A large, for-profit government contractor based in the eastern corridor of Washington, D.C. provides business services to government agencies in the US and other countries. Employing more than 15,000 professionals, the organization administers programs of all sizes,  from enormous federal programs to smaller state and local programs that directly assist a broad sector of the population. Biggest Challenge of Adopting the Cloud isn’t Technical Increasingly the organization’s clients had begun asking about the possibility of receiving cloud-based services because of lower TCO. Internally, the company also realized that it could reap significant benefits from providing services using the public cloud. Like its customers, the organization could take advantage of reduced TCO. Using the public cloud, it could also quickly ramp up or scale down the number of users—a huge benefit for a company with so many contracted projects. Clearly, the cloud belonged in the government contractor’s future, so the system analyst and his colleagues set out to figure out how best to secure it. In the process, they discovered that, as he puts it: “The biggest challenge of the public cloud isn’t technical.” Rather, it is overcoming the perception that the cloud can’t be secured. “We have had to educate both internally and externally that we can extend our existing threat defenses beyond our physical infrastructure to the public cloud,” says the system analyst. “Education is ongoing, but our success thus far at securely leveraging the public cloud is converting the naysayers.” Easy Deployment of Cloud Protection for AWS After carefully researching cloud security options, the company decided to implement McAfee Cloud Workload Security before launching its first contracted project using Amazon Web Services (AWS). They already relied on the McAfee integrated security platform and a variety of McAfee solutions to secure its physical and virtual infrastructure of 35,000 endpoints (including servers). These products are all managed using the McAfee ePO central console—as is McAfee Cloud Workload Security.
“Adding the public cloud to our McAfee infrastructure was simple,” notes the system analyst. “We spun out the cloud side in less than a week. With McAfee ePO software, it was easy to implement McAfee Cloud Workload Security and set security policies for the project.” As part of the McAfee Cloud Workload Security solution, they deployed the Data Center Connector for AWS, Cloud Usage Metering, Data Protection for Cloud, Data Center Visualization, and Data Center Assessment components. With this functionality, the organization has end-to-end visibility into all cloud workloads and their underlying platforms and insights into weak security controls, unsafe firewall and encryption settings, and indicators of compromise (IoCs). In addition, the same McAfee Endpoint Security, which protects its physical and virtual endpoints, protects the company’s endpoints within the AWS cloud. Flexibility and Bandwidth to Accommodate Volatility in Server Volume The company’s first AWS-based project serves a handful of US federal government agencies with a combined total of 1,500 endpoints. As part of the project, the company created a web-based portal where authorized users from these agencies can review aspects of their program’s infrastructure, request changes, and exchange information. “Portal traffic is very fluid,” explains the system analyst. “The number of servers can increase or contract sometimes daily; five to 20 instances come online very week. The public cloud is the perfect vehicle to handle such fluctuations in bandwidth requirements.” For this multiple-agency project, the workloads that run in the public cloud are generated by:
■    SQL and Oracle databases
■    Imaging software, since a huge volume of documents need to be stored digitally for years
■    Agency- or contract-specific applications Small Team Able to Manage Security Across Hybrid Environment For this project, 95% of the security policies for the endpoints within the AWS public cloud are the same as for the company’s physical endpoints, but 5% are unique to the project.“We run a base set of policies for every project, to meet ISO requirements and so on, but with McAfee ePO software, we can easily add or customize policies to meet the security needs of each specific contract and project,”notes the system analyst. Thanks to the intuitive McAfee ePO management console, the company’s information security team of five, spread across three locations, can effectively and efficiently manage a host of McAfee solutions and even some non-McAfee solutions, across a widely dispersed physical and virtual infrastructure that includes private and public cloud. “As a small but dispersed team, we must have tools that work well together and enable us  to work efficiently with one another,” says the system analyst.“McAfee ePO software is basically our eyes and ears across the entire environment. We use it for day-to- day management as well as to remediate threats quickly in conjunction with our McAfee SIEM.” Custom Reports and Automated Responses Speed Compliance and Resolution Using McAfee ePO software, the system analyst and his colleagues have also created customized reports and automated responses as an added cloud defense measure. “To us, whether the endpoint is in the public cloud or on premises, it doesn’t matter,” he says. “We use McAfee ePO software the same way, to manage as well as accelerate time to compliance and resolution.” For example, in McAfee ePO software, he created an agent access report, which runs frequently. The report details which endpoint agents are not reporting back on a regular basis. If an agent doesn’t respond within a set number of minutes—the number is set in the project contract—then the information security team will automatically be notified to investigate. The team also receives automatic notifications if file integrity monitoring queries discover that certain thresholds are reached, such as a user accessing an executable file a certain number of times within a certain number of minutes. “Full Speed Ahead” for AWS Expansion The government contractor has built a hardy, multilayered defense with a McAfee integrated security infrastructure backbone that protects its widely dispersed, hybrid environment and numerous, global government customers. With the addition of McAfee Cloud Workload Security, they have extended that defense and laid the foundation for securely leveraging the public cloud even more in the future, to the benefit of both the company and its customers.
