Cisco Secure Network Analytics Case Studies : Page 2

Case Study: Large Enterprise Professional Services Company

Introduction

This case study of a large enterprise professional services company is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

“We were able to increase our visibility into all of our remote offices by adding a single flow sensor in each location. We can now monitor network performance and security events using one platform. We typically use StealthWatch to remediate events generated from within Stealthwatch and also from our IDS. The ability to search on a name or IP address allows us to identify and locate the source of an issue very quickly.”

“The design and implementation of the solution fits perfectly within my firm. The ability to monitor performance and security using deep packet inspection and netflow within the same product helps us respond quickly to events on the network. The platform is very stable and the ability to keep data for a year is critical when trying to research an event.”

Challenges

Stealthwatch has helped improve the following:
- Real-time threat detection
- Incident response
- Forensic investigations
- Overall security posture
- Network troubleshooting

Use Case

Stealthwatch has helped with:
- Insider threats
- APTs
- Malware/zero-day attacks
- DDoS attacks
- Compliance
- Network performance
- Network segmentation
Is able to secure the following with Stealthwatch:
- Virtual infrastructure/private clouds
- The data center
- Remote locations

Results

Reduced their network and security troubleshooting time by days.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Heightened threat intelligence
- Enhanced visibility in the data center
- Improved user identity awareness
- Increased application awareness
Found the following Stealthwatch capabilities to be the most beneficial:
- Sophisticated security analytics/behavioral analysis
- Context awareness (user, application, device data)
- Detection of lateral movement (East-West Traffic)
- Scalability
- Long-term flow storage
Compared to other security vendors, Cisco is:
- Effective at detecting attacks
- Innovative
- Supportive of its customers
Stealthwatch enables the company to:
- Better manage security with limited staff/resources
- Accelerate threat detection and mitigation
- Speed up incident response
- Reduce enterprise risk
- Gain pervasive network visibility
- Foster cross-team collaboration within the IT department

Case Study: Medium Enterprise Media & Entertainment Company

Introduction

This case study of a medium enterprise media & entertainment company is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

“Information is easier to find. Network baselining and traffic reporting is streamlined.”

“Stealthwatch is easy to use for a small staff. Deployment was simple.”

Challenges

Stealthwatch has helped improve the following:
- Network baselining
- Incident response
- Forensic investigations
- Overall security posture
- Network troubleshooting
- Capacity planning

Use Case

Stealthwatch has helped with:
- Insider threats
- DDoS attacks
- Compliance
- Network performance
- Network segmentation

Results

Reduced their network and security troubleshooting time by hours.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Heightened threat intelligence
- Enhanced visibility in the data center
- Increased application awareness
Found the following Stealthwatch capabilities to be the most beneficial:
- Detection of lateral movement (East-West Traffic)
- Scalability
- Long-term flow storage
Compared to other security vendors, Cisco is:
- Easy to use
- Easy to integrate with other security technologies
- Cost effective
Stealthwatch enables the company to:
- Better manage security with limited staff/resources
- Speed up incident response
- Gain pervasive network visibility
- Foster cross-team collaboration within the IT department
- Clearly report on organizational security to upper management

Case Study: Large Enterprise Financial Services Company

Introduction

This case study of a large enterprise financial services company is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

“With limited resources and large amounts of data, Cisco helps pinpoint areas my analyst needs focus.”

Challenges

Stealthwatch has helped improve the following:
- Real-time threat detection
- Forensic investigations
- Overall security posture
- Network troubleshooting

Use Case

Stealthwatch has helped with:
- Insider threats
- APTs
- Malware/zero-day attacks
- DDoS attacks
- Compliance
- Misconfiguration
Is able to secure the following with Stealthwatch:
- Virtual infrastructure/private clouds
- The data center
- Areas of my network I could not see previously

Results

Reduced their network and security troubleshooting time by minutes.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Heightened threat intelligence
- Enhanced visibility in the data center
- Increased application awareness
Found the following Stealthwatch capabilities to be the most beneficial:
- Sophisticated security analytics/behavioral analysis
- Context awareness (user, application, device data)
- Flow stitching and deduplication
- Scalability
Compared to other security vendors, Cisco is:
- Effective at detecting attacks
- Innovative
- Supportive of its customers
- Easy to use
- Easy to integrate with other security technologies
- Cost effective
Stealthwatch enables the company to:
- Better manage security with limited staff/resources

Case Study: Global 500 Energy & Utilities Company

Introduction

This case study of a Global 500 energy & utilities company is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

“Stitches user information to netflow data, reducing time for investigations.”

