Cheshire County government mitigates ransomware risk and secures data regulated by HIPAA and CJIS

Challenge

• Protect large volumes of sensitive and regulated data
  The county stores substantial amounts of criminal justice data, financial records, Social Security numbers and protected health information. With only a five-person IT team, manually reviewing audit logs to ensure secure handling and compliance with HIPAA and CJIS requirements was not feasible.
• Reduce ransomware risk across critical systems
  The IT director saw the growing threat of ransomware attacks targeting local governments and needed a way to quickly detect anomalous activity on any file server to safeguard data availability and security.
• Resolve operational issues faster
  To maintain reliable services for Cheshire’s citizens, the IT team needed to quickly investigate issues such as files being deleted or moved. However, finding the root cause of these problems was complex and time-consuming with existing tools.

Netwrix solution

Robert Hummel, IT director at Cheshire County Government, had been using Netwrix Auditor Free Community Edition and liked how it transforms cryptic audit logs into usable information and simplifies security auditing, so upgrading to the full version of Netwrix Auditor was an easy decision. He was impressed by how little time was required to learn to use the product effectively, since the interface is clean and easy to navigate.

• Automated security auditing. The software reports on activity across AD and file servers, and alerts the IT team about the most critical events, such as privilege elevation, changes to AD group membership and multiple failed login attempts, so they can respond promptly to active threats and serious policy violations. The IT group said that the software saves them two hours a day on routine file auditing, which adds up to an entire week of work every month.
• Detection of ransomware and other threats. Netwrix Auditor provides a consolidated view of all anomalous activity across the county’s IT environment, so Robert and his team can quickly spot a malicious actor, whether it is ransomware, a disgruntled employee or an intruder.

• Faster troubleshooting. When the IT group gets a call that a file has been moved, deleted or modified, they don’t have to dedicate hours for investigation. Instead, they go to the Netwrix Auditor console and see what happened to the file in a matter of minutes. With the complete who-what-when-where details at hand, they can educate the person responsible for the issue about proper data handling procedures, thereby reducing the risk of similar problems in the future and ensuring uninterrupted services for county residents.

Key benefits

• Improved security of residents’ data
• Mitigated the risk of ransomware
• Ensured business continuity
• Increased IT efficiency