001Good afternoon, everybody. Thank you uh everybody for being able to join uh this webinar today on the EDR services through the This webinar is uh being hosted uh both by TEA and the MSS team uh specifically SAIC. Uh we've got some some information to to share uh and so we'll we're going to get the show started here. Uh a a few housekeeping items that we typically go over uh those being that the webinar is being recorded uh and the recording and the slides will be made available uh a few days uh at the end of the webinar. Um the chat is turned off, so if you have any questions uh please put it into the Q&A section uh and then we will answer those questions if we have a chance as as we go along
002or if not, then we will email everybody who asked a question uh responses to not just your question, but any of the others that we receive as well. Uh duplicate logins are not allowed, so we prefer that everybody just uses their own login uh and we do not allow of the use of chatbots uh and the team will remove those uh if they are seen. Uh so those those are our our our few housekeeping items, so uh thank you again for for making it here with us today. We've got lots of stuff to talk about, some exciting news on on on this different services available through the MSS. So SAIC, if you take over, please. All right. Let's see. Let me see. Good afternoon, everybody. My name is Frank Crichton. I am the um outreach
003and uh growth director for the MSS program uh hosted uh for state of Texas. And it's our pleasure this afternoon to uh present to you the uh endpoint detection and response uh service and solution that we use uh here within the state of Texas. Um it is service you that is available to uh to uh agencies, school districts uh across the state and really is a great service and a great value uh to uh secure and increase the security posture uh within uh your own school district. Uh today with me uh I have a couple of uh really smart engineers. They are they are actually the smart guys in the room that make all this stuff work very well. So uh we'll be hearing from uh Sean Barrett later uh to go over some of
004the architecture and some of the um uh views and shut screenshots for that you might see depending on which console, which uh solution you use. We also have Adam Wise uh on the uh call as well to uh help answer any questions. For those of you who do have questions during the course of the conversation, uh please put those in the Q&A section. We do have folks uh Adam and Sean uh monitoring uh questions that will be coming across. Uh so uh we will be happy to uh uh address what we can and uh if we need to have a follow-up, if you would like to have a follow-up with us, uh you will find later how to uh be able to uh uh get in touch to uh um to get the help uh
005and uh questions answered that you're looking for. Uh so with that, uh we will just will jump right in here. So EDR will be going over what the EDR service is. And we'll talk a little bit with this about the concept of managed services. That is something that the state of Texas has looked into as an ability to be able to help deliver security services to as many people and as many organizations across the state as a high value price for the state. So some good stuff there. So we'll explain the concept of a managed security service and specifically with this one. We'll go into Sean to go into the architecture. So I know we've got quite a few of you all that probably are like, "Yeah, I know what EDR is, but tell me
006about the specifics of what this what this looks like. What's the flow? What are our options that we have? Show me some of the technical details. So we'll be going over that as well. We will also have some screenshots about you know, just kind of what kind of what you all can look forward to as far as um you know, the benefits and value to you. We'll also and then we'll finish up with there are some specifics to TEA that Daniel will be going over with everybody. And then finally we will show you how to get in touch with us. So looking forward to it. So with that, let's just kind of jump right in to what is a managed security service. For in state government and not my just a little background for me.