Challenges

Stealthwatch has helped improve the following:
- Network baselining
- Network segmentation
- Real-time threat detection

Use Case

Stealthwatch has helped with:
- Insider threats
- APTs
- Malware/zero-day attacks
- Network performance
Is able to secure the following with Stealthwatch:
- Areas of my network I could not see previously

Results

Reduced their network and security troubleshooting time by hours.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Heightened threat intelligence
Found the following Stealthwatch capability to be the most beneficial:
- Sophisticated security analytics/behavioral analysis
Compared to other security vendors, Cisco is:
- Effective at detecting attacks
Stealthwatch enables the company to:
- Accelerate threat detection and mitigation

Case Study: Large Enterprise Media & Entertainment Company

Introduction

This case study of a large enterprise media & entertainment company is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

“One of the biggest gaps in visibility is traditionally east-west lateral movement. Without NetFlow, it’s nearly impossible to monitor that traffic at scale. Stealthwatch happens to be our tool of choice for that.”

“Great product, great team. Does anymore need to be said?”

Challenges

Stealthwatch has helped improve the following:
- Real-time threat detection
- Incident response
- Forensic investigations
- Overall security posture
- Network troubleshooting

Use Case

Stealthwatch has helped with:
- Insider threats
- APTs
- Malware/zero-day attacks
- Network performance
Is able to secure the following with Stealthwatch:
- The data center
- Areas of my network I could not see previously
- Remote locations

Results

Reduced their network and security troubleshooting time by hours.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Enhanced visibility in the data center
Found the following Stealthwatch capabilities to be the most beneficial:
- Flow stitching and deduplication
- Detection of lateral movement (East-West Traffic)
- Scalability
Compared to other security vendors, Cisco is:
- Supportive of its customers
- Easy to use
Stealthwatch enables the company to:
- Speed up incident response
- Gain pervasive network visibility

Case Study: State & Local Government

Introduction

This case study of a state & local government is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled organization asked to have their name blinded to protect their confidentiality.

“With Stealthwatch, we enabled our security team to better investigate problems within our network and more efficiently remediate any issues.”

“Cisco is a great company that stands by their clients. Stealthwatch is not only selling a great product, it is also giving us an edge over breach resolution.”

Challenges

Stealthwatch has helped improve the following:
- Network baselining
- Real-time threat detection
- Incident response
- Overall security posture
- Network troubleshooting

Use Case

Stealthwatch has helped with:
- Insider threats
- DDoS attacks
- Network performance
Is able to secure the following with Stealthwatch:
- Virtual infrastructure/private clouds
- IoT devices/systems
- The data center

Results

Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Heightened threat intelligence
- Enhanced visibility in the data center
- Improved user identity awareness
- More visibility into mobile devices
Found the following Stealthwatch capabilities to be the most beneficial:
- Sophisticated security analytics/behavioral analysis
- Context awareness (user, application, device data)
Compared to other security vendors, Cisco is:
- Effective at detecting attacks
- Innovative
- Supportive of its customers
- Easy to use
- Easy to integrate with other security technologies
Stealthwatch enables the company to:
- Better manage security with limited staff/resources
- Accelerate threat detection and mitigation
- Gain pervasive network visibility

Case Study: Educational Institution

Introduction

This case study of a educational institution is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled organization asked to have their name blinded to protect their confidentiality.

“Drilling down into the traffic flows has been very helpful for our network team to reduce the amount of time it takes to troubleshoot an issue.”

Challenges

Stealthwatch has helped improve the following:
- Network baselining
- Incident response
- Forensic investigations
- Network troubleshooting

Use Case

Stealthwatch has helped with:
- Network performance
- Network segmentation
- Troubleshooting performance issues and an understanding of what is going on with our network so we can be more proactive rather than reactive.
Is able to secure the following with Stealthwatch:
- The data center
- Areas of my network I could not see previously

Results

Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Enhanced visibility in the data center
- Increased application awareness
Found the following Stealthwatch capabilities to be the most beneficial:
- Context awareness (user, application, device data)
- Flow stitching and deduplication
- Detection of lateral movement (East-West Traffic)
Compared to other security vendors, Cisco is:
- Supportive of its customers
- Easy to use
Stealthwatch enables the company to:
- Speed up incident response
- Reduce enterprise risk
- Gain pervasive network visibility
- Foster cross-team collaboration within the IT department

Case Study: Fortune 500 Automotive & Transport Company

Introduction

This case study of a Fortune 500 automotive & transport company is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

“Ability to understand our “normal”, enables us to react when it changes and start looking at causes. This helps in very early detection of events, before they impact us and become incidents."

“Stealthwatch is a tool which can be used by both networking and security professionals to effectively solve issues.”

