerable without a course of action to correct it. The supplies (Amazon) could have a national outage causing the service to go down and Techfite would not have anything monitoring the security logs. The positive impact of adding Elastic Cloud through AWS is obviously decreasing man hours auditing logs while increasing notification time for security issues. Any network vulnerabilities that arise due to the installation of the new service will be handled with care while assuring Techfite stays within FISMA compliance. E. Comparison Splunk is another similar technology that Techfite could consider. But I believe that Staying with AWS would be the best option due to the flexibility AWS offers over Splunk as well as the pricing. AWS would be the more cost-efficient service.