007I've been I've been for 24 years. The state of Texas is actually the 10th state that I've done uh through uh services for delivery for. Uh and within the state environment, managed security services is a newish uh approach to providing uh services. The idea around managed security services is you have a very well-defined uh service solution. Uh in this case, it's around endpoint uh detection and response. Using standardized indus- industry tools, uh we use CrowdStrike and SentinelOne. Uh you have options. And then within that, we define the service and the delivery element of what you receive. So, uh the benefit to uh the benefit for a security managed security service is that you understand this is what I get. There's no ambiguity. There's no, "Well, you know, I'd really like to kind [clears throat] of
008have this." Or, "Oh, didn't know about that." Uh it's it This approach really does help define um to a lot of detail what you can receive, how you can receive it, and the benefits that uh are derived through you and your organization. Uh and it allows you also in this model to uh create what we call resource enterprise pricing, which is a you know, the state pays for this in a per-unit basis. So, you know, if uh in in this case, it's for every endpoint. Um and it creates a a very easy and uh much more um much more uh budget-friendly approach to understanding what my what my cost could be. I just take the number of endpoints, I multiply it times the uh the end unit rate, and there you go. Um now, that
009that sounds easy, um but we'll talk a little bit later about utilization rates and some of the things that uh we're looking at to uh try to help you provide that visibility, so you actually can know what you are actually are consuming, cuz that's the part where I think a lot of us when we get into EDR, are surprised that oh wow, I actually have that many endpoints on my network. Oh wow, we actually have that many devices out there kind of in the wild. Uh so uh we'll be working on uh we'll be working on uh some ways to help show you uh what uh how you can know, how you can uh understand what's out there and where it's at. And more importantly, how to secure it. Uh the other thing, um some
010of the benefits that you get, it really um a lot of managed security services are really built around the idea of how do we create and value to reduce the level of effort that it takes for you to manage the securing of these endpoints. So, that allows you as an say an administrator, as a uh director, as, you know, somebody who's just out handing out Chromebooks, it allows you more time to do uh more nuanced and also more specific security services for your particular school district. Uh we take that burden, uh a lot of heavy administration lift, a lot of the monitoring lift, and a lot of the um uh response lift off of you uh to allow you do to do other things. Uh it helps uh school districts' dollars to go farther. Uh
011it helps um taxpayers uh be assured that one, uh, you're we are good stewards of taxpayer dollars, and that two, we also, um, are making sure that we're doing the best we can to secure the environment that, let's just be honest, all of our children are going through. Um, part of what we've got within our services is, um, a lot of a lot of you might have heard something called a sock. Uh, so, the other advantage to this is we can see we have a visibility through our sock and our ingestion in this managed service to be able to see where threats are, see where threats are active, and then be able to quarantine those so that if it happens in one place, we don't have to worry about happening everywhere across the entirety of
012the state. So, it gives us the visibility, um, to, uh, keep everybody, uh, as as secure, uh, as, um, you know, the dollars will allow. Um, the MSS, uh, some of you might be saying, "Okay, well, that's great. We're talking about endpoint, uh, management." But, in addition to that, we also have other services out there available through the, uh, through DIR on the MSS contract, and we we actually this is for SAC, this is what we do. We, uh, we do a lot of security work across all levels of government, from local government all the way up to, um, Department of Defense and Intel, uh, and everything in between. Uh, securing, uh, securing our, um, securing the organizations that support service to citizens, that is that is kind of what we do. That is why
013we are in business, and that is who we are here to serve. So, within this managed security services, while we are here today to really deep dive into EDR, there are a lot of other services that are available. TCF assessments, pen testing, um, network, uh, network detection, there you know, dark web tracing if you have I mean this this is cool. It's amazing what kids can get into today. Um, so lots of other services. Just know what uh we are we were selected because we do bring expertise in just more than just this one space. Uh, so with that you have the assurance as the MSS provider, you have that you have somebody that's actually looking broadly and globally to be able to identify and to be able to help remediate and mitigate uh, risk
014to you and risk to your organization so that you can go focus on other things that are important within your environment. Um, some of the benefits of EDR. So EDR endpoint detection and response. It is securing the edge. It's the devices that are out on your network that are you know, that are mobile and they're moving around and you just who knows on who knows what's on them. You know, and you know, there's a lot of threat, a lot of ability for bad actors to be able to infiltrate your organization's networks, your organization's infrastructure uh, because you know, this is the hard part. Securing securing all those devices that are out in the wild and making sure that we can track them, making sure that we know where they're at. A couple of things that