Challenges

Stealthwatch has helped improve the following:
- Network baselining
- Real-time threat detection
- Forensic investigations
- Overall security posture

Use Case

Stealthwatch has helped with:
- Insider threats
- APTs
- DDoS attacks
- Network segmentation
Is able to secure the following with Stealthwatch:
- IoT devices/systems
- Areas of my network I could not see previously
- Remote locations

Results

Reduced their network and security troubleshooting time by hours.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Increased application awareness
Found the following Stealthwatch capabilities to be the most beneficial:
- Sophisticated security analytics/behavioral analysis
- Context awareness (user, application, device data)
- Flow stitching and deduplication
- Detection of lateral movement (East-West Traffic)
- Scalability
- Long-term flow storage
Compared to other security vendors, Cisco is:
- Innovative
- Supportive of its customers
- Easy to use
- Cost effective
Stealthwatch enables the company to:
- Better manage security with limited staff/resources
- Accelerate threat detection and mitigation
- Gain pervasive network visibility
- Foster cross-team collaboration within the IT department

Case Study: Educational Institution

Introduction

This case study of a educational institution is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled organization asked to have their name blinded to protect their confidentiality.

“It makes identifying a DDoS or DoS attack fairly easy. It allows us to interact with other systems for automated mitigation.”

“It stores a small subset of data about flows for long periods of time, which is useful for investigations.”

Challenges

Stealthwatch has helped improve the following:
- Network baselining
- Incident response
- Forensic investigations
- Network troubleshooting

Use Case

Stealthwatch has helped with:
- APTs
- Malware/zero-day attacks
- DDoS attacks
Is able to secure the following with Stealthwatch:
- The data center
- A BYOD environment

Results

Reduced their network and security troubleshooting time by hours.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Increased application awareness
Found the following Stealthwatch capabilities to be the most beneficial:
- Flow stitching and deduplication
- Scalability
- Long-term flow storage
Compared to other security vendors, Cisco is:
- Supportive of its customers
- Easy to use
- Easy to integrate with other security technologies
- Cost effective
Stealthwatch enables the company to:
- Better manage security with limited staff/resources
- Speed up incident response

Case Study: Education Department

Introduction

This case study of Education Dept is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“We really have benefited from the SLIC subscription, since it is able to help us see malware issues. And, we also like the idea that using NetFlow has helped us “probe” our network end-to-end."

“Cisco’s Stealthwatch is easy to implement, and having nearly complete network visibility is super important. Moreover, the tech support team at Cisco is also very responsive and training has been excellent.”

Challenges

Stealthwatch has helped improve the following:
- Network baselining
- Real-time threat detection
- Incident response
- Forensic investigations
- Overall security posture
- Network troubleshooting
- Capacity planning

Use Case

Stealthwatch has helped with:
- Insider threats
- Malware/zero-day attacks
- Network performance
Is able to secure the following with Stealthwatch:
- Areas of my network I could not see previously
- Remote locations

Results

Reduced their network and security troubleshooting time by minutes.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Heightened threat intelligence
- Improved user identity awareness
- Increased application awareness
Found the following Stealthwatch capabilities to be the most beneficial:
- Sophisticated security analytics/behavioral analysis
- Context awareness (user, application, device data)
Compared to other security vendors, Cisco is:
- Innovative
- Supportive of its customers
- Easy to use
- Easy to integrate with other security technologies
- Cost effective
Stealthwatch enables the company to:
- Better manage security with limited staff/resources
- Accelerate threat detection and mitigation
- Speed up incident response
- Gain pervasive network visibility
- Clearly report on organizational security to upper management

Case Study: Toronto 2015 Pan Am Games – Cisco Systems Canada, Inc.

Introduction

This case study of Cisco Systems Canada, Inc. is based on a August 2015 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“With over 150,000 user (BYOD) devices connected to the network during the Toronto 2015 PANAM Games we relied heavily on StealthWatch to help us understand what was happening on the network and where the threats were coming from. It helped us in many instances make the decision whether to simply notify a user or disconnect them from the network. With any multi-sports games or large event that is broadcast live time and high availability are critical.”

“Stealthwatch works well with Cisco NetFlow to give holistic picture of the network. It allows us to group and build out profiles that reduce the amount of raw analysis making it practical for a very small security team to get a handle on what is happening on a large network.”

Challenges

Stealthwatch has helped improve the following:
- Real-time threat detection
- Incident response
- Forensic investigations
- Overall security posture
- Network troubleshooting

Use Case

Stealthwatch has helped with:
- Insider threats
- Malware/zero-day attacks
- DDoS attacks
- Network performance
- Network segmentation
Is able to secure the following with Stealthwatch:
- Virtual infrastructure/private clouds
- The data center
- A BYOD environment

Results

Reduced their network and security troubleshooting time by hours.
Stealthwatch System has helped their organization achieve the following:
- Greater network visibility
- Heightened threat intelligence
- Enhanced visibility in the data center
- Improved user identity awareness
- Increased application awareness
- More visibility into mobile devices
Found the following Stealthwatch capabilities to be the most beneficial:
- Sophisticated security analytics/behavioral analysis
- Context awareness (user, application, device data)
- Flow stitching and deduplication
- Detection of lateral movement (East-West Traffic)
Compared to other security vendors, Cisco is:
- Effective at detecting attacks
- Innovative
- Supportive of its customers
Stealthwatch enables the company to:
- Better manage security with limited staff/resources
- Accelerate threat detection and mitigation
- Speed up incident response
- Reduce enterprise risk
- Clearly report on organizational security to upper management

Case Study: Medium Enterprise Banking Company

Introduction

This case study of a medium enterprise banking company is based on a June 2014 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

“By increasing visibility into our network we are able to correlate data between our network TAPs and Firewall information to generate a ‘larger view’ of whats really going on in the network and from where.”

