Case Study

Financial Services Firm
Financial Services Firm Counts on Forescout for Device
Visibility, Policy-Based Segmentation, Threat Response andCompliance Enforcement$415K

2 WEEK$2M

gained in average annual
benefits

Implementation

total annual benefits savedin 5 years

Overview

Industry
Financial Services

Environment

A growing financial services firm with approximately 100 branch offices in thesoutheastern United States requires a heterogeneous network that is both flexible
and tightly secured. As you’d expect, the firm’s 2,600 employees use all kinds ofnetwork-connected devices, including corporate-owned PCs as well as personallyowned (BYOD) smartphones and tablets. IoT devices such as ATM machines
and security cameras are also part of the mix, which comprises around 12,000
connected endpoints on any given business day.

Headquarters plus 100 brancheswith 12,000 connected devices
comprising Windows PCs and virtualmachines, ATMs, cash-management
devices, teller machines, cameras,
stock tickers and more

Challenges•

Identify, classify and manage
connected devices on thenetwork

Prior to deploying the Forescout platform, the firm had been depending on anetwork access control (NAC) solution that was by all accounts primitive. Anyone
logging on would be directed to a guest registration page and either granted
access to an internet-only guest network or to the internal network. But that
was about all it could do. For a whole host of reasons, the company’s Security
Operations Center (SOC) team wanted much more.

Business Challenge
There’s no way around it: financial institutions will always be prime targets forcybercriminals, and that makes their security requirements and risk reduction
extremely complex. Confidential customer data must be protected at all costs,multiple regulations must be complied with, and the network must be secure
yet readily available to employees, customers and contractors. Specifically,challenges include:• Preserving customer trust by protecting data privacy•

Ensure device hygiene
without impeding services ortransactions•

Comply with FDIC, GLBA, PCI
and other regulations•

Securely accommodate BYOD
and guest endpoints•

Maintaining a strong security posture without impeding business operations•

Staying in compliance with FDIC, GLBA, PCI DSS and other regulations

Improve security posture while
reducing total cost of ownership•

Adding new types of devices and services to networks without adding
vulnerabilities•

Security Solution•

Ensuring that connecting and already connected devices meet baseline
compliance requirements•••

Forescout Platform•

Accommodating BYOD and guest endpoints without compromising security

Forescout Enterprise Manager•

Orchestrating existing security tools into a unified solution that accelerates
incident response and reduces vulnerabilities•

Forescout eyeExtend for IBMQRadar•

Forescout eyeExtend for
Rapid7 Nexpose•Forescout eyeExtend forServiceNow•

Forescout eyeExtend for
VMware AirWatch•

Forescout eyeExtend Open

Forescout eyeExtend for Palo
Alto Networks WildFire

Integration Module (OIM)

Use Cases••••••Device visibility
Network access control
Network segmentation
Incident response
Device compliance
Asset management

Why Forescout?
The company’s previous technology left a lot to be desired. An older-model Bradford
Networks product, it was a basic tool that wasn’t suited to a banking environmentthat required an intelligent, feature-rich cybersecurity solution. The firm’s Deputy
CISO and his SOC team knew better solutions were out there. Cisco ISE was briefly
under consideration, but it wasn’t seen as a solution they could deploy quickly.
Besides, the word on the street was that the Cisco product was difficult to use. Incontrast, the Deputy CISO had nothing but good experiences with the Forescout
platform while working for one of the U.S.’s biggest healthcare service providers
prior to joining the financial services firm, and he’s still very positive.
“Not only can Forescout isolate devices and do network segmentation, it can also
discover networks that haven’t been seen previously,” he said. Then he rattled offother reasons:“It can push scripts. It can discover detailed information. It builds inventory overtime of what you’re seeing. You can switch VLANs on the fly. I mean, it’s a powerfultool. It does what you tell it to do.”
And perhaps most important, there’s absolute agentless visibility. When the SOC
team decided to bring in Forescout for a proof-of-value assessment and got theirfirst look, they were amazed at what the platform revealed about endpoints on
the network.
“We were seeing devices we didn’t know we had,” said the SOC Manager. “There
were old legacy networks that people thought were decommissioned that still had
some log devices on them. We were getting to see all the different devices at thebranch-office level—all kinds of things that weren’t previously documented.”Once the team decided to move forward with Forescout, deployment wentsmoothly. With the Forescout platform in place, it was just a matter of getting
the appliances connected to the core, standing up the network segments andconfiguring policy. The company chose a centralized deployment model that runs
Forescout appliances at the corporate data center’s core switch and replicates afailover cluster at its backup data center. The Forescout platform has full accessto the company’s entire switching infrastructure as well as all virtual devices. “We
had it fully operational in about two weeks—at least for the initial requirementof segmenting devices off the network that weren’t supposed to be there,”commented the company’s SOC Analyst.
With 2,600 employees at 100 locations all using multiple devices running a slewof applications—not to mention thousands of customers, contractors, analysts,regulators and media representatives plugging into the network every day—it’s
no wonder the security team appreciated the agentless visibility they gainedwith Forescout.

Results

Business Impact•

Fully operational in less than
two weeks

For this financial services firm, the Forescout platform provides intelligent
functionality that fits the bill on multiple levels.

