University of Oklahoma - April 2022

COMPANY NAME

This is the headline of the feature DIGITAL REPORT 2021

On a Mission To Protect And Provide

IN ASSOCIATION WITH:

DIGITAL REPORT 2022

IN ASSOCIATION WITH:

On a Mission To Protect And Provide

2

ou.edu

UNIVERSITY OF OKLAHOMA

ou.edu

3

UNIVERSITY OF OKLAHOMA

CISO of the University, Aaron Baillio has helped to completely modernize the institute's IT environment, empowering the students and staff

I

n the South Central region of the United States, bordered by Texas, Kansas, Missouri, Arkansas, New Mexico and Colorado, lies the tornado-prone land of Oklahoma. This proud state is home to a University with big ambitions and no small amount of competitiveness.

But to truly compete at a higher level, they needed to undergo a digital transformation three years ago, which was triggered by new leadership and the desire to modernise, centralise and standardise their technology environment.

To help achieve this, Aaron Baillio, Chief Information Security Officer, primarily responsible for IT risk and security for the institution, had to transform into more of a “Chief Security Evangelist,” in his words.

Having spent 11 years in the Department of Defense, it’s no surprise that Baillio is a man who likes to protect and serve.

“What drives me on a day to day basis is the fact that we're stopping bad guys.

Despite the military and academia being vastly different, those intrinsic values are the same and are part of the reward of being in this profession. Our teams are doing their job; we're legitimately stopping bad things from happening to other people,” he says.

Issues from a distributed IT environment In his current role as CISO for two years, but with the University for seven, Baillio was aware the institution had multiple campuses that operated very independently, in a

4

ou.edu

Example of an image caption ou.edu

5

very distributed IT model. Baillio explains: “We began to merge operations, from this distributed model across the three campuses to a systemwide approach.”

The University went from three CIOs to one CIO and merged teams from across the campuses to become systemwide groups and organisations. By centralising these teams, the university began to realise millions of dollars of savings, revamping how they approached technology purchases and IT processes.

When asked about consolidation of the CIO into one overarching role, Baillio states that it accelerated the decision making process: “There was a lot of duplicative spending, a lot of decision making that was happening outside of a governance process.

So we developed one group that provides governance for the system. The one CIO is responsible for developing strategy and 6

ou.edu

the primary point of contact when looking at institutional risk of purchases. When we have one person to point to, and we have a governance structure, the process becomes more streamlined, making it easier to implement strategy and digitally transform.”

When the IT groups merged from the various campuses, they had over 300 maintenance contracts, requiring 300 different bills that the University was paying for, and some they had already bought.

Standardising platforms reduced overall spend and reduced risk, but merging the teams was not easy. As Baillio explains, “one group is accustomed to one software platform, then another group, another software platform. Which tool becomes the definitive tool that the team uses? Or do we go with something completely different and in a different direction?”

UNIVERSITY OF OKLAHOMA

AARON BAILLIO

Higher Education Industry

12k+

Number of Employees

“Our teams are doing their job; we're legitimately stopping bad things from happening to other people” AARON BAILLIO

CHIEF INFORMATION SECURITY OFFICER, UNIVERSITY OF OKLAHOMA

LOCATION: NORMAN, OKLAHOMA I spent the first 11 years of my career with the Department of Defense. With them I traveled the world and supported both in garrison and deployed network operations. My primary missions were information assurance and security engineering. I am currently the Chief Information Security Officer for the University of Oklahoma and have been with OU since 2015. We support 45k faculty/ staff and students across three campuses including a Health Sciences Center. Security at OU is supported by three pillars: Security Operations, Governance, Risk and Compliance and Training & Awareness. We currently have around 20 security professionals including 3 students who support Tier 1 operations in the SOC.

EXECUTIVE BIO

1890

Year Founded

TITLE: C HIEF INFORMATION SECURITY OFFICER

Proofpoint: protecting customers with the right approach

cover all of the different places into a single umbrella. By having this single umbrella, they don’t have to go to three different windows to do one job and that helps with resources.”