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Scalability up to 3 million flows per second
- Flow analytics
- Value for price
- Customer support
- IPv6 and Cisco ISE integration!!!!

Use Case

Uses Stealthwatch with:
- SIEM
- Firewalls
- Full-packet capture system
- ISE
Is doing the following with Stealthwatch by Cisco deployment:
- Monitoring a centralized network with a large number of satellite or retail locations
- Monitoring traffic within a data center, physical and virtual

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Faster Incident response
- Forensics
- Monitors individual user activity & mobile devices
- Continuous internal monitoring
- Contextual & situational awareness
- Meets auditing & compliance requirements
- Cross-department collaboration
- Integration with Cisco ISE
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Performance monitoring
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: extremely effective
- accelerating incident response and forensics: extremely effective
- detecting advanced persistent threats: extremely effective
- detecting insider threats / Suspicious behavior: extremely effective
- detecting malware / zero-day attacks: extremely effective
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : very critical
Selected Stealthwatch by Cisco over the following vendors:
- Arbor Networks
- NetScout
- Plixer
- Orion which is currently in place.

Case Study: Large Enterprise Professional Services Company

Introduction

This case study of a large enterprise professional services company is based on a June 2014 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Flow analytics
- Value for price
- Customer support

Use Case

Uses Stealthwatch with:
- Firewalls
- IDS / IPS
- Full-packet capture system
Is doing the following with Stealthwatch by Cisco deployment:
- Monitoring a large, globally distributed network

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Faster Incident response
- Forensics
- Continuous internal monitoring
- Meets auditing & compliance requirements
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Performance monitoring
- Forensics
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: effective
- accelerating incident response and forensics: extremely effective
- detecting advanced persistent threats: effective
- detecting insider threats / Suspicious behavior: extremely effective
- detecting malware / zero-day attacks: effective
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : very critical
Selected Stealthwatch by Cisco over the following vendors:
- Riverbed Cascade / Mazu Networks
- NetQoS / CA

Case Study: State & Local Government

Introduction

This case study of a state & local government is based on a June 2014 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled organization asked to have their name blinded to protect their confidentiality.

“Cisco provides the network visibility to help my staff see cyber threats data flow trends and improve our network troubleshooting.”

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Advanced behavioral detection
- Flow analytics

Use Case

Uses Stealthwatch with:
- Firewalls
- IDS / IPS
Is doing the following with Stealthwatch by Cisco deployment:
- Monitoring a centralized network with a large number of satellite or retail locations
- Monitoring traffic within a data center, physical and virtual

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Earliest detection of advanced threats (APTs, malware, etc.)
- Faster Incident response
- Forensics
- Monitors individual user activity & mobile devices
- Continuous internal monitoring
- Contextual & situational awareness
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Performance monitoring
- Forensics
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: effective
- accelerating incident response and forensics: effective
- detecting advanced persistent threats: extremely effective
- detecting insider threats / Suspicious behavior: extremely effective
- detecting malware / zero-day attacks: effective
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : very critical
Selected Stealthwatch by Cisco over the following vendors:
- Riverbed Cascade / Mazu Networks
- NetScout
- Fluke / Visual Network systems
- Open source solution

Case Study: Non Profit

Introduction

This case study of a non-profit is based on a June 2014 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled organization asked to have their name blinded to protect their confidentiality.

“We purchased Stealthwatch to gain security visibility into our internal network, the soft chewy center.”

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Value for price

Use Case

Uses Stealthwatch with:
- Firewalls
- Full-packet capture system
Is doing the following with Stealthwatch by Cisco deployment:
- Monitoring a centralized network with a large number of satellite or retail locations

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Earliest detection of advanced threats (APTs, malware, etc.)
- Faster Incident response
- Continuous internal monitoring
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Performance monitoring
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: uncertain
- accelerating incident response and forensics: effective
- detecting advanced persistent threats: uncertain
- detecting insider threats / Suspicious behavior: uncertain
- detecting malware / zero-day attacks: uncertain
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : very critical
Selected Stealthwatch by Cisco over the following vendors:
- NetScout
- Plixer

Case Study: Gannett Co., Inc.