015we bring to the table around the EDR is um, we bring two of the leading uh, EDR solutions. CrowdStrike. Um, anybody who ever spends any time out on any reading any security uh, you know, newsletter, publication, website, Reddit, uh, Substack thread you're going to hear CrowdStrike. You know, the The one is uh, Signal One. Uh we bring uh both solutions. They're very much the same. But they also have some nuances that uh make them uh very different. So, we brought uh we brought two different solutions to the table to be able to allow you as an organization to select the right solution for you and your organization. Okay? Um while managed security services is a resource unit, very uh very uh defined service delivery. We do this through things such as um uh we do
016this uh to uh make sure that you have options. We as the MSS provider, we're not here to push one solution over the other. We're just not. Uh for us, it is about securing your organization, your um your uh environment with the solution that best fits your needs. Uh so, uh with that, we have a couple of ways that we uh engage with you. And we are happy to talk through the nuances. Shawn will be highlighting a lot of those uh later on. Um but uh we do want to, you know, as we move forward for us, it does We're not here to promote TA does not promote one over the other. Um what we are here to promote is the best solution for you to secure your environment. Uh some of the um benefits
017you you get uh with the solution, you get 360 uh you know, 365 24/7 monitoring. Um we do have an RSOC uh that uh solution that we will talk about a little bit later. They have a slightly different uh monitoring uh environment. But for um for two of our services, it's 24/7 365. Uh you get uh professionals such as Shawn and Adam and a whole and a large team behind them backing them up that help identify monitor identify and remediate quickly so that things are contained if if something does happen the speed that maintaining it and quarantining it is greatly reduced our tools our solutions and our processes around those around all of these are also Texas compliant so one of the big benefits is you know we actually implement any legislative any policy any
018changes in the environment that might come from you know who knows from the legislature from the governor's office wherever we we actually get those early we build those into the tools so by using the EDR tool and EDR system you're actually able to you'll be compliant you don't have to worry about that um let's see zero learning curve with the deployment we're here to help you and that is not something that you know this is not a just oh sign up for and you never hear from us again this is a service where we're here to help you out we have ways for you to be able to contact us get in touch with us ask for that and then optimization of your resources that's what that's one of the things that we look at
019how can we make this easier better for you and we use the term better cheaper faster in our environment and that's what we're looking for so I have just thrown a lot at everybody so I'm going to pause there anybody and if you have any questions be sure to put those in the Q&A. Um and then we um we can go uh we can go from there. Um let's see. Next slide. So, we have three services that we offer for um for EDR, okay? Our first service uh we call shared. And this is just a quick uh up so uh slide to give a high-level uh overview. You'll see a lot of the same thing within this. So, within the shared environment, you get you get like advanced threat detection, you get 24/7 uh automated
020in- incident responses. Uh you know, our second tier of service is what's called dedicated. Um and then we finally have a we also have a service that we run through the R SOCs um as well. So, um Shawn will have uh some more detail about some of the nuances between the three services. Uh as you see, a lot of it goes to um uh a lot of it goes to who's actually doing uh the um advanced threat detection um and who has got your back. So, uh um and then um so, with that, we'll go into a little more detail and you and I will um now turn it over to Shawn uh to give you some of the uh detailed architecture overviews uh each of the three services that we talked about we just
021uh briefly showed you on the screen above. So, Shawn, I'll turn it over to you. All right. Hey. Uh thank you very much, Frank. Let me go ahead and get on camera there? Hello everybody. Uh so to briefly introduce myself for any of those that I may be a new face or name for, uh my name is Shawn Merritt. Uh I was on the AT&T uh side of the house with Adam and others when we started the EDR program that uh a lot of uh you are all part of. And um we are now here uh on the SAIC side uh trying to continue uh bringing that same level of service that we always have uh for you. Going into this slide, uh the security architecture, uh you may be familiar with what we used
