The challenge
Comcast needed better support for its RSA Adaptive Authentication Manager. The rules engine produced a high volume of false-positive denials, there was no automated failover when authentication services went down, and users had no way to manage their own MFA methods.
What Zephon did
- Rules engine tuning: optimized RSA Adaptive Authentication rules to sharply reduce false positives while improving cyber threat hunting.
- Automated recovery: utilities that auto-restart failed instances, plus automated log archiving and rotation.
- Resilience planning: documented current and future architecture for geo-based load balancing and disaster recovery.
- Identity threat monitoring: analyzed potential credential breaches and shared findings with the SOC for faster incident response.
- MFA self-service: a custom self-service application, integrated with Azure AD Conditional Access, for users to manage their MFA methods.
Results
- Authentication services restart automatically on failure, reducing downtime.
- False positives drastically reduced, improving user experience without weakening security.
- Authentication and authorization logs available for eDiscovery and audits.
- Less dependence on IT support for MFA changes.