Introduction

This case study of Gannett Co., Inc. is based on a June 2014 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Scalability up to 3 million flows per second
- User centric monitoring

Use Case

Uses Stealthwatch with:
- Firewalls
- IDS / IPS
Doing the following with Stealthwatch by Cisco deployment:
- Monitoring a large, globally distributed network
- Monitoring a centralized network with a large number of satellite or retail locations

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Earliest detection of advanced threats (APTs, malware, etc.)
- Continuous internal monitoring
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Compliance
Rated Stealthwatch’s effectiveness in the following areas:
- Detecting insider threats / Suspicious behavior: extremely effective
- Detecting malware / zero-day attacks: extremely effective
Rated how critical Cisco StealthWatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : very critical
Selected Stealthwatch by Cisco over the following vendors:
- NetScout
- Plixer

Case Study: Fortune 500 Health Care Company

Introduction

This case study of a fortune 500 health care company is based on a June 2014 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Scalability up to 3 million flows per second
- 1:1 Flows
- Advanced behavioral detection
- Flow analytics
- Customer support

Use Case

Uses Stealthwatch with:
- Full-packet capture system
Is doing the following with Stealthwatch by Cisco deployment:
- Monitoring a centralized network with a large number of satellite or retail locations

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Monitors individual user activity & mobile devices
- Continuous internal monitoring
- Contextual & situational awareness
Agrees that Stealthwatch’s user / host-level information is critical for the following:
- Security
- Performance monitoring
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- Detecting DDoS: extremely effective
- Accelerating incident response and forensics: extremely effective
- Detecting advanced persistent threats: extremely effective
- Detecting insider threats / Suspicious behavior: extremely effective
- Detecting malware / zero-day attacks: extremely effective
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: Critical
- Improving security: Critical
- Managing cyber security: Critical
- Responding to cyber threats : Critical
Selected Stealthwatch by Cisco over the following vendors:
- Riverbed Cascade / Mazu Networks
- NetScout
- Fluke / Visual Network systems

Case Study: Small Business Health Care Company

Introduction

This case study of a small business health care company is based on a June 2014 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Scalability up to 3 million flows per second
- User centric monitoring
- Advanced behavioral detection
- Flow analytics
- Customer support

Use Case

Uses Stealthwatch with:
- IDS / IPS
- Full-packet capture system
Is doing the following with Stealthwatch by Cisco deployment:
- Large Healthcare network

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Earliest detection of advanced threats (APTs, malware, etc.)
- Faster Incident response
- Forensics
- Continuous internal monitoring
Agrees that Stealthwatch’s user / host-level information is critical for the following:
- Security
- Performance monitoring
- Forensics
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- Detecting DDoS: extremely effective
- Accelerating incident response and forensics: extremely effective
- Detecting advanced persistent threats: effective
- Detecting insider threats / Suspicious behavior: effective
- Detecting malware / zero-day attacks: effective
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : Critical
Selected Stealthwatch by Cisco over the following vendors:
- Riverbed Cascade / Mazu Networks
- NetScout
- Fluke / Visual Network systems
- OpNet

Case Study: Miami-Dade County

Introduction

This case study of Miami-Dade County is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“[My favorite aspect of the Stealthwatch Solution is it gives an] overview of the network.”

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- User centric monitoring
- Flow analytics

Use Case

Is currently using Stealthwatch for:
- Network analysis & visibility
- Advanced threat detection
- Network performance monitoring & diagnostics
Uses Stealthwatch with:
- Firewalls
- Full-packet capture system

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Earliest detection of advanced threats (APTs, malware, etc.)
- Faster Incident response
- Monitors individual user activity & mobile devices
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Performance monitoring
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- Detecting DDoS: effective
- Accelerating incident response and forensics: effective
- Detecting advanced persistent threats: effective
- Detecting insider threats / Suspicious behavior: effective
- Detecting malware / zero-day attacks: effective
Saves hours per incident for determining Mean-Time-To-Identify threats and Mean-Time-To-Know root cause using Stealthwatch.
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: Critical
- Responding to cyber threats: Critical
Ranks Cisco’s customer support as above average.

Case Study: Fugro (Usa) Inc.

Introduction

This case study of Fugro (USA) Inc. is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“My favorite aspect of the Stealthwatch Solution is being able to see what is on the wire.”

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Scalability up to 3 million flows per second
- Advanced behavioral detection
- Flow analytics

Use Case

Is currently using Stealthwatch for:
- Network analysis & visibility
- Network performance monitoring & diagnostics
Uses Stealthwatch with:
- Firewalls

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Forensics
- Continuous internal monitoring
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Performance monitoring
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: uncertain
- accelerating incident response and forensics: extremely effective
- detecting advanced persistent threats: extremely effective
- detecting insider threats / Suspicious behavior: extremely effective
Saves days per incident for determining Mean-Time-To-Identify threats and Mean-Time-To-Know root cause using Stealthwatch.
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats: very critical
Ranks Cisco’s customer support as excellent.

