State of Michigan Case Study

The speaker: Anthony Rodgers

Director of Enterprise Solution Design Services, Office of the Chief Technology Officer, State of MI

Anthony’s department is responsible for enabling a government that works for Michigan’s 10 million residents.

Which aspects of NIST does Tufin help us meet?

Tufin helps the State of MI meet many NIST 800-53 controls, specifically the requirements highlighted in orange:

• Enforcing approved authorizations
• Authorizing internal connections
• Documentation
• Establishing a traffic flow policy

Tufin also helps manage a complex regulatory environment.

Challenges we had to overcome

• Paperwork, paperwork and more paperwork
• Transitioning compliance from a command-and-control environment to trust-but-verify
• Eliminating manual dependencies to find mistakes
• Moving away from “paper-like” processes
• Achieving security guardrails, control and consistency at scale

Security changes in minutes, not days

Tufin eliminated manual processing. Over 4 months, the average time to implement a network access change request dropped from 5.1 days to less than 1 day, even while access change request volumes increased by 25-50% due to Covid-19.

Firewall management issues were fixed through a standardized set of service rules:

• Defined guardrails or data communication standards based on pre-approved rules (for example, enterprise services that may be consumed by an endpoint)
• Eliminated redundant and inconsistent rules
• Eliminated guesswork
• Simplified access change requests for users

Eliminating manual processes to increase productivity and accuracy

• Removed manual steps
• Supported the addition and incorporation of new technologies
• Unified silos and encouraged shared responsibility, eliminating the “throw it over the wall” approach to the cloud team, IPS team or Azure team through automated workflows and transparent policy standards

Implementing 3 modules of Tufin Orchestration Suite

Tufin SecureTrack

• Creates guardrails that keep individual rule requests within standards
• Automatically validates rule compliance and implementation
• Detects and remediates access changes that did not go through the approval and validation process

Tufin SecureChange

• Automates and orchestrates the right rule, on the right firewall, on the right platform
• Eliminates sending Remedy tickets off to multiple teams
• Eliminates typos and manual input errors
• Automates clean-up by eliminating obsolete and shadowed rules

Tufin SecureApp

• Shifts from a Layer 3 to a Layer 7 view of connectivity
• Describes business applications the way they are described in the data communication standard, giving a complete picture of business application connectivity