022to call standard. Uh it's now called shared. So, uh shared EDR is uh the solution where our team does all the heavy lifting uh for you. Uh we're going to take care of all the configuration. We're going to take care of managing the day-to-day in the consoles. We are going to take care of all the detection triages. Um everything uh that is the um the lift part of uh the EDR, so to speak, uh is going to be done by our team. Um you'll [clears throat] be getting notifications of the detections that uh happen in your environment um from our SOC team. Um and that's always been the case. Um going forward, uh we do have a new SIM. Uh I apologize. So, for a lot of folks that have been with us uh for
023some time, uh we used to have a SIM solution called Devo. Uh we're now using uh Microsoft Sentinel solution. And in the chart that we have here, uh you kind of see uh the flow of how those events are ingested on our side and then triaged by our team. Uh it's pretty straightforward, uh so I don't want to uh, bore everybody too much with a lot of technical details, especially if these are things everybody um, you know, is already familiar with. Uh, but for any new customers or anybody out there that may not know exactly what these tools are, um, uh, a SIM is a security information and event monitoring tool. It's basically a piece of software that allows us to monitor the events coming off of uh, your EDR uh, console, your agents, uh,
024the your host, if you will, and see it in real time, and we're able to respond to it uh, with our security uh, teams that are monitoring your environment 24/7. Uh, so shared, as I was saying, uh, used to be called uh, standard. Um, you know, we you have a uh, an ancillary uh, an an auxiliary team, uh, if you will, um, at your at your disposal. Uh, if we contrast that uh, with um, Frank, if you want to go to dedicated, our dedicated solution, those are going to be for anybody um, that has an existing relationship with either uh, the two vendors that we use, um, CrowdStrike and SentinelOne, or has the ability with a staffing uh, that's jump in discussion that could be had uh, with uh, both TEA and you know, everybody
025uh, the customer involved. If you have the staffing and the um, the use case to take on uh, the lift yourself, uh, that is. So, dedicated used to be called custom, and dedicated is is more what it says it is. We are dedicated to helping make sure that the uh, flow of communication between you and the vendors uh, that you're you know, using your license for that we're facilitating happen smoothly while also monitoring those advances a backstop through our sock the same solution that we had on the standard side of the house. >> [clears throat] >> The you know, main benefit for a dedicated customer would be somebody that wants to have full ownership over their solution wants to take care of the configuration the detection management the triage everything from start to finish so
026to speak. with the helping hand of an advisement so to if you will of our teams watching your events through our sim and being a backstop for anything that with crowdstrike their Falcon complete or Sentinel one their vigilance teams are not able to provide a dedicated customer. We all work together hand in hand. Um from an architectural standpoint this does look just a little bit differently in regards to who manages the day-to-day you know, who is admins in the consoles with our shared console you do have a read-only access level as we are managing the consoles. We don't want to enter into a co-management situation ever and have any ambiguity in the audit trails. So for shared customers, you are given a a just a read-only access ability. You can do a great deal of
027things in the console but we are managing it. Dedicated you are actually managing it. So you are the admins in your console. You have the ability to you know, do the management actions. So this is really comes down to the choice of the customer. What is the benefit for you? We do have the uh in the contractual language there the existing CrowdStrike or Sentinel One solution. So this is something that you've already you would know it if you have that relationship. If you are wondering like oh do I already have this? So this would be for customers that already have environments and we are going to help basically migrate their environment to our environments with the management of the vendor CrowdStrike or Sentinel One being the support resources for anything that you know troubleshooting support
028and backstop in the case of CrowdStrike SOC and complete teams. But we would be there monitoring your events through our 24/7 SOC teams. Um Next slide. So for the R SOCs. Now this is a a newer addition to the service offerings. It was in its early stages before the transition has taken off. And that is going to be the the regional SOCs through our fine college institutions across the state. There are a few that we are currently working with right now. And I'm sure many of you are familiar with them or referred about them as those contacts have been going out for both the ARTA and I believe the R SOCs themselves. But to go into this, this is going to be a more um how you say nuanced scenario in regards to how everything
029looks architecturally. So I didn't want to go too fast through the other slides, but in the sake of time I did want to try to reserve some time for this slide as it just may, uh, you know, have some, uh, existing customers or potentially new customers, uh, more, you know, wondering how this is going to look, uh, going forward with our, um, you know, our service offering in the MSS. Uh, so, you know, everything, uh, that was previously said still applies in this situation. The RSOC is just now you should treat them as though they are the, uh, their own dedicated or custom, um, customer themselves that are also offering up their services to other, uh, customers, uh, beneath them. So, the, so the school systems, uh, formerly known as LEAs or ISDs, um, you
