City of Aurora's security posture starts with its people
The Challenge
- Stop phishing attacks and floods of spam
- Significantly improve the city’s security
- posture
- Increase security team’s expertise
The Solution
- Proofpoint Email Protection
- Proofpoint Threat Response Auto-Pull
- Proofpoint Targeted Attack Protection
- Proofpoint Email Data Loss Prevention
- Proofpoint Email Encryption
- Proofpoint Internal Mail Defense
The Results
- Stopped targeted ransomware attacks and reduced spam and bulk mail to zero
- Gained comprehensive visibility into email threats for the first time
- Increased citywide engagement and support of cybersecurity through real-life education and awareness
- Grew security team’s knowledge, expertise, and confidence
The Challenge
City of Aurora employees were Very Attacked People™ (VAP) and a large, ongoing target for attackers. Email is the leading threat vector across organizations of all kinds. CISO Timothy McCain knew he had to address both at the same time.
The city had added a competing security product to its Office 365 deployment, but attacks still occurred regularly, and internally generated spam was still overwhelming. Worse, the team had limited visibility and fragmented event data. That hindered its ability to improve defense and response. For each incident, investigation through the vendor portal could take several days and still not deliver meaningful answers. Meanwhile, incidents continued and spread.
"Low security efficacy and visibility are bad for any organization," McCain said. "But the real problem is how attacks affected our people. Our team needed new skills and expertise to fight effectively. The last thing the city needs is a cyber attack. We needed to defend city employees and services for the community, as well as empower and energize our team."
The Solution
The security and infrastructure teams evaluated a number of secure email gateway solutions. After running a proof-of-concept (POC), they felt the choice was clear.
"Proofpoint's level of professionalism, technical ability, and understanding of our needs was way above other vendors," McCain said. "They made the POC easy and answered every question we asked. They even answered questions we didn’t think to ask."
The City of Aurora chose a comprehensive Proofpoint solution.
Email Protection protects users against malware, impostor emails, and stopped the food of spam almost overnight. If emails are poisoned after delivery or use evasion tactics, Threat Response Auto-Pull (TRAP) enables McCain’s team to automatically pull them out of users' mailboxes—even if they were forwarded to other employees. Targeted Attack Protection (TAP) proactively stops advanced threats before they reach users' inboxes, including zero-day and emerging threats. In addition, the TAP Attack Index identifes the city’s most attacked people and surfaces targeted ransomware attacks. With Email Encryption, users can now encrypt email messages with a click, enabling the city to more easily meet a wide range of compliance requirements.
"Proofpoint immediately gave us optics into email threats that we never had before," McCain said. "We know who our VAP are and can reach out to each individually. One employee was specifcally targeted by a ransomware campaign, which Proofpoint caught. He was one of only 300 individuals Proofpoint has ever seen targeted by this type of attack."
Empowered and Engaged
McCain's team is taking on a security operations role with the help of the Proofpoint dashboard and support. It is doing deep dives into incident data. It is proactively preventing spam fare-ups. In the past, if an employee was victim to a phishing attack, it could take the team hours or even days to fully clean up the environment. Since deploying Proofpoint, the city has seen these spam fare-ups reduced to nothing. In fact, it rarely needs to use Proofpoint TRAP anymore.
"Ironically, Proofpoint is a victim of its own success," McCain says with a laugh.
The Results
"Proofpoint's ability to make security real enables us to engage everyone—from city leadership on down," McCain said. "My team's confidence has grown, and now they feel like 'CyberCSI: Aurora,' which is great."
McCain said he can’t overstate the value of Proofpoint solutions and regular business reviews with his Proofpoint account team. Proofpoint is always available as the team gains leading-edge security knowledge and experience, giving them confidence. The city plans to integrate Proofpoint intelligence with its SIEM solution—ahead of the original plan.
"Proofpoint enables us to successfully address the issues at the very heart of risk—people and email," McCain said. "Their support is amazing. I can say without hesitation that Proofpoint is an unequivocal success."