McGraw Hill Amplifies Security Efficiency With Splunk SOAR

Small teams need the right tools to work efficiently.

As a learning sciences company, McGraw Hill provides customized educational content, software and services for pre-school through postgraduate education. The organization also has a large digital products group that develops learning sciences platforms. McGraw Hill currently operates in 28 countries, has more than 5,000 employees globally, and offers products and services to over 135 countries in 60+ languages. 

Because they provide an essential product globally, it is critical that the McGraw Hill team do so securely — and they learned how through experience. 

“We had an incident when copies of our internal user addresses were released, and we received tons of phish to exploit the situation,” says Jason Mihalow, senior cloud cyber security architect. “When something like this hits, the clock starts.” These incidents were monitored through a simple email inbox, and with few people to monitor this inbox, it was impossible to clear them all. “It's a completely manual process,” says Mihalow. “When you’re targeted by a few of these waves, you come to realize there's no number of people who can solve the problem. Automation is the only solution.”

The Right Tool for the Job

With Splunk SOAR, McGraw Hill is able to automate its response to these threats. Now, the McGraw Hill team automatically puts all of these reports into Splunk SOAR and pulls them into a container. “A container case management–based system prevents us from having to chase down emails in an inbox,” says Mihalow. “We have everything in a single system, and we know everything's been addressed. We have a record of what happened and what the analyst has done, which has been a generational leap for us.”

Before Splunk SOAR, Mihalow says all of this information lived in 10 different tools and completely disparate logs. Consolidating this all into Splunk SOAR has been a huge help to the team. “Instead of having to go into other tools and do that blocking there, I've created playbooks that can automatically do that stuff,” says Mihalow. “Analysts now don't have to leave Splunk SOAR to respond to the malicious emails.”

This shift has saved McGraw Hill time on training new analysts who join the team. “Splunk SOAR has enabled us to consolidate our SOC. Previously, when we hired someone, we had to say, ‘here are your 10 tools and how to use them,’” says Mihalow. “Now, I can abstract all of that and just introduce Splunk SOAR. It brought all of our operations into a single place that we can maintain.”

The Splunk SOAR Advantage

Since McGraw Hill implemented Splunk SOAR, team members have seen a variety of changes in how they handle security. “We have found many use cases for Splunk SOAR,” says Mihalow. “In total, we have 40 something playbooks that I've created. We use it for everything.”