“Now that we can extend robust security to the public cloud, it’s not a question of if we’ll put more projects in AWS, but how many,”says the system analyst.“It’s full speed ahead.”

Ariel Picans, technology risk manager at Banco Delta, is responsible for overseeing the security posture of 400 endpoints and safeguarding the assets that reside both within the perimeter of the organization and in the cloud, ensuring that sensitive financial information, databases, and documents are secured against known and emerging threats. Once a year, Picans and his team conduct security checks and assessments of the infrastructure, creating vulnerability tests using various methods to make sure that alerts and filters are functioning properly. Over the years, Picans has been building out Banco Delta’s security infrastructure with solutions that, in his words, “add value and protect the bank’s environment from future attacks.” As a long-time McAfee customer,
Banco Delta was looking to upgrade to deepen and broaden protections and further simplify and consolidate security management. Additionally, Picans wanted to make sure that the bank was implementing the security controls required by compliance regulations and could provide detailed reports at audit time. McAfee Solutions Expand Security Options at Banco Delta Picans has always appreciated the advantages of the single-vendor, integrated approach offered by McAfee. Positive reviews from industry analysts like Gartner and Forrester, along with streamlined management, support, and communications prompted him to continue down the same path and explore the latest McAfee innovations, particularly McAfee® Endpoint Security 10.5 and McAfee ePO 5.9.1 software. Several years ago, Picans and his team relied on McAfee® VirusScan® Enterprise for strong antivirus and anti- malware. When he learned about McAfee Endpoint Security, Picans was impressed with the solution’s multilayered protection and made a decision to upgrade as a way of protecting Banco Delta against rapidly evolving threats. The solution provides not only antivirus but also encryption and integration with data loss prevention (DLP). McAfee Endpoint Security in collaboration with McAfee ePO software, McAfee® DLP Endpoint, the McAfee Network DLP solution, and McAfee® Network Security Platform enables him to create and enforce strict data access policies for devices both within and outside the four walls of the bank. The McAfee® Web Gateway appliance is also part of the ecosystem, using a host of techniques to analyze all web traffic and offering protection against malware and malicious code hidden through encryption.
To round out Banco Delta’s security infrastructure, Picans added McAfee® Enterprise Security Manager, a security and events management (SIEM) solution that integrates with all of the bank’s solutions. It uses advanced analytics to give Picans and his team context and to enable them to prioritize threats and assess risks. McAfee Enterprise Security Manager also centralizes and automates compliance monitoring and reporting, with pre-built dashboards, audit trails, and reports for more than 240 global regulations. “We migrated to McAfee Endpoint Security because it has opened up a wide gamut of options, all managed by a single console and a single agent. We’ve taken maximum advantage of this tool and have experienced very positive results. For all these reasons, we trust and count on McAfee security technology,” says Picans. A Collaborative Ecosystem with McAfee ePO at the Helm Since the upgrades, Picans has observed a noticeable reduction in both infections and in potentially compromising user behavior. The integration of McAfee® Threat Intelligence Exchange extends another layer of protection and speeds detection and response across the bank’s entire environment. McAfee Threat Intelligence Exchange shares threat intelligence from third-party sources and locally collected intelligence with other McAfee and third-party security solutions via the Data Exchange Layer (DXL) communications fabric. As Picans points out, all of the McAfee solutions in the bank’s integrated ecosystem can act immediately on this intelligence and swiftly block or quarantine threats. Banco Delta made a decision to add McAfee Threat Intelligence to its arsenal when Picans and his team detected an increase in usage of unauthorized applications. “Because of this, we needed a tool that provides information on whitelisted and a blacklisted applications. McAfee Threat Intelligence is the perfect solution because it provides us with visibility across the whole organization,” he says. Now Picans can customize data for his organization— including blacklists and whitelists of applications.