030know, everybody that is coming, uh, to them or other services, um, will flow through those RSOCs. Um, however, we are still integrated with their environments to a degree where we are watching those events through our SIMs and helping to assist with, uh, a backstop of, um, you know, monitoring for events and helping, uh, to, uh, be a bridge between, uh, the vendors for both, uh, solutions. Uh, there's an RSOC for CrowdStrike as well as SentinelOne, uh, solutions. Um, the, uh, big thing here is that we, uh, do not have admin, um, ability or or, uh, admin, um, access to those consoles. Uh, that is at the behest of the, the RSOC. Um, however, we are now, kind of like with our shared customers, uh, the read only and the, uh, in those consoles to have
031a, you know, our, we have the visibility and are able to assist, but we're just not taking those management actions. Those will all be through the RSOC and those RSOCs support teams will be basically the same teams that you work with on our side. And so any of any questions please put those in the chat. I do see quite a bit going on there so and if I am going too fast at all, I do apologize. I'm trying to do keep my eye on both of them. They're you know if there's anything I need to stop or go back on please allow me with a hand raiser anything you need. Okay, so going on to the solutions themselves. The biggest takeaway really from these slides is your endpoints have a lot to say. Over the
032last you know 7 years building out this program one of the things we have seen both of our tools S1 and CrowdStrike do is provide a incredible amount of data and insights to your environment that a lot of people didn't even know existed. Especially anybody that is a smaller you know size organizations especially K-12 where your main you know role is just trying to help help help teach our children and may not have the technical ability to staff to you know handle a security program for example or managing a huge EDR rollout. And once we do get it rolled out well what do you do with all that data? These tools actually help create visualizations and dashboards and um other helpful insights that give you a wide range of actionable intelligence that you didn't have
033before. Mainly what I want to touch on is the managed and unmanaged access uh sections that are are found across both. CrowdStrike has theirs in a a a different format. It looks a little different. That's what you're seeing here now. But I bring that up because when an EDR agent is dropped on to one of your host, it is going to scan the environment that is on. It's going to look for other hosts with CrowdStrike on it, for example, or look for a printer, an IoT camera, and then label it as such. Um one of the categorizations, the labels, is managed versus unmanaged in this example. And an unmanaged asset is something that the agent is able to see on your network that can take the CrowdStrike or it's another one if we use it
034in another different scenario, agent, but doesn't have it on it. And it can help you identify gaps in your environment where you don't have the agent on your all the hosts that you are able to have it on. For example, say you say, "TA, I'd love to take advantage of this program." They say, "Great, you're approved for 1,000 hosts." You get in there. You're trying to deploy out. You get a few hundred and you think you're good. I think you're good to go. Come to find out you have a lot of hosts that you don't have the agent on. Exposure management through CrowdStrike can actually help you identify those hosts, so that way you can make quick work of getting the agent deployed out to them. Um and then shore that up. So, anybody that's
035you know, right now trying to go through any alignment with their approved versus deployed out numbers, Uh you know, the CrowdStrike's uh agent uh exposure management section can definitely help you do so. And if you are an existing customer and uh you know, you have questions about that, uh we can definitely um you know, go over that with you at another time. Um S1, Sentinel One, has similar abilities. And if you want to go to the next uh screen, uh one of the biggest things about um Sentinel One that I like is their ability to have a deep visibility into your um security events. Um a security event is a security event. There are a lot of tools out there that will alert you to uh things going on in your environment. They will tell
036you all types of um you know, flashing red signs if you've clicked this, it's warning, you know, virus. Uh the old school, you know, virus, you have a virus on your system. Uh but what do you do with that information? Or what is how clean or um actionable is that information is what really helps you through um prevent a security event from escalating further and also um you know, dealing with any security event when it happens. And in both of the tools, they have what's called a deep visibility or the ability to do an advanced event search. Uh for this example, we show S1's uh deep visibility. Um and in the console, you'll be able to get a a a where where the where uh the process uh you know, where it started, where it's