Case Study: HCA Healthcare Inc.

Introduction

This case study of HCA Healthcare Inc. is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Scalability up to 3 million flows per second
- 1:1 Flows
- API

Use Case

Is currently using Stealthwatch for:
- Network analysis & visibility
Uses Stealthwatch with:
- SIEM
- Firewalls
- IDS / IPS

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Faster Incident response
- Continuous internal monitoring
- Contextual & situational awareness
- Network segmentation
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
Rated Stealthwatch’s effectiveness in the following areas:
- Detecting DDoS: uncertain
- Accelerating incident response and forensics: effective
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: Critical
- Improving security: Critical
- Managing cyber security: somewhat critical
- Responding to cyber threats: somewhat critical
Ranks Cisco’s customer support as excellent.

Case Study: Blue Cross Blue Shield Of Tennessee, Inc.

Introduction

This case study of BlueCross BlueShield of Tennessee, Inc. is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- User centric monitoring
- Advanced behavioral detection
- Flow analytics
- Customer support

Use Case

Is currently using Stealthwatch for:
- Network analysis & visibility
Uses StealthWatch with:
- Firewalls
- IDS / IPS

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Faster Incident response
- Forensics
- Continuous internal monitoring
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Forensics
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: effective
- accelerating incident response and forensics: extremely effective
- detecting advanced persistent threats: uncertain
- detecting insider threats / Suspicious behavior: effective
- detecting malware / zero-day attacks: effective
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: Critical
- Managing cyber security: Critical
Ranks Cisco’s customer support as excellent.

Case Study: The University Of Manchester

Introduction

This case study of The University of Manchester is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“Stealthwatch provides an holistic view of our network rather than a specific link or part of the network. The rich functionality together with the superb customer support gives us an excellent tool for combating security issues on the network.”

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- 1:1 Flows
- Advanced behavioral detection
- Flow analytics
- Customer support

Use Case

Is currently using Stealthwatch for:
- Network analysis & visibility
- Network performance monitoring & diagnostics
Uses StealthWatch with:
- VPN

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Faster incident response
- Forensics
- Continuous internal monitoring
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Performance monitoring
- Forensics
Rated Stealthwatch’s effectiveness in the following areas:
- accelerating incident response and forensics: extremely effective
- detecting insider threats / Suspicious behavior: extremely effective
- detecting malware / zero-day attacks: effective
Saves hours per incident for determining Mean-Time-To-Identify threats and Mean-Time-To-Know root cause using Stealthwatch.
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : Critical
Ranks Cisco’s customer support as excellent.

Case Study: Yale New Haven Hospital

Introduction

This case study of Yale-New Haven Hospital is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Value for price
- Customer support

Use Case

Is currently using Stealthwatch for:
- Specialized threat analysis & protection
- Network analysis & visibility
- Advanced threat detection
- Network performance monitoring & diagnostics
Uses Stealthwatch with:
- SIEM

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Forensics
- Continuous internal monitoring
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Performance monitoring
- Forensics
- Compliance
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: effective
- accelerating incident response and forensics: effective
- detecting advanced persistent threats: effective
- detecting insider threats / Suspicious behavior: effective
- detecting malware / zero-day attacks: effective
Saves hours per incident for determining Mean-Time-To-Identify threats and Mean-Time-To-Know root cause using Stealthwatch.
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: Critical
- Improving security: somewhat critical
- Managing cyber security: somewhat critical
- Responding to cyber threats : Not Critical
Ranks Cisco’s customer support as above average.

Case Study: Experian

Introduction

This case study of Experian is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“Cisco Stealthwatch is a product that provides so much insight into what is really happening within your networks and gives the best blend of advance notice of problems combined with historic reporting using standard flow data. Couple this with outstanding support and sales/marketing teams with active collaboration with customers and it’s a winning solution.”

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- 1:1 Flows
- Advanced behavioral detection
- Customer support
- flow stitching and depth of information

Use Case

Is currently using Stealthwatch for:
- Specialized threat analysis & protection
- Network analysis & visibility
- Advanced threat detection
- Network performance monitoring & diagnostics
Uses Stealthwatch with:
- SIEM
- Firewalls
- Full-packet capture system

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Earliest detection of advanced threats (APTs, malware, etc.)
- Faster Incident response
- Forensics
- Monitors individual user activity & mobile devices
- Continuous internal monitoring
- Contextual & situational awareness
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
- Forensics
- Network troubleshooting
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: effective
- accelerating incident response and forensics: extremely effective
- detecting advanced persistent threats: effective
- detecting insider threats / Suspicious behavior: extremely effective
- detecting malware / zero-day attacks: extremely effective
Saves hours per incident for determining Mean-Time-To-Identify threats and Mean-Time-To-Know root cause using Stealthwatch.
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: Critical
- Managing cyber security: Critical
- Responding to cyber threats : very critical
Ranks Cisco’s customer support as excellent.

