Case Study

TDOT
Tennessee Department of Transportation Counts onForescout to “Guard the Guards” and Reduce Risk ofBusiness Disruption or Breach95%

27 HOURS$500K

of devices auto-classified

time savings per week

in annual savings fromreduced insurance premiums

Overview

Industry
Transportation, Government

Environment
5,000 wired and wirelessendpoints statewide, including IT,IoT and OT and devices in remote,campus, cloud and data center
environments

Challenge•

Reduce risk of business disruption
from security incidents orbreaches•

Continuously ensure anddemonstrate security complianceacross all devices connected tothe network•

Drive security operations
efficiencies and efficacy throughintegration and automation

The Tennessee Department of Transportation (TDOT) serves the transportationneeds of the state’s 5.7 million residents across the state’s 14,000 miles ofroadway as well as railways, waterways and 80 airports. To reduce the risk ofnetwork disruption or a security breach, TDOT’s cybersecurity staff wanted
absolute visibility of all devices—including IoT and OT devices, virtual machinesand network infrastructure—so it could validate the integrity of data generated byits other security tools. With the Forescout device visibility and control platform,
TDOT gained comprehensive, real-time visibility across all the enterprise’sendpoints and a “source of truth” to check the trustworthiness of information
generated by other security systems in its environment. The Forescout solution
addresses additional use cases at TDOT as well; for instance, from its first hour inproduction, it began helping to improve device compliance. Since then it has also
resulted in significant, measurable time and cost savings.

Business Challenge“If one of our key security tools is compromised and starts giving us dishonest
information, how will we know?”— Richard White, Cybersecurity Architect, Tennessee Department of Transportation
Strategic Technology Solutions (STS), the State of Tennessee department thatruns and controls information technology for the state’s government operations,runs TDOT’s switches and routers and controls some of its Active Directory andother security controls. Consequently, the TDOT cybersecurity team lacks accessto things like switch management for discovery purposes. They could direct aswitched port analyzer (SPAN) at their security tools to monitor traffic but they had
no way to validate patches or other compliance-related information on devices
without requesting a report from STS.

Security Solution••

Forescout platform•

Forescout eyeExtend for Splunk

Forescout eyeExtend for
Symantec Endpoint Protection

Use Cases

•••
•
•
•

Device visibility
Asset management
Device compliance
Network access control
Incident response
Network segmentation

Results“We have a lot of great security tools protecting our endpoints—but we needed away to obtain visibility across devices without going through STS,” explains TDOT
Cybersecurity Architect Richard White. “We also desired a way to make sure thetools are being honest, that they haven’t been unknowingly compromised.”

Why Forescout?
Comprehensive Visibility Proves Business Value in Less than an Hour
When the TDOT cybersecurity team learned that the Forescout device visibility
and control platform provides agentless device discovery and classification in realtime plus continuous posture assessment, they decided to test it in a two-week
proof of concept using live data. “The quality and breadth of data the Forescout
platform provided and all the use cases it could address, from device complianceand detection of rogue devices to asset management and incident response,
impressed us all,” recounts White. “Plus, we would no longer have to wait on otherpeople to gain visibility or control.”The team was also amazed at how quickly the Forescout platform began proving
its worth. “We plugged in the Forescout appliance, and in less than an hour it was
fully operational, and we were collecting valuable data that would help mitigate
compliance risks and validate other sources,” White continues. “In every aspect,deployment was quick and easy. For instance, in less than two hours we weremonitoring Voice over IP at all of our traffic management centers.”•Reduced risk of businessdisruption from a security
incident or breach•Business value evidenced within
one hour•Auto-classified and categorized
over 95 percent of devices out of
the boxBusiness Impact•

Rapid discovery and remediationof the 10-15 percent of total
devices found to be noncompliant•

Continuous assessment ofdevices as they connect to thenetwork to enforce compliancepolicies“We have Cisco Identity Services Engine (ISE), network traffic analyzers, AI-based
behavioral analysis software and other security products—but the Forescout
platform found everything on our network better than any of them,” claims White.
“For instance, it detected a computer still running Microsoft XP that neither
Active Directory nor any of our other tools caught. It also gave us highly granular
information and produced the best asset inventory we’ve ever had.”•Time savings of 27 hours perweek (more than two-thirds of
one full-time employee)•Cost savings of $300,000 to$500,000 annually from reduced
insurance premiums•Automated incident response
actions thanks to integration
with Splunk SIEM

•Accurate asset inventory acrossIT and OT networks, including
agentless devices•A robust, truly multi-layered
cyberdefense to provide
confidentiality, integrity andavailability

Discovered Noncompliant Devices that Other Security Tools Missed“Forescout gives us the critical integrity piece of the ‘CIA triad’—confidentiality,integrity, and availability,” adds White. “Without integrity, the other two are of novalue. You need to be able to trust your systems when they tell you your data isconfidential and available. The Forescout platform lets us know whether their data
can be trusted.”