037ending, and uh where it is finishes with the agent taking action, not taking action, alerting on it. Um There are quite a few few actions that can be done uh via the console such as network containment, um which we could we we go over with all of our customers uh you know, on our call. But uh what I'm getting at, I apologize, uh that's kind of going on there. I I saw a few of the the crowds uh the questions going is that the deep visibility into your security events is leaps and bounds ahead of what you have not having EDR on your system and it's both historical and real time. The longer the agent sits on those hosts the more data we're able to retain and store and sift through in the event of
038security event. And then I believe we've got one more slide. Sorry. And I will turn this over to Daniel, I believe. Where the Yes. Sorry. Thank you. Well, thank you. So some things to know and to set expectations as we've communicated to to our schools on the program itself specifically we are focusing on the EDR service today. The TA does currently [clears throat] limit the school systems in scope to those with an enrollment of 50,000 and below. The amount of licenses that a school system is eligible for is based on the student enrollment and we take 30% of the student enrollment as the number of licenses that are given to a school. If for our very small schools we do have a minimum of 30 licenses. So if your 30% would be less than 30
039licenses that we would just get the 30 licenses. But for other schools we do take into account your student enrollment and and provision you with with 30% of that. >> [clears throat] >> The uh program starts off for those schools that are interested in signing up for the services that are currently not customers. So if you are interested with first of all uh completing a um IOC with DIR. The the IOC with DIR then will give you access to the DIR SDS portal. Uh and in the portal you could request the services uh including EDR. The um the process for requesting it is really simple. Once you log in to the STS portal, you would request uh the EDR service. Uh you'll answer a couple of questions uh about how many licenses you need based
040on the endpoints that you have. Uh and then we go from there. You are allowed to ask for the your the maximum allocation of 30% of your student enrollment if that's what you prefer. Uh and then you'd be allocated that. Um So once once approved uh your request once your your request is approved, um the MSS will reach out to you uh to schedule the kickoff call. Uh where they will explain in more detail the program uh and you know, uh provide you access to the console uh and and and things like that. For existing customers, uh we encourage you to make full use of your total approved licenses. So any unused license uh currently mean that uh potentially others would not be able to use them. We are currently going through a realignment where
041we are focusing efforts on making sure the schools deploy to everything they need. Uh and then um sort of adjusting the numbers to make sure that there isn't any miscommunication because the EDR service has always been and will continue to be a first come first serve service. So if you are not utilizing all of your allotted uh agents, then we will reallocate those uh to other schools. Um if ever you determine uh you need more, you can always go through the add-on process uh and include justification uh and if approved uh you would be able to of course add on additional agents assuming that we still have some available to to disperse. Uh school systems have 60 days uh to deploy to 90% of your allotted agents. And so for those existing customers, that clock
042uh has started back in um March. Uh and a school and a and a few schools have have requested that we sort of allow, uh due to circumstances around testing and things like that, additional time. Uh and as long as the school communicates, we've we've allowed that. Uh but at the end of May, we will reassess where we at to see if we have the opportunity to open up the program to any additional schools uh and to see where we're at. Uh also, the new legislative session is coming to uh going to begin work uh for the state, and we plan on requesting additional funds. But we need to be able to show uh that the schools are using uh the EDR that that we currently have budget for, and that we need more money.
043If if we don't have schools that are actively participating in the program, it's kind of hard for us to go and ask for more money when we still have uh uh unallocated agents. Uh as of this conversation today, we are actually above uh the allocated amount, and so we are being very very mindful of uh adding additional funds within the funds that we already had, getting a little creative, if you will. Uh so, it's been great response to the recent realignment efforts. Uh and if you need to engage with the MSS, uh the MSS has provided there some some contact information uh that you can just email them, and they can assist, um whether it be through their MSS outreach email or something specific to to to for the EDR service. Just at a high
044level, this is the sort of workflow that has been uh set up uh between uh SAIC and TEA. Uh there was a lot of communication back and forth to make sure that the process from beginning to end was smooth for all parties involved. Uh I won't go into details to all the different pieces, but just know that there is a workflow that we follow. Starts off with the uh customer submitting a request. There are different approval paths uh to allow the schools to receive the amount of agents. We of course check to see that enrollment numbers match the request and things like that. We make sure that certain communication is established with the school. And then the EDR services is begun with a with a SVM meeting between SAIC and the customer to begin employment.