Case Study: Webster Financial Corporation

Introduction

This case study of Webster Financial Corporation is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“I like having access to the highly trained staff to help us talk through alerts and issues that we have on our network. "

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Customer support

Use Case

Is currently using Stealthwatch for:
- Specialized threat analysis & protection
- Advanced threat detection
Uses Stealthwatch with:
- Firewalls
- IDS / IPS

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Earliest detection of advanced threats (APTs, malware, etc.)
- Forensics
- Continuous internal monitoring
Agrees that Stealthwatch’s user/host-level information is critical for the following:
- Security
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: extremely effective
- accelerating incident response and forensics: extremely effective
- detecting advanced persistent threats: extremely effective
- detecting insider threats / Suspicious behavior: extremely effective
- detecting malware / zero-day attacks: extremely effective
Rated how critical Cisco Stealthwatch is for the following:
- Monitoring visibility: very critical
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : very critical
Ranks Cisco’s customer support as excellent.

Case Study: Global 500 Financial Services Company

Introduction

This case study of a Global 500 financial services company is based on a November 2013 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service. The profiled company asked to have their name blinded to protect their confidentiality.

Challenges

Purchased Cisco because it is differentiated from competitive products in the following areas:
- Advanced behavioral detection
- Flow analytics

Use Case

Is currently using Stealthwatch for:
- Specialized threat analysis & protection
- Advanced threat detection
Uses Stealthwatch with:
- IDS / IPS
- Full-packet capture system

Results

The following are the greatest benefits of the internal visibility provided by Cisco Stealthwatch:
- Faster Incident response
- Forensics
- Contextual & situational awareness
- Cross-department collaboration
Rated Stealthwatch’s effectiveness in the following areas:
- detecting DDoS: extremely effective
- accelerating incident response and forensics: effective
- detecting advanced persistent threats: effective
- detecting insider threats / Suspicious behavior: effective
- detecting malware / zero-day attacks: effective
Saves hours per incident for determining Mean-Time-To-Identify threats and Mean-Time-To-Know root cause using Stealthwatch.
Rated how critical Cisco Stealthwatch is for the following:
- Improving security: very critical
- Managing cyber security: very critical
- Responding to cyber threats : very critical

Case Study: Vesuvius

Introduction

This case study of us.vesuvius.com is based on a December 2012 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“We are dependent on [Stealthwatch by Cisco’s] ‘Alarm and Target (Alarm Report by Type)’ for security analysis and detection.”

Challenges

Solved the following operational challenges with Stealthwatch by Cisco:
- Reduced mean-time-to-know (MTTK) root cause of network or security incidents
- Improved in network performance and forensic analysis
- Enhanced network security posture
- Increased efficiency in the identification of security threats
- Increased correlation of user identity and activity, flow collection, and monitoring and analysis

Use Case

Primarily uses Stealthwatch by Cisco in the following ways:
- Incident Response
- Network Forensics
- Security Forensics
- Network performance monitoring
Used Stealthwatch to detect or prevent the following security threats:
- Network malware or virus
- Suspicious user behavior
- External hacking attempt
Is doing the following with Stealthwatch by Cisco deployment:
- Monitoring a large, globally distributed network

Results

Chose Stealthwatch by Cisco for the following capabilities:
- Behavior-based security monitoring
- Real-time flow monitoring capabilities
- DDoS
- Scalability
Selected Stealthwatch by Cisco over the following vendors:
- Riverbed Cascade / Mazu Networks
- NetScout
- Fluke / Visual Network systems
- Open source solution
Meets enterprise requirements by utilizing the following Stealthwatch by Cisco benefits:
- Scalability and flexibility
- Improved incident response and threat management
- Enterprise-wide visibility into network activity
Rated the following Stealthwatch by Cisco capabilities as compared to competing vendors:
- Network Security: Better
- Scalability: Better
- Network Visibility: Better
- Innovation: Better

Case Study: Council Rock School District

Introduction

This case study of Council Rock School District is based on a December 2012 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“Prior, I had no consolidated single view picture that provided, with a single click or two, the depth of information. I could get the depth, or the broad stroke, but not both. Cisco provided me with the visibility I needed.”