Deborah Watson, Proofpoint’s Resident CISO, discusses the company’s values and how it supports the University of Oklahoma with cyber defences

Striking the right balance between the customer and the infrastructure

Providers of cybersecurity and compliance solutions, Proofpoint, protect people over every channel including email, the web, the cloud and social media.

With its customer-centric approach, Proofpoint always aims to reduce the risk of cyber-attacks and in doing so, protect people, data and brands against advanced threats and compliance risks.

Commenting on the company, Proofpoint’s Resident CISO, Deborah Watson said: “First and foremost, we listen to our customers. To address their needs, we continuously focus on addressing reducing the risks in the evolving threat landscape.”

“A cybersecurity attack isn’t going to be effective if somebody on the other end doesn’t take some form of response. That’s why we take a peoplecentric approach,” explained Watson.

The University of Oklahoma has been a customer of Proofpoint since 2016 and offers the institution email protection with TAP and TRAP, CASB, TAM. Adding to this, Watson said: “The University of Oklahoma is unique in the fact that they have a very diverse set of security circumstances, in addition to having three campuses, offering remote learning, they also have a premier teaching hospital. With all of this, they have a lot of challenges that a hospital or other healthcare system would have, as well as a university.”

These challenges include email phishing attacks, cloud app threats, email and cloud security and IT efficiency. To overcome these challenges, Watson explained: “Our solution provides them with a consolidated solution to

“More than 99% of cyber-attacks require human interaction to be successful,” she added. Noting the importance of focusing on Very Attacked People (VAPs) rather than VIPs, Watson outlined that this approach is of equal importance to focusing on infrastructure, and striking the right balance lends itself to Proofpoint’s success.

She concluded: “Unlike security teams, cybercriminals aren’t focused on infrastructure and don’t view the world as a network diagram.

Defenders, on the other hand, are confident in dealing with networks and endpoints, which is why more than 60% of IT budgets are focused on the network.”

UNIVERSITY OF OKLAHOMA

Working alongside and in competition with peers There are several comparison models the university can look to, as they are part of the ‘Big 12’: an American collegiate athletic organisation driven by healthy competition in a number of sports.

“We try to align with our peers and also institutions at comparable Carnegie research levels. We're an R1 research institution, which means we produce a lot of research every year. So certainly as we have gone through this transformation, and we're looking at capabilities and policies, we do certainly compare ourselves across other institutions,” says Baillio.

“When we want to be a leader in one area, or if we find ourselves behind in certain areas, it does help us to benchmark where we want to be. Across academia, it hasn’t been very regulated as far as information 10

ou.edu

technology goes. I think culturally there have been some impacts from how academia works, how research works and where money comes from. But there’s not been a whole lot of focus from a business perspective on IT risk. As things have modernised and we have external policies, laws, and other compliance requirements, that has helped transform not only IT but IT security, which affects the running of an institution like a university,” he adds.

Utilising many strengths The teams were able to build on the strengths that came from each campus. In the health science centre, the security teams are very adept at policy and governance, as they are driven by HIPAA regulation, a compliance heavy environment.

Meanwhile on the Norman campus, a typical four-year graduate study institution,

they were very strong on incident response.

Baillio went on to say: “We were able to marry those capabilities and those teams in a way that took those strengths and spread them across the system. Yes, that did involve new technologies and new processes, but we were able to leverage our budget, reducing duplication and standardising on common platforms. We’re now enjoying support from the highest level leaders, who themselves have come in from their industries that have had to deal with IT risk in the past.”

The new culture of growth has contributed to many successes, including enrolling all faculty staff and students on the phishing training program. Baillio insists that this is significant because providing this kind of ‘on the spot’ training to the whole community, as cyber hygiene becomes increasingly important, it reduces the attack

surface across the institution. “We consider that a big win,” he says.

“We've been able to centralise endpoint control and management from all of the distributed IT groups, which from a security and risk perspective, covers a lot of areas where we were introducing more risk than was necessary. We'll be able to push our endpoint agents and our detection tools to every endpoint to patch on time,” adds Baillio.