Reports generated by the McAfee ePO console provide an overview of executed applications—both authorized and unauthorized. This allows him to see whether somebody has been engaged in malicious or unauthorized activities. Picans and his team simply configure McAfee Threat Intelligence, let it run, and check reports on a daily basis. McAfee Solutions Keep Advanced Threats in Check and Prevent Disruption As the management hub for Banco Delta’s McAfee solutions, McAfee ePO software is integral to security operations. Picans relies on McAfee ePO software to ensure that every endpoint has antivirus and encryption, updated .DATs, and more. Picans and his team can also pull reports from the McAfee ePO dashboard with details like analysis and classification of malware by type, blocked malware, and devices that are most vulnerable to attack. Picans consolidates this information and provides the bank’s executive committee with a comprehensive view of
Banco Delta’s risk profile every month. He also finds this data useful for trend analysis. “The main benefit of this collaborative approach has been the reduction of the advanced malware and ransomware attacks that have been in circulation recently. Thanks to McAfee ePO software and our other McAfee solutions, we’ve been able to carry on without disruption, while other organizations have suffered from data breaches, putting their day-to-day operations at risk,” explains Picans. To protect against today’s continually morphing threats, Picans deployed McAfee® Advanced Threat Defense.
McAfee Advanced Threat Defense combines multiple powerful technologies—in-depth static code analysis, dynamic analysis through sandboxing, and machine learning—to help the bank accelerate detection of zero-day malware, evasive threats, and ransomware. In the first month of deployment at Banco Delta, McAfee Advanced Threat Defense proved its value by intercepting Locky, a prolific and persistent strain of ransomware that continues to reappear with new variants. Picans also uses McAfee Advanced Threat Defense to support security investigations. He points out that it has detected several malicious archives that were missed by solutions from other vendors. Picans submits these malware samples to McAfee Advanced Threat Defense to derive insights on indicators of compromise, which help him gain a better understanding of highly camouflaged threats. Since deploying these McAfee solutions, Picans has seen a significant reduction in attacks and data loss. Additionally, the integrated and connected McAfee ecosystem, with its single-console management through McAfee ePO software, has resulted in notable operational efficiencies as compared to a multivendor environment. “When you have a collection of unintegrated products with multiple management consoles, you need more people, and they need additional, highly specific training. McAfee has reduced the need for hiring additional personnel,” he affirms. “Plus, with its modular, centrally managed system, McAfee opens up a world of possibilities.” Stepping Up Security Across On-Premises, Virtualized, and Cloud Environments McAfee® Cloud Workload Security (CWS) will help increase Banco Delta’s visibility to elastic workloads in the public cloud and AWS (Amazon Web Service)/ VMware environments and will provide an integrated defense against advanced attacks. CWS with AWS is an example of how we can forge forward fearlessly in the cloud. McAfee® MOVE AntiVirus currently offers optimized security for virtualized desktops and servers. “I know that, with McAfee, I can count on having the same level of security in the cloud and in virtualized environments as we have on premises,” he notes. The bank currently has plans in the works to provide cloud-based services and applications for both external clients and internal stakeholders. When Banco Delta fully launches these cloud services, Picans and his team will be responsible for making sure all communications and data are encrypted and secure. For example, it will be really important to reassure the sales department that their information won’t be exposed and will be monitored regularly and that the bank’s databases won’t be compromised. “McAfee protects everything that’s online—not just within the network perimeter. The company’s advancements in cloud security and other innovations speak for themselves. It shows that McAfee is truly concerned about protecting its customers and that it strives to stay current with new technology trends and the evolving threat landscape,” summarizes Picans.