Cyber security threat monitoring

Cyber security threat monitoring complements and enhances your existing cyber security toolkit by integrating with existing investments such as antivirus and endpoint detection services to improve your security posture.

How it works

The service provides a single pane of glass, alerting you to signs of potential concern that your organisation could be at risk from attack, by monitoring key security controls that you have implemented.

The service gathers logs from your existing utilities into a single dashboard, highlighting the most significant and helping you prioritise resources. By correlating events that would otherwise go unnoticed, it helps you highlight risks from multiple sources.

You will receive timely alerts of activities and changes that could indicate unauthorised access to your systems, for example, tracking the number of failed login attempts to high privilege accounts from unusual or unexpected geographic locations. Additionally, the same user appearing to authenticate from multiple locations simultaneously could indicate a compromised account.

Alerts are categorised by their potential level of severity. Critical alerts are sent to the Jisc CSIRT team, who will provide advice, guidance and remedial actions to mitigate potential threats. 

Benefits of the service

The service is fine-tuned to meet your requirements, adjusting detection thresholds and rules as necessary to separate suspicious activity from business-as-usual activity.  

Our analysts triage any alerts, assessing the threat severity and providing recommendations to you about how to resolve the issue. This reduces your own team’s workload so they can focus on the most significant issues. You have the assurance that you will be advised of critical alerts on your infrastructure 24/7, 365 days a year.

Cyber security threat monitoring:

• Is designed to overcome the sector-specific challenges of looking for a security monitoring solution
• Frees staff from monitoring your network and analysing log outputs
• Quickly provides clear information on vulnerabilities and threats so you can act fast to protect your systems
• Assists with and demonstrates your organisation’s compliance with sector body requirements on cyber security
• Is a market leading value solution from your trusted partner to strengthen your security posture

Co-designed with members

To develop a service that works for you, Jisc worked with members to identify use cases including:

• Same user logging in from multiple geographical locations at the same time
• Brute force detection
• Unauthorised or unexpected remote desktop session
• Privileged group changes

Together, the service was designed around these requirements. Jisc worked with industry leader Splunk to build a bespoke cloud platform based around the requirements of the education and research sectors - this approach has helped create a service that does what’s needed.

When you become a service user, you’ll be able to feed into our continuous improvement processes to help us develop the service so it can meet changing needs and adapt to emerging threats.