For two weeks a year, UCAS, the UK’s Universities and Colleges Admissions Service, is seen as a critical national service, during which 700,000 students rely on the service to find and secure university placements. If UCAS fails, students won’t get their places confirmed on time and universities won’t fill the spaces they need to. Personal data flows from the point of student application, through UCAS, to the universities. Protecting this data is paramount. Join this webinar to learn how the UCAS uses Splunk Enterprise Security running on Splunk Cloud to gain real-time end-to-end visibility and reporting across various technology stacks, both on premise and across their AWS environment, and why an analytics-driven approach can enable you to identify anomalies that could indicate potential compromise. Find out how Splunk helps UCAS: · Gain centralised visibility into their Security Operations Center (SOC) · Use incident investigation to prove-negative for breach notification obligation under the Data Protection Act 1988 (soon to be GDPR) · Proactively detect security risks beyond malware

1. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.
How security analytics helps UCAS
protect 700,000 student
applications
Neil Bell, Security Assurance Manager, UCAS
Tom Gromski, Technology Relationship Manager, UCAS
Haiyan Song, SVP and GM, Security Markets, Splunk

2. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Spelunking:
to explore
underground caves
Splunk’s Mission:

3. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Analytics-Driven Security
RISK-BASED CONTEXT AND
INTELLIGENCE
CONNECTING
DATA AND PEOPLE

4. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Security Nerve Center
WAF & App
Security
Orchestration
Network
Threat
Intelligence
Cloud Security
Identity and Access
Firewall
Web Proxy
Endpoints

5. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Adaptive Response Initiative
Identity and
Access
Internal Network
Security
Endpoints
OrchestrationWAF & App
Security
Threat
Intelligence
Network
Web Proxy
Firewall
Mission:
Deeper integrations across the best security technologies
to help combat advanced attacks together.
Approach:
Gather / analyze, share, take action based on end-to-end context,
across security domains

6. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Security at the
Universities and
Colleges Admissions
Service (UCAS)
Neil Bell, Security Assurance Manager, UCAS
Tom Gromski, Technology Relationship Manager, UCAS

7. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Getting to know us a little
The world’s only national centralised
organisation processing applications to higher
education.
An intermediary in an ever changing multi-£billion
market.

8. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Our customer(s)
Circa 800,000 applicants
Circa 600,000 placed
4 million applications, in over 6,000
registered centres, to 388universities &
colleges & 1200 schools. This includes UK &
international schools, agents and advisers from
over 100 countries.

9. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
“Who has used UCAS/has kids
who have used UCAS in the
room?”

10. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ Protecting circa 800k Student Records (across multiple schemes) and ensuring
availability of our services throughout the year including during our peak periods
of activity
▶ Data flows from applications to universities and back
▶ Maintaining service levels throughout the year but with specific focus during
August
▶ “UCAS provides important core services throughout the year, but for two
weeks during August the reliance on our services is significantly increased
- we are a crucial part of the process of ensuring applicants obtain their
University offers. If we fail circa 700k+ Undergraduate students don’t get
their places confirmed on time (during an already stressful period) and
universities don’t fill the spaces they need to.”
Our priorities in IT

11. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
National News at UCAS on results day

12. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
BBC Live from UCAS on results day

13. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Our Challenges

14. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ Exam results: Time sensitive (embargoed) data
▶ Students: UCAS.com and TRACK.UCAS.com over 4000 hits/s
▶ Providers: 388 providers wanting the latest view of their applicants
▶ Detect issues before they become a ‘real’ problem
▶ We can only do this using a single analytics driven view
Our Challenges - The ‘live’ view

15. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Our Challenges - The ‘live’ view

16. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
• AV endpoint reporting – Vulnerability scan data – Web filtering – mail
filtering – Domain – DNS
• File system auditing, Database auditing, Web access logging
• 98 web application services
• Sophos Endpoint incl. PUA detection
• Cisco ASAs, Firepower, Cisco ISE, Palo Alto
• Amazon Web Services monitoring via the app
• And much much more…
What goes into Splunk?
Monitoring
Alerts
Data

17. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Centralized Visibility in our
SOC
Detecting Security Risks
beyond Malware
Incident Investigation to
prove-negative for breach
notification obligation
What do we do with Splunk’s Security Platform
Insights in three use cases

18. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
With Splunk Enterprise
Security in the Cloud
Centralized
Visibility in
our SOC

19. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
With Splunk Enterprise
Security in the Cloud
Centralized
Visibility in
our SOC

20. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Automation of reporting
Detecting
Security Risks
beyond
Malware
Need:
• Monitoring of file auditing to detect if unauthorized users
are making changes or access data that is treated under
NDA and a timed embargo
Solution:
• Enabled windows auditing and data onboarding within a
day
• Event enrichment through a list of authorised users
• Automated alerting

21. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Automation
Detecting
Security Risks
beyond
Malware
Need:
• Monitoring newly created domain users
Solution:
• On boarded data within a day
• Created a dashboard
• Splunk Cloud sends us every day a report to review

22. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Protecting Privacy
Incident
Investigation
to prove-
negative
Compliance Regulation:
We are processing personal information from students around
the world and need to comply with the Data Protection Act
1988 (shortly EU-GDPR)
If personal data is lost or ends up in the wrong hands,
we have the obligation to report publicly

23. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Protecting the Privacy
Incident
Investigation
to prove-
negative
Situation:
Security Incident which looked like a breach of the DPA
Solution:
Incident Investigation with Splunk
• Analysing log data from all our databases
• „Connecting the dots“
• Found out it was a false report of loss that we could prove
didn‘t happen - no data was disclosed.
• We showed that others were wrong.
Result:
• No statutory reporting needed
• Stronger reporting position
• Increased trust in the platform and my team

24. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ We have been going about a year, but…
▶ It can be technically done in less than 5 Weeks
▶ We have a ‘Splunk Champion’ in every business area that uses it
▶ Put as much in as you can to get the best out
▶ Operate
• IT core technology partner (Including SOC service)
• Splunk Cloud and Splunk Enterprise Security are key to the deliverables
• Splunk is listed as our strategic logging and SIEM product
What does it take to establish and build this?

25. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
Let it Grow
▶ Define a few use cases first to get it off the ground
• Security
• Operational
• ITSM
▶ Expose the application to as many areas within your business as you can
▶ Being able to explore and ask any question of your data – that’s where you can go!
▶ Analytics of machine data allows us to take decisions based on actual facts rather then „feelings“
Lessons Learned
Building security analytics capabilities

26. © 2017 SPLUNK INC.© 2017 SPLUNK INC.
▶ We know what we can do with Splunk
▶ We honor the flexibility and speed how we can address issues and solve them
through a analytics approach
▶ Next on our list:
• Detecting Account Take over on our platform
• Logging of more transactions, middleware (Mulesoft ESB integration)
• ISO27001 and CIS 20 controls reporting
• ServiceNow integration
• Deploying Cisco ISE and feeding into Splunk
• Potential to use Splunk for IT health monitoring
Our future Plans

27. © 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.© 2017 SPLUNK INC.
Thank You
Q&A