Security

Review: Cortex XSOAR Protects Against Common Threats in Higher Ed

The automated platform allows users to set custom responses to cyberthreats and incidents.

Carlos Soto is an award-winning reviewer and journalist with 20 years of experience covering technology and business within various sectors and industries.

In higher education, reputation is essential, and nothing shatters a good reputation faster than a high-profile cybersecurity attack that compromises the personal data of students and staff or steals other sensitive or legally protected information. Compounding the challenge of thwarting cyberattacks is the fact that educational institutions often have limited staff, resources and budget to put toward cybersecurity, even though they are under constant threat.

One solution that has proved to be a big help — both in extending cyberdefenses and in reducing attacks — is automation. Automating the mitigation of low-level attacks can reduce up to 90% of the threats that are stalking colleges, universities and other schools. Eliminating that part of the threat landscape provides smaller staffs the opportunity to concentrate on advanced threats that could do real damage.

Automation can also help with incident response when time is of the essence. Instead of giving attackers who get past firewalls and other frontline defenses days, weeks or months to further scope out their target, they can be blocked by well-informed humans in just a few hours. They could also be removed almost instantly using properly tuned automation that is given sufficient permission to act independently, with reports going to humans for review after the fact.

Click the banner to learn why good cyber resilience is essential to higher ed security.

x-cyberresillience2-static-2024-na-desktop

x-cyberresillience2-static-2024-na-mobile

Automated Security Helps IT Teams Do More With Less

The Cortex XSOAR platform from Palo Alto Networks was created with the demands of a highly targeted environment such as education in mind. I was able to review the platform running in a test environment and found it to be helpful in eliminating many threats automatically and assisting human workers with mitigating others.

As the industry's first extended security orchestration and automation platform (hence, the name), Cortex XSOAR simplifies security operations by unifying automation, case management, real-time collaboration and threat intelligence. It’s a complete package that is surprisingly easy to deploy and manage, even for smaller IT staffs.

The first thing I noticed about XSOAR is its easy-to-use interface and intuitive user experience. Adding to the ease of use is robust functionality that’s native to the platform, especially when customizing features to the nuances of your users and enterprise. That high level of customization is key to many higher educational institutions whose networks differ from those of most companies. For example, schools have large swaths of their networks that are open to the public, commingling with classified areas and common workspaces. Being able to customize protections and acceptable risk levels can keep everything secure while providing access to students and staff.

Cortex XSOAR Allows Users to Customize Responses

The platform’s automation and response capabilities are especially impressive. XSOAR delivers native threat intelligence management that can be tailored specifically to the environment, meaning that key intelligence about the most likely attacks will be prioritized. According to Palo Alto, that can reduce incident response time by 90% or more. A key part of the automation platform, an incident response “war room,” empowers teams to collaborate during mitigations and helps with post-incident analysis and training.

The automation even extends to the responses themselves. Users can customize how they respond to different types of threats and incidents using playbooks. When a similar threat comes along again, users can go through those playbooks to reach similar conclusions, or even have the platform automate much of that response.

Of course, automation is only effective if a platform is smart enough to act properly without human intervention. In my testing, the XSOAR platform was successful in eliminating over 90% of the most common threats without any human intervention. That could free up staff to concentrate on the most dangerous and complex security challenges — humans in the driver’s seat, with help from Cortex. In any case, threat remediation can be handled much more quickly, if not instantly, with Cortex on the job.

Higher education is in the crosshairs of attackers these days. A platform like Cortex XSOAR can help to even the odds, giving a big boost to limited IT staff, handing many attacks on its own and assisting with everything else.

SPECIFICATIONS

BRAND: Palo Alto Networks
PRODUCT LINE: Cortex XSOAR
MODEL: Threat intelligence management
OPERATING SYSTEM: Linux, MacOS, Windows
SOFTWARE TYPE: Annual license per user

Side-Step Top IT Security Issues in Higher Ed

Higher education, like other industries, is subject to myriad cybersecurity threats. Attackers often target higher education institutions due their vast stores of vital information and because attackers know that IT budgets in education are often limited. From personal information and financial data to information about research projects, higher education is a veritable cornucopia of valuable data for all kinds of attackers.

These breaches often result in identity theft, financial loss and damage to the institution's reputation. Internally, IT staff can become exhausted and stressed. The volume of IT security data that must be sifted through on college networks can be overwhelming for security teams to manage.

The key types of attacks, security incidents and vulnerabilities that are often faced (and what a platform like Cortex XSOAR can to do help) include:

Phishing attacks. Phishing emails and websites are commonly used to trick students, faculty and staff into revealing sensitive information, from passwords to account numbers. A tool like XSOAR can help orchestrate all other cyber solutions to help staff thwart attacks that lead to unauthorized access and account takeover.
Insider threats. Sometimes malicious but often accidental (following a phishing attack, for instance), insider incidents can be triggered by employees, students, visitors, vendors and others who use a university’s hybrid public and private networks. They are often difficult to detect because an authorized user is part of the attack. But tools like XSOAR can detect anomalous activities outside of traditional workflows and either take pre-emptive action or alert human staff.
Lack of security awareness. The added free time that IT staff gains from using the XSOAR automated platform could allow them to educate students, faculty and staff about security best practices so that a basic level of cyber hygiene can be achieved. This can help to eliminate the vast number of low-level threats.
Legacy systems. Many higher education institutions use outdated software, and older systems may not receive regular security updates or patches. These systems are more vulnerable to attacks and may not meet current security standards. By implementing XSOAR, IT security teams are empowered with out-of-the-box integrations that can be used to wall off those assets and provide a level of protection without the need to do an immediate rip-and-replace.
Bring-your-own-device policies. Most universities let students and faculty use their own devices on campus networks. There would be a rebellion if personal devices were restricted. That is an accepted part of the culture, but it does create additional security risks. XSOAR can generate playbooks regarding proper security practices to ensure that all connected devices meet security standards. Playbooks can also be followed if an attack comes in from a smartphone or other external device, speeding both detection and mitigation of those tricky threats.