Improved Device Compliance with Real-Time Posture Assessmentand Classification
In addition to the PC running XP, the Forescout platform’s real-time device postureassessment uncovered workstations that needed patching or upgrading, devices
with Telnet turned on that they had thought had been turned off, legacy machines
without strong password capability, and other at-risk, noncompliant devices. In
total, it found 10 to 15 percent of all devices lacked compliance to some degree—which TDOT staff immediately addressed.
To aide with compliance, TDOT also uses the Forescout platform to automaticallyclassify and categorize more than 95 percent of its devices. For instance,classification by the street zone segment in which the device is located enables

“Forescout gives us thecritical integrity piece of theCIA triad. Without integrity,
the other two are of novalue. You need to be able
to trust your systems when
they tell you your data isconfidential and available.
The Forescout platform lets
us know whether their data
can be trusted.”— Richard White, CybersecurityArchitect, Tennessee Departmentof Transportation

application of the strictest security policies to devices within critical infrastructurezones.

Saving 27 Hours Each Week Through Centralized Visibilityand Automation
By automating and streamlining manual activities, the Forescout platform saves
the TDOT cybersecurity team approximately 27 hours each week—more than
twothirds of a full-time employee. “To find information about devices on thenetwork, we no longer have to sit and wait for a ping sweep or go to four or fivedifferent systems and pull log files,” White explains. “We now have one central
place to answer all our visibility-related questions—what IP addresses are currently
active, where a specific device resides, where all the devices of a given type
are, how many there are, when they were last logged into, which version of an
application they are running, which devices need updating, which were affectedby an incident, and so on—all without requiring agents or writing scripts. The
Forescout platform really is a one-stop shop for visibility.”

Saving $300,000 to $500,000 Annually in Insurance Premiums
Thanks to the Federal Information Securities Modernization Act, U.S. government
entities can submit an incident response plan to receive a discount on the liability
insurance premiums it pays to cover the financial impact of a breach. TDOT
submitted a plan featuring the Forescout platform as a key component. “Ourincident response plan saves us between $300,000 and $500,000 each year indiscounts—or between $900,000 and $1.5 million in three years,” notes White.

Orchestration to Help Automate Incident Response and Bolster
OT Defenses
TDOT has also been piloting and plans to implement Forescout eyeExtend forSplunk to integrate the Forescout platform with its SIEM. The Forescout platform
discovers infected devices and sends the information to the SIEM, which thenautomatically initiates policy-based mitigation actions to contain and respond tothe event. For instance, it can alert users, initiate scans by another security tooland share real-time context with other incident response systems to acceleratequarantining or other remediation.
The TDOT Cyber Security plan is standing-up a Cyber Security Protection team(Flat-Earth) to monitor the Active Intelligent Traffic Network (Active-ITS) 24/7.
Extending the Forescout platform and integrating with Splunk, the Computer
Protection team will have additional tools to analyze zero-day events. TDOT’s
Active ITS network is a critical infrastructure serving drivers throughout the Stateof Tennessee. Information must be accurate and have the integrity to ensure
travelers make a safe destination while travelling on Tennessee highways.
In addition, TDOT plans to use other Forescout eyeExtend products to gain
workflow interoperability with other security tools, enhancing their effectivenessby providing greater situational awareness. “Our goal is to have the Forescoutplatform, Cisco ISE and other security solutions all working together to watch one
another and keep us safe,” says White.
TDOT is also currently evaluating Forescout SilentDefense™. “Forescout
SilentDefense is the most advanced and mature OT network monitoring and“We have Cisco Identity
Services Engine (ISE),
network traffic analyzers,
AI-based behavioral
analysis software and othersecurity products—but theForescout platform foundeverything on our network
better than any of them.
For instance, it detected
a computer still running
Microsoft XP that neither
Active Directory nor any ofour other tools caught. Italso gave us highly granular
information and produced
the best asset inventory
we’ve ever had.”

intelligence platform available,” explains White. “We want to use it to automaticallylearn and validate network communication patterns, and to apply the most indepth analysis of industrial protocols to create network and protocol whitelists.”
TDOT’s success with Forescout has other departments within the Tennessee
government considering the Forescout platform too. “Buying the Forescout
platform is the best first step for improving device compliance and reducing therisk of a security incident or breach,” states White.

— Richard White, Cybersecurity
Architect, Tennessee Departmentof Transportation

Forescout Technologies, Inc.
190 W Tasman Dr.
San Jose, CA 95134 USA
Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support +1-708-237-6591

Learn more at Forescout.com© 2020 Forescout Technologies, Inc. All rights reserved. Forescout Technologies,
Inc. is a Delaware corporation. A list of our trademarks and patents can be found at
www.Forescout.com/company/legal/intellectual-property-patents-trademarks.
Other brands, products, or service names may be trademarks or service marks of
their respective owners. Version 05_20B