045Uh Then Daniel, Daniel, just I'll add some light on that. So, one thing for expectations for everybody is we actually do have a program management office that we so that these the determined to make these as smooth and as seamless as possible for for for all the school districts. We actually have dedicated project managers. We have dedicated project team that will work with you and actually setting up and executing your deployment. So, there's a there's a large group of people that you will could receive contact from. And that and it all starts with that SVM or the service validation kickoff. And from there, that's when we can that's when we'll get into the details of okay, here's here's level of effort, here is the expected time frame, and also goes through some of the beginning
046aspects of and here's how we get everything configured and set up with you. So, we do run these as a project with standardization across each of the projects to kind of help everybody come up to speed as quickly as possible. And so uh I think uh I feel like there's been a great partnership with TEA and MSS and taking into account what what is it that what are the pain points and what is it that we need to do to make this as easy as possible. And we've uh gone through several iterations of this process with uh some onboarding. Uh and we've done postmortems to say, "Hey, did that work? Did that not work? What do we need to change?" So, uh know that uh know that a lot of effort this is not just
047something that was created out of the box and then we're just kind of taking a cookie-cutter approach, but it actually has been something that we've been that's been tested, that's been refined. And uh so uh it should be should should be beneficial to ramping everybody up as quickly as possible. So. And we won't we won't bore everybody by reading all the bullet points in there, but we just we did want to show we have a process. Uh it has been vetted, it has been tested. And uh it's uh uh it's it's quite it's it's quite refined now. So, um so, yeah. Yep. Thank you, Frank. >> [clears throat] >> And one of the things we wanted to note as part of the process cuz this has been a slight uh hiccup, if you will, for
048for many of our schools is that once you submit your request through the MSS portal uh the first approval is actually the school itself. Uh and so, this has raised some eyebrows and some questions around if I just submitted the request, why do I got to approve what I just submitted? And the reason is because the MSS portal is not just used by the schools, it's used by our other state agencies here in Texas. And many of the organizations, including some of our schools, have different folks that are required to approve anything that is uh money related. And so, for the for the services as part of the CAP 12 initiative, EDR and the TCF assessments, there are no uh funds, but if there were, somebody at the school would need to approve of those.
049Uh and so, the the workflow is is configured to be the same for all of our partners, all of our schools, all of our state agencies, not just for the schools. And so after he after somebody submits a request, the school then has to go back in there and then approve it before it even starts its journey. So, this link here, uh, that that that's showing here, after you submit your request, you should receive an email that says, "Hey, you know, this is waiting for your approval." Which maybe kind of confuses some folks, uh, because it's not very you know, I just submitted it, why do I got to approve? But just know that if you click on this link and it does show you as needing to approve something, it's because it's exactly that.
050It's still waiting even though you just submitted it, it's waiting for you to approve it in case there was a financial requirement that needed to be, uh, approved by by the school, whether it be your your financial, uh, your business office or anything else. But if not, then you can just submit it through, click approve, and then it'll go on to its next checkpoint. So, we wanted to make sure that schools are aware, um, that this this little hiccup, uh, does delay things sometimes. We do have visibility to these and we do communicate with the schools, "Hey, we've noticed that this is kind of here for for for for 48 hours now. Wondering if there's any assistance you need." And we'll try to communicate that to to get it going. So, we we've learned, you
051know, over time, you know, this is one of those nuances, uh, that we're trying to make sure that it doesn't stop approval from going through. So, just be aware of that. Next slide, please. And then in the portal as well, not only can you request the services, uh, you can also request assistance. Uh, some of the assistance is for example, if if you need somebody else added to your console, your EDR console, um, or if you need, uh, somebody, you know, forgot their credentials for the console. You can submit requests through the MSS portal for assistance in regaining access to to your console, whether that be SentinelOne or CrowdStrike. Uh, if if an employee leaves and you need to remove them from access to the console, then this is also the the the method you
052would use to to remove somebody from from access to your EDR console. If you are experiencing any technical issues or need any configuration changes or things like that, so you need to tweak your your EDR settings, anything like that, you can also submit a request through the MSS other operational services request. And and know that that it there's a large team behind there that monitors these and make sure that they get to the right folks so they can get to you as soon as possible. This is the the the best and recommended way to submit these type of requests because this will ensure that one, everybody's accountable, right? So once they receive the the the clock is ticking. We want to make sure that all these are are met within certain criteria to make sure
053that nothing is left, you know, for a week without being answered. Uh, and if if it is, then then then we have conversations around that. That's never happened, thankfully, but we have had schools that maybe email for some support and and unfortunately sometimes the email routes to different places and it just takes long to get to the right people. So our recommendation is to always use the MSS portal, these two specific requests to make sure that if you are needing access changes to the console or experiencing any technical issues with your EDR, that that is communicated promptly to the teams that will help you to get that resolved. And Daniel, thank you for bringing that up because I will I will say on the when it comes to um, interacting, the portal is monitored and
054measured. So we are held accountable to tickets that are entered in requests that are ticket that are entered through the portal. The email, while it's great after that initial request, uh, the email is not monitored and uh, as Daniel said, sometimes, you know, with the routing, uh, depending on depending on who's who's out of the office that day, it there is there is a danger of that it uh could sit there until the person comes back into the office. So, uh, our recommendation, as Daniel said, is to start with a portal. Uh and that will be that is the the fastest and also the most accountable way to get in touch with us. The other thing, too, that I will say is is if you need assistance if if you forget you know, this this
055often the the portal is not something that we access every day, so we may forget. Is if you need assistance with this, also I recommend you communicate with your ESCs. All of the ESCs have the same information and can also guide you on how to submit this request and can even walk you through how to submit the request, especially if you lose access to just the MSS portal itself. They the ESC can help you to regain access to that. So, the ESC is also another valuable resource that you can use to make sure that your your your request does not go lost. Next screen, please. So, Okay. Oh, I'll So, Daniel, thank you so much. Um Appreciate that. So, uh with that kind of that that's getting to the end of the webinar. Wanted to
056one and uh wanted to send some appreciation one first to Shawn. We've had Adam Weiss in the background answering questions. So, just wanted to bring the MSS team uh to for you all to be able to know that, hey, there are people behind here actually supporting me. For all of you who are existing customers. And then all and also to let people know that, hey, we actually do have a team of folks to support the state of Texas. Daniel, thank you for going through some of the TEA specifics uh that are relevant to this audience um and uh uh communicate us that we all can understand expectations moving forward. I will say um you know, a couple of ways that you can stay informed. Well, first one is through the TEA website. Um you know,
057we have a cyber security website that's we keep up to date. Uh TA does a great job uh to make sure that you have the most relevant and up-to-date information uh on the on the new comings and goings of the available security services beyond just what we presented today. Uh you know, so on that you can find things such as uh uh uh questionnaire or frequently asked question responses for things like onboarding, what do I do in this situation, who do I talk to. Um you know, and things such as that. You can also reach out to the TEA email web link our email domain that we have out there as well. For specifics to MSS and this EDR service that we went over today. And believe me, today was just a brief overview. There's
058a lot more to it than what we could present just in an hour uh that that we can bring these tools can bring to you. That these tools can be used to help secure your environment and increase your security posture uh to make sure that we're doing the right things uh for the students, for the administration, and the you know, the taxpayers. Uh so, you'll see the portal link out here for MSS services as well as a uh the ability the MSS phone number as well. If you have just, hey, over, you know, just more generalized questions about a whole host of services, start with MSI. Uh they they they are really kind of entry way around that general overarching uh security portfolio. And then, as always, you can reach out to us uh with
059that link there. So, uh with that, thank you everybody who um uh entered questions in the Q&A. And uh we will be working to um you know, we will get answers for you. So, with that, Daniel, I will kick it off over to you uh to uh send us off. All right. Well, Frank and and the rest of the MS-ISAC team, I I want to thank you for your time uh today in putting this presentation together. We had several requests from schools that wanted to know more about the program or schools that were currently in the program who wanted to meet the sort of the the wizards behind the curtain, if you will. Uh and so, that was the purpose of this presentation. It's to make sure that you know that there is a large
060team of folks that are out there supporting uh the services that we provide through the MSS uh portal. Uh currently for the initiative, it's both the EDR service and the TCF assessments. And so, that will continue as we move to to the next set of services, which we won't discuss here. We've talked about that a lot. But, I want to thank uh all the schools that joined us also in this conversation. I hope that it's been beneficial to you in learning more about the program, getting to meet the MS-ISAC team, which which manages the MSS, uh and uh is the ones that are 24/7 looking at your machines, making sure that nothing goes awry. We have received a lot of information from those that are already in the program uh how this has helped to
061make sure that ransomware did not impact the school system. We have many stories on that. And this is why we have made every effort to ensure that our schools deploy to all in scope systems. Misconfiguration [clears throat] or excuse me. Misconfiguration or not having this deployed to all in scope systems, especially servers and and and those type of things can be the difference between being a successful case of of of EDR coming to the rescue and or a sad story of where EDR could have helped to prevent the issue. So again, thank you for all the schools and all the work you do to secure and make sure that that education happens. If you have any questions, we provided the information both through SAIC and through TEA. I hope that you have enjoyed the presentation
062and we will now return you to the rest of your day. Thank you.