•Real-time visibility and policybased control of networked
devices

Device Identification, Inspection and Isolation•

Automated security andcompliance controls, reducing
manual tasks•

Orchestration between theForescout platform andexisting security tools•

Optimized network
segmentation planning andimplementation•

Streamlined asset inventory
and reporting•

Improved device management
and regulatory compliance•

Gained $415,737 in averageannual benefits*•

Realized $215,458 in IT staff
efficiencies** Calculated by Forescout Business ValueROI Tool using IDC methodology“Before we were primarily
focused on detecting rogue
devices, isolating them off
the network and sending
us an alert. The additionof Forescout visibility
and scripting has beenawesome. It’s a huge tool in
our arsenal that we didn’t
have previously.”— SOC Analyst, Financial
Services Firm

The Deputy CISO and his team appreciate the ability to see the device and classify
its type, understand how long it has been on the network, identify open ports andmore. He noted that his team recently used the Forescout platform to isolate adevice on the network to stop it from beaconing out to a command-and-control
server and pulling in more malware.

Advanced Threat Detection and Containment
The company’s threat detection and response solution is built upon a combinationof the Forescout platform, Forescout eyeExtend for Palo Alto Networks WildFire™
(which provides orchestration), and Palo Alto Networks’ WildFire. “When WildFire
detects a malicious file or executable attachment, it sends the indicator ofcompromise to the Forescout platform, which can check other devices or inspect
network traffic for similar IOCs. If anything is found, Forescout quickly places
the device in an internet-only VLAN, where it can’t cause harm to other corporate
systems or access our resources,” explained the SOC analyst. This dynamic
segmentation is made possible through deep integration with more than 30 switch,
wireless and VPN vendors, and is just one of the policy-based control actions
possible on the Forescout platform.

Event Correlation, Analysis and Response
The SOC team also combines the intelligence of the Forescout platform with its
QRadar security information and event management tool via Forescout eyeExtend
for IBM® QRadar. According to the SOC Manager, the team feeds all Forescout logs
into the QRadar instance where devices get isolated. Then they do correlations on
all the data. If the combined solution detects something, it generates alerts to letthem know.

Scripting and Auditing
The security team uses the Forescout platform to verify that managed devices are
running Trend Micro full-disk encryption as well as Carbon Black antivirus and othersecurity applications. In addition, the SOC team uses the Forescout platform todeploy these security tools to new systems or ones that require remediation. “Wejust write a script saying “Install this software,” said the SOC Manager. “We push itout and then we use Forescout to audit to make sure our security tools are installed.
The ability to automatically run scripts based off certain policies is huge…The
addition of the visibility and the scripting has been awesome.”

Auditing and Compliance
The Forescout platform can run reports about assets on the network anddetermine whether they are up to corporate and regulatory bodies’ standards. Itcan quantify how many endpoints of a certain type are connected—how many
Windows 7 or Server 2003 devices are still on the network, for example. The SOC
team generates reports for their own purposes as well as for FDIC auditors andothers. To aid further in regulatory compliance, Forescout’s custom policy engine
can identify thousands of IoT devices— providing accurate, real-time inventories ofthe full range of network-connected devices to demonstrate compliance with SOX,PCI DSS and other regulations.

“The Forescout platform
discovers devices andcaptures detailed
information. It builds
inventory over time of what
you’re seeing. You canswitch VLANs on the fly. I
mean, it’s a powerful tool. It
does what you tell it to do.”— Deputy CISO, Financial
Services Firm

Managing Disparate Technologies Resulting From Acquisitions
The firm is growing rapidly, partly due to acquisitions. Its standard practice isto isolate network infrastructure that results from acquisition and “forklift” it toa completely new network. During the transition period, it’s not uncommon foremployees to try to connect their old devices. To ensure device compliance, theForescout platform automatically isolates these endpoints and notifies users that
there’s an issue: namely, that their equipment is unauthorized, unsanitized and unfit
for the network until appropriate hygiene measures are taken. Equally important,Forescout lets companies apply control across all infrastructures, including
switches, next-generation firewalls, SDN networks, cloud and microsegmentation
providers, and hypervisors—without requiring upgrades—to maximize M&A
efficiency and security.

Inventorying Assets
The company’s IT department is in the process of standing up a ServiceNow®
configuration management database (CMDB) and using Forescout eyeExtend
for ServiceNow to integrate the CMDB with the Forescout platform. When theprocess is complete, the ServiceNow CMDB will be able to leverage Forescout’s
real-time visibility and up-to-date intelligence when it comes to device properties,classification, configuration and compliance status. This will enable the security
team to get a current view of networked assets, track their movement and remediate
or retire those assets as required. In this way, the firm can gain a trusted data set,
improve asset compliance and provide the basis for informed business decisions.

Orchestrating Security by Sharing Intelligence
Over the years, the company has made significant investments in SIEM, VA, ATD,
AV and other key security tools. Through integrations made possible by Forescout
eyeExtend products, the network environment is now able to share contextual
device data between the Forescout platform and these security products—
automating policy enforcement across disparate solutions, bridging previously
siloed IT processes and accelerating system-wide incident response.

Forescout Technologies, Inc.
190 W Tasman Dr.
San Jose, CA 95134 USA
Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support +1-708-237-6591

Learn more at Forescout.com© 2020 Forescout Technologies, Inc. All rights reserved. Forescout Technologies,
Inc. is a Delaware corporation. A list of our trademarks and patents can be found at
www.Forescout.com/company/legal/intellectual-property-patents-trademarks.
Other brands, products, or service names may be trademarks or service marks of
their respective owners. Version 03_20