Valuable partnerships held key to transformation Baillio is keen to credit CrowdStrike and Proofpoint’s roles in helping the IT teams reach their initial goals: “In terms of the endpoint management story, CrowdStrike were crucial in working with us on a security platform that would address all the different types of devices that we have at the university.

Universities, in general, have a fairly open ou.edu

11

Protect yourself against external threats with IntSights cyber intelligence.

Get your free, customized threat intelligence report.

Are external threats Take A Look targeting your company?

UNIVERSITY OF OKLAHOMA

“We've been able to centralise endpoint control and management from all of the distributed IT groups” AARON BAILLIO

CHIEF INFORMATION SECURITY OFFICER, UNIVERSITY OF OKLAHOMA

bring your own device (BYOD) environment.

And so we support a lot of different devices, operating systems and software platforms.

So because of that, we needed something that was resilient and could operate a lot of different platforms. And so CrowdStrike has partnered with us as an agent that fit with most of our environment. Even on the Linux side and for those one-off devices.”

From the protection and prevention of malware to endpoint detection response, CrowdStrike covered a wide spectrum of security issues that the university might experience with an endpoint - which numbers around 14,000 and if covering the management of all devices, can even reach the 25,000 range.

“We're looking forward to growing with them and we've got a great deal of use and

a lot of training. They've been really great to work with as far as protecting our assets and providing incident response.”

With Proofpoint, the university experienced a very similar kind of growth.

The implementation of an email gateway drastically reduced the number of malicious emails that came in, but phished accounts before Proofpoint arrived became a weekly occurrence. Around big campaigns at the start and end of term, Baillio saw an exponential growth of compromised accounts, which became a time drain for his incident response teams.

“That pretty much dried up right away with Proofpoint. And as we've grown with them, we've been able to do more automation, allowing the tool to automatically pull emails from email boxes that are suspicious ou.edu

13

UNIVERSITY OF OKLAHOMA

“We began to merge operations, from this distributed model across the three campuses to a systemwide approach” AARON BAILLIO

CHIEF INFORMATION SECURITY OFFICER, UNIVERSITY OF OKLAHOMA

GEOCARB MISSION OU obtained a grant from NASA for its Earth science mission – the Geostationary Carbon Observatory (GeoCarb) mission, which is targeted for launch into space early this decade. This mission studies how and why the global carbon cycle is changing and monitors plant health and vegetation stress throughout the Americas.

14

ou.edu

UNIVERSITY OF OKLAHOMA

or malicious. We've been able to leverage automation to automatically lock accounts and enroll people in training. As we now look at the cloud access security broker (CASB) and other things we're doing off 365, we get this great email telemetry from Proofpoint, coupled with the data loss prevention (DLP) and behaviours happening inside of Microsoft 365. There's just a lot of great data” he says.

“We see both those partnerships growing over the next couple of years, as their portfolios expand and our needs continue to expand,” he adds.

The research community Baillio is proud to support the university's research community, as they are handling more unclassified information than ever before, as well as meeting the government requirements for security.

“We're finding that the ability to meet those needs and to be more dynamic and resilient on that front, we can do that better in the cloud. And so cloud security will be a big focus for us in the coming year,” says Baillio.

The support given by the new IT setup assists the researchers to explore new options and avenues for data and insight.

This expands into looking at retention and recruiting, not only from the student side but from a faculty side too.

“We have a lot of maturity efforts, as we publish our strategy and look at things like identity, access management, a zero trust type of concept, affirming our processes and technology, and training our people on incident response. We have a lot of expansion coming up so will be recruiting for several positions on our security teams.

I think we have a bright future in 2022 and beyond,” he says.

ou.edu

15

631 N Parrington Oval, Norman, Oklahoma, 73019 www.ou.edu

POWERED BY:

Company Name

Address line Address line Address line Address line T 01234 5678910 companyname.com POWERED BY: