Case Study

Hillsborough Community College
Forescout Scores High Marks for Visibility,
Policy-Based Control and Third-Party Integration

300Hr94%23.5

productivity gain each monthless infected systems permonthless devices that needto be reimaged each month

Overview

Industry
Education

Environment
6,500 college-owned endpoints
spread across five campuses with aheavy emphasis on wireless BYOD
(another 10,000 simultaneousconnections). The environment
supports separate domains foremployees and students.

Challenge• Gain visibility into BYOD
systems accessing the collegenetwork•

Enforce device compliance andsecurity hygiene policies•Reduce the need for system
reimaging and downtime due tomalware

Tampa Bay-based Hillsborough Community College (HCC) has grown into oneof Florida’s largest higher education institutions. Its 2,600 faculty and staff
members serve more than 47,000 students annually at five campuses and threeacademic centers. The ever-increasing digital nature of education coupled withdiverse populations of students, professors and support staff posed formidable
cybersecurity challenges for HCC information security specialists who sought tooffer users secure wired and wireless network access with minimal inconvenience.

Business Challenge
Bring Your Own Device (BYOD) is not just a way of life in college, it’s aprerequisite for participating in higher education. The need for secure mobility
was painfully obvious to Ken Compres, Hillsborough’s senior network security andintegration engineer/chief security officer, as he joined the college to bolster its IT
security in 2012. Students needed connectivity and wanted to stay mobile, whichis understandable given that the college’s facilities span 850 acres and morethan 64 buildings. At that point, students could go anywhere they wanted on thenetwork and connect with any device. “We were totally blind as to what systems
and devices were live on the network. My first task was to get some sort ofvisibility so that we could start to classify devices and begin tightening network
access controls to secure the college,” recalled Compres.
Compres and his team began evaluating network access and control solutions,embarking on an ambitious review process that included offerings from the fiveleading vendors at that time: Forescout Technologies, Cisco®, Blue Coat®, Aruba®
and Pulse Secure®. According to Compres, “We had to be thorough. With anetwork access control solution, you don’t want to put something on the networkthat would hinder the user experience, break peoples’ computers or become
overly intrusive to users. In addition, you need to fully understand how easily thetechnologies integrate into your existing environment.”

Security Solution• Forescout platform•

Forescout Enterprise Manager•

Forescout eyeExtend forFireEye NX and EX

Use Cases• Device visibility•

Device compliance•

Network access control•

Incident ResponseResults• Automated endpoint discovery,classification and remediation•

Orchestrated ATD/theForescout platform integration
via eyeExtend for FireEye•

Accelerated incident response
and containment to instantly
stop CryptoLocker propagation•

Cut user downtime and IT techreimaging/system restoration
time from 300 hours per month
to less than 18 hours•

Reduced data loss•

Minimized impact on users

Evaluation units were obtained and set up in a test lab for a side-by-side
assessment that began during the summer of 2012 and concluded in January of
the following year. Solutions were judged on the following criteria:1.
2.
3.
4.
5.
6.
7.

Agentless deployment capabilities
Ability to authenticate users against two separate domains, with and without
LDAP*
Ease of management, ability to separate user environment
Scalability
Compatibility with devices and network infrastructure
Ability to perform Simple Message Service (SMS) messaging without incurring
additional costs

Why Forescout?
After extensive evaluation, the Hillsborough team chose the Forescout platform.
Several factors led to their decision. “Agentless visibility offers a huge advantage,
and the Forescout platform was the only one that supported agentless operation,”
said Compres. “The Forescout platform, allowed us to gain the necessary insight
into the network by integrating with existing technologies and components.
In addition, a second finalist began crashing and preventing computers from
communicating with anything else, so it was a no-brainer to go with Forescout,”
added Compres, who also appreciated the fact that the Forescout platform cansend text messages without incurring additional costs of an SMS appliance.
After gaining in-depth visibility insights into who was on the network, the teambegan to carefully define the appropriate VLAN* segments for various connection
scenarios and test rules to enforce policies. The rules would automate policybased
enforcement of student and employee network access based on theiraccess privileges and endpoint compliance status, as well as limit access ofagentless IoT devices. The IT team began a phased deployment of the Forescout
platform, placing Forescout’s SecureConnector on employee systems and using
the dissolvable version of SecureConnector on student systems to allow agentlessvisibility and control.
Hillsborough’s massive mixed environment includes more than 1,000 Aerohive®
wireless access points, which initially placed added performance demands on
the the Forescout platform appliances. Forescout Technical Support worked withCompres and his team to customize the solution using an innovative whitelisting
technique, allowing each Forescout platform appliance to support more than 1,000
wireless access points. This approach proved so successful that it ultimately
became a supported 802.1X feature within the Forescout platform. “Forescout
Tech Support has been fantastic! I look forward to collaborating with them on
additional projects in the future as new needs arise,” stated Compres.

