Land Registration Systems, Inc.

Selecting ArcSight to introduce SIEM and bolster security posture

The 30-strong cybersecurity team at LARES investigated SIEM options and sought advice from customers who had recently implemented a SIEM. After evaluating several solutions, ArcSight Enterprise Security Manager (ESM) was found to best meet the specific LARES requirements. ArcSight ESM reduces threat exposure by detecting threats in real-time with powerful and adaptable SIEM correlation analytics.

“Support was extremely important to us with this investment as we aim to have long-term partnerships,” commented Mr. Sumulong. “We were reassured that ArcSight is a strong product that will be supported far into the future, ensuring continued innovation. OpenText worked with us to determine the scope and scale of our requirements and proposed a flexible license structure that can grow with us.”

Integrating different data sources for efficient analysis and correlation

ArcSight ESM was implemented in less than two months, with OpenText Cybersecurity experts supporting the LARES security team. The ArcSight out-of-the-box business rules were customized to reflect LARES rules and regulations so that security anomalies and false positives were minimized, saving time for the security team. The new SIEM captured Windows monitoring logs and incident detection, such as workstation reboots, USB plug-ins, application installations, authentication status, and user creation or deletion. It also actively monitored the firewall, database, and network device activities to register any changes that may be out of the ordinary.

At the same time as the ArcSight implementation, LARES also decided to adopt Darktrace, leveraging machine learning to introduce even more sophisticated cyberattack prevention. ArcSight is designed to integrate with many data sources, as the more data is available for analysis and correlation, the more reliable the actionable results are. Darktrace security logs were consolidated into the ArcSight SIEM, and LARES felt reassured it could address its security compliance and operational requirements.

With effective knowledge transfer from OpenText, the LARES security team was fully equipped to take on the ongoing management of the ArcSight platform.

Transforming an outdated IT support model with ZENworks Suite

While a cybersecurity plan with ArcSight took shape, the LARES team turned its attention to the issue of centralized IT device management. With a lack of structured patch management and version control, the 162 LARES office locations relied on engineers going into the field and manually updating and patching thousands of workstations. Processes were outdated and there was always a risk that a mission-critical patch was delayed.

ZENworks Suite combines the tools an organization needs to manage, secure, and protect its endpoint environment and data, and do it from one place. LARES leverages ZENworks Suite to identify, track, and remediate missing patches and the associated vulnerabilities. Rather than send engineers on extensive field trips, the team can specify centralized patch policies so that all LARES endpoints have the right OS and third-party application patches at the right time.

“Leveraging ZENworks Suite we introduced application control and policy enforcement for all our endpoints,” commented Mr. Sumulong. “Its flexibility allowed us to easily blacklist any applications we don’t want our users to run. We also automated our asset discovery so that we have better hardware and software visibility. This inventory used to take a lot of manual effort.”