Cloud Gate, Chicago (Photo by Sawyer Bengtson on Unsplash)
Best Practical attended the Educause Security Professionals conference last week, this year hosted in Chicago. We were excited to attend this year as we were able to increase our visibility a bit with a display table in the vendor area. This led to many people stopping by to tell us they run RT or RTIR in various ways, for security and many other applications as well.
The conference always has a theme and presenters had fun last year with a nautical and pirate theme in Baltimore. This year they kept up the fun with a "Windy City" theme and talks like "After the Storm" and "Driving the Winds of Change." Our favorite was "Tornado Talks in Ten" which was their variation on Lighting Talks first made popular years ago at the early Perl Conferences.
One of our takeaways was the importance of automation and integration between tools used by security and incident response teams. These groups deal with a huge amount of incoming data from logs, monitoring systems, and alerts and they need to identify the most important problems to focus on. The most successful teams are able to identify repeatable processes and automate them, leaving security analysts to work on the harder tasks that need special handling.
We have worked with customers for years on just this sort of automation and integration, and these projects often pay for themselves with time saved in the months and years after they are put in place. As new monitoring tools become available and existing tools add new features, we're always happy to work with RT and RTIR users on integration projects. And the best part is we often open-source the results of these projects to benefit other universities.
One other message we were happy to hear is the value of various open source projects in the toolbelts of security teams, and especially the value of projects that offer a commercial support option. The University of Michigan described the wide array of tools they have deployed to support their security operations, many of them open source. And we're flattered that they identified Best Practical as providing the "Best software support they have ever experienced!" We try hard to provide the best support we can for our customers and it's great to hear we're doing a good job!
If you're not familiar with how RT and RTIR are used by security and incident teams, we have an introductory video that explains one way RTIR workflows are used in incident management. If you'd like to learn more, feel free to contact us for a demo any time. We hope to see you next year in Seattle for Educause Security 2020!