The challenge
HCSC had just started migrating to Microsoft Azure. Its information security team had defined robust cloud security policies, but many were not available out of the box in Azure Security Center, and applications were already running in production. Until those policies were enforced in Azure, confirming the environment's security posture and tracking compliance took significant manual effort.
What Zephon did
- Custom policies: designed and deployed Azure Security Center policies aligned with HCSC's security requirements and the CIS 1.0 and 1.1 benchmarks, building custom policies where none existed.
- Automated alerting and remediation: custom rules, playbooks, workbooks, and Logic Apps for automatic, near real-time notification and resolution of compliance gaps.
- Archer integration: scripts that extract policy compliance data from Azure and import it into RSA Archer for enterprise reporting.
- Exception management: documented procedures for handling security exceptions.
Results
- A week of manual compliance reporting reduced to a script that produces the data in under an hour, with automated monitoring in place of manual tracking.
- A complete, resource-level view of compliance gaps against organizational security policies.
- A compliance dashboard that gives senior management visibility into enterprise-wide security posture.