Challenges

Solved the following operational challenges with Stealthwatch by Cisco:
- Reduced mean-time-to-know (MTTK) root cause of network or security incidents
- Enhanced network security posture
- Increased efficiency in the identification of security threats
- Improved forensic analysis
- Increased correlation of user identity and activity, visibility of mobile devices, flow collection, monitoring and analysis

Use Case

Primarily uses Stealthwatch by Cisco in the following ways:
- Network Forensics
- Security Forensics
- Application performance monitoring
- Network performance monitoring
Used Stealthwatch to detect or prevent the following security threats:
- Suspicious user behavior
- Network reconnaissance
Is doing the following with Stealthwatch by Cisco deployment:
- Monitoring a centralized network with a large number of satellite or retail locations

Results

Chose Stealthwatch by Cisco for the following capabilities:
- Behavior-based security monitoring
- Real-time flow monitoring capabilities
- Internal visibility
- Forensics
- Auditing and compliance requirements
- Identity awareness
- Application Aware Network Performance Monitoring
Selected Stealthwatch by Cisco over the following vendors:
- Open source solution
- Cisco
Meets enterprise requirements by utilizing the following Stealthwatch by Cisco benefits:
- Scalability and flexibility
- Real-time threat detection and correlation with user identity data
- Improved incident response and threat management
- Enterprise-wide visibility into network activity
- Deployment and support simplicity
- Enterprise-wide user monitoring
- Forensic analysis
Reduced the time it took to mitigate a security incident by > 75% by deploying Stealthwatch.
Rated the following Stealthwatch by Cisco capabilities as compared to competing vendors:
- Network Security: Much Better
- Performance Monitoring: Much Better
- Scalability: Much Better
- Network Visibility: Much Better
- Innovation: Much Better

Case Study: ViaSat

Introduction

This case study of ViaSat, Inc. is based on a December 2012 survey of Cisco Stealthwatch customers by TechValidate, a 3rd-party research service.

“[Cisco’s Stealthwatch] is a great way to see threats proactively.”

Challenges

Solved the following operational challenges with Stealthwatch by Cisco:
- Reduced mean-time-to-know (MTTK) root cause of network or security incidents
- Improved in network performance
- Enhanced network security posture
- Increased efficiency in the identification of security threats
- Increased flow collection, monitoring and analysis

Use Case

Primarily uses Stealthwatch by Cisco in the following ways:
- Incident Response
- Network Forensics
- Network performance monitoring
Used Stealthwatch to detect or prevent the following security threats:
- Network malware or virus
- Suspicious user behavior
- Network reconnaissance
Is doing the following with Stealthwatch by Cisco deployment:
- Monitoring a large, globally distributed network
- Monitoring a centralized network with a large number of satellite or retail locations
- Monitoring traffic within a data center, physical and virtual

Results

Chose Stealthwatch by Cisco for the following capabilities:
- Real-time flow monitoring capabilities
- DDoS
- Scalability
- Application Aware Network Performance Monitoring
Selected Stealthwatch by Cisco over the following vendors:
- Arbor Networks
Meets enterprise requirements by utilizing the following Stealthwatch by Cisco benefits:
- Scalability and flexibility
- Real-time threat detection and correlation with user identity data
- Improved incident response and threat management
- Regulatory compliance
- Enterprise-wide visibility into network activity
- Forensic analysis
Reduced the time it took to mitigate a security incident by 25% to 49% by deploying Stealthwatch.
Rated the following Stealthwatch by Cisco capabilities as compared to competing vendors:
- Network Visibility: Much Better
- Performance Monitoring: Much Better
- Innovation: Much Better
- Network Security: Better
- Scalability: Better

TechValidate Research on Cisco Secure Network Analytics

71 Case Studies – Page 2 of 3

Case Study: Large Enterprise Professional Services Company

Introduction

Challenges

Use Case

Results

Company Profile

About Cisco Stealthwatch

Case Study: Medium Enterprise Media & Entertainment Company

Introduction

Challenges

Use Case

Results

Company Profile

About Cisco Stealthwatch

Case Study: Large Enterprise Financial Services Company

Introduction

Challenges

Use Case

Results

Company Profile

About Cisco Stealthwatch

Case Study: Global 500 Energy & Utilities Company

Introduction

Challenges

Use Case

Results

Company Profile

About Cisco Stealthwatch

Case Study: Large Enterprise Media & Entertainment Company

Introduction

Challenges

Use Case

Results

Company Profile

About Cisco Stealthwatch

Case Study: State & Local Government

Introduction

Challenges

Use Case

Results

Organization Profile

About Cisco Stealthwatch

Case Study: Educational Institution

Introduction

Challenges

Use Case

Results

Organization Profile

About Cisco Stealthwatch

Case Study: Fortune 500 Automotive & Transport Company

Introduction

Challenges

Use Case

Results

Company Profile

About Cisco Stealthwatch

Case Study: Educational Institution

Introduction

Challenges

Use Case

Results

Organization Profile

About Cisco Stealthwatch

Case Study: Education Department

Introduction

Challenges

Use Case

Results

Organization Profile

About Cisco Stealthwatch

Case Study: Toronto 2015 Pan Am Games – Cisco Systems Canada, Inc.

Introduction

Challenges

Use Case

Results

Company Profile

About Cisco Stealthwatch

Case Study: Medium Enterprise Banking Company