The challenge
Comcast needed better support for its RSA Adaptive Authentication Manager. The rules engine produced a high volume of false-positive denials, there was no automated failover when authentication services went down, and users had no way to manage their own MFA methods.
What Zephon did
- Rules engine tuning: retuned RSA Adaptive Authentication rules to cut false-positive denials, and supported threat hunting with the resulting data.
- Automated recovery: utilities that auto-restart failed instances, plus automated log archiving and rotation.
- Resilience planning: documented current and future architecture for geo-based load balancing and disaster recovery.
- Identity threat monitoring: analyzed potential credential breaches and shared findings with the SOC for faster incident response.
- MFA self-service: a custom self-service application, integrated with Azure AD Conditional Access, for users to manage their MFA methods.
Results
- Failed authentication services restart automatically instead of waiting for manual recovery.
- Fewer legitimate users denied by the risk engine after the rules were retuned.
- Authentication and authorization logs archived and rotated, and available for eDiscovery and audits.
- Users change their own MFA methods through self-service instead of IT tickets.