Business Impact
According to Compres, the Forescout platform’s impact on HCC’s ROI is anything
but academic. “Once we had the Forescout platform in place, our need to reimage
infected computers dropped significantly—from 20 to 25 each month to just
1.5 systems. It takes a support tech five to six hours to reimage the system
and restore the user’s documents, files and applications. Moreover, the user is“With the Forescout
platform, our needto reimage infectedcomputers dropped from
20 to 25 each month tojust 1.5. When you consider
staff resources and user
downtime, that’s a 240- to300-hour productivity gain
each month.”— Ken Compres, Senior Network
Security and Integration Engineer/CSO,
Hillsborough Community College

unproductive during that time, so you are literally wasting 12 hours per incident 20
to 25 times per month. That’s a 240- to 300-hour productivity gain per month.”
In addition, the Forescout platform does the following for Hillsborough Community
College:

Agentless Visibility
The Forescout platform sees desktops, laptops, tablets, smartphones, sensors,
network infrastructure, peripherals and wearable devices—without requiringexisting management agents. That’s a major advantage over Compres’ early days
at HCC. “Today we know what’s on our network—including IoT devices such as
printers, VoIP* phones and security cameras. The Forescout platform classifies thedevice and slips it onto the appropriate VLAN segment,” said Compres.

Continuous MonitoringOnce users are allowed onto Hillsborough’s network, The Forescout platform
continuously monitors their devices. “Security doesn’t end with complianceand remediation,” insists Compres. “Everything must be monitored. Is a device
scanning the network? Is it attempting to do some type of SNMP* trap or scanother devices on the network? We need these insights to not only protect ourassets on the network, but the devices and personal data of our users.”

Guest Access
The Forescout platform lets customers automate visitor enrollment while
enforcing policy compliance. This is particularly important in college environments
where students use multiple device types on any given day that vary wildly in termsof compliance levels.
When a user attempts to log on via one of the college’s wireless access points,
the access point queries The Forescout platform for 802.1X authentication. The
college also allows guests to authenticate via Facebook, Google or directly throughthe Forescout platform, which sends a confirmation email or SMS text to the end
user to confirm their identity.

Endpoint Remediation
The Forescout platform proactively identifies unsecured endpoints on the networkand can automatically remedy the problem based on policies. When an unknown
student device attempts to connect, The Forescout platform prompts the user toinstall the dissolvable version of SecureConnector. Within seconds, the systemdetermines the device’s patch level and the antivirus engine it’s running, including
the version level. “If they are compliant, we allow them to access the network
resources. If not, we limit their access to Internet-only,” explains Compres.
Hillsborough performs automatic remediation of both managed systems and
BYOD devices, granting appropriate access to resources upon system compliance.

FireEye Integration
Integration between the Forescout platform and FireEye® is another example ofsuccessful collaboration between Hillsborough and Forescout Technologies. Upon
acquiring FireEye NX in 2012 and seeing the access control and managementcapabilities of the Forescout platform, Compres began wondering, “Howcan I leverage this information from FireEye to make the Forescout platform
even smarter and automate threat response and remediation?” The team at

“We evaluated the fiveleading access and controlsolutions. Forescout was
the only one that supported
agentless operation andprovided the flexibility
to integrate with othersolutions.”— Ken Compres, Senior Network
Security and Integration Engineer/CSO,
Hillsborough Community College

Hillsborough began working to integrate the two solutions and eventually shared
its use cases and preliminary results with Forescout. After several iterationsof development and refinement, Forescout delivered an integration module toCompres for his team to beta test. “We immediately tested it in our environment
and it worked great,” said Compres. Today, the solution has evolved into theForescout eyeExtend for FireEye NX.
Shortly thereafter, the value of the integration became readily apparent. Compres
explains:“One of our systems became infected with CryptoLocker ransomware. As
soon as it tried to communicate with the command and control server tobegin propagating the ransomware across the network, FireEye saw thisand immediately informed the Forescout platform, which blocked communications
by dropping the infected system’s port. The Forescout platform alerted me—it wasamazing to watch the scenario unfold. Upon losing their connection, the user
tried to connect to four different ports. The Forescout platform immediately
blocked them all. This malware could have encrypted all of our data files
accessible to this user—including network shares and documents—across ournetwork. In the end, we had to only reimage one system.”
In a more recent example, a Hillsborough user downloaded a malicious payload
via email. “It was a zero-day payload that our antivirus software missed.
Immediately, we started seeing a higher-than-normal volume of email being sentfrom that user’s mailbox. The integration we have with Forescout and FireEyequickly determined the system was attempting malicious attacks against othernetwork resources and allowed us to stop the system before it caused anydamage.” And without FireEye integration? As Compres explains, “That sameattack hit a neighboring county and brought down a critical departmental email
server for two days.”*VLAN (Virtual Local Area Network)
VoIP (Voice over Internet Protocol)
SNMP (Simple Network Management Protocol)
LDAP (Lightweight Directory Access Protocol)

Forescout Technologies, Inc.
190 W Tasman Dr.
San Jose, CA 95134 USA
Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support +1-708-237-6591

Learn more at Forescout.com© 2020 Forescout Technologies, Inc. All rights reserved. Forescout Technologies,
Inc. is a Delaware corporation. A list of our trademarks and patents can be found at
www.Forescout.com/company/legal/intellectual-property-patents-trademarks.
Other brands, products, or service names may be trademarks or service marks of
their respective owners. Version 03_20