2020 UNC CAUSE

The year is 2015. UNCG is subjected to extensive phishing campaigns. Compromises are rampant. The Information Technology Services (ITS) division does not have an operational IT security team. In response, the unit at UNCG responsible for email, the Cloud Collaboration and Productivity Services (CCPS) group, develops middleware to process and remediate compromised email accounts based on Gsuite and SSO logs.

Fast forward to 2020. Accounts are still being compromised. The middleware CCPS used to develop the compromise processing application is now outdated and a security risk, and CCPS is responsible for more cloud services, extending their workload. But on the other hand, UNCG has invested in security and compliance and ITS now has a fully-staffed security operations team. Splunk is indexing more data. And a recent CCPS reorganization has opened doors for more sophisticated middleware DevOps.

The time is right for a refactor.

This talk will discuss the changes in IT organization and architecture, and share how the CCPS and Security teams at UNCG partnered to move account compromise logic (and exceptions) out of PHP middleware and into Splunk, as well as developed messaging systems using webhooks to better safeguard cloud services and facilitate remediation.