BACKGROUND

Catholic Charities of Santa Clara County has been a local community lifeline for more than 50 years, serving 27,000 clients annually with more than 45 services ranging from housing to job skills training to mental health and substance abuse counseling, youth services and education. Catholic Charities is also designated as an early responder, assisting the community in the event of a natural disaster or other crisis.

MPLS NETWORK UPGRADE DEMANDS ENTERPRISE CLASS FIREWALL

In order to better serve their clients, business partners and 400 employees, the Catholic Charities of Santa Clara County recently upgraded their infrastructure to an MPLS network, connecting their seven sites and consolidating their Internet connectivity into a single high speed pipe. The end goal of the upgrade process was secure, reliable connectivity. As a provider of many different services to the community, the Catholic Charities is subject to several governmental regulations, including HIPAA. Consequently, Will Bailey, IT Manager, required a new firewall as part of the network infrastructure upgrade process.

The firewall that Catholic Charities selected and deployed to protect the network and ensure appropriate network usage is the Palo Alto Networks PA-4020. Will liked the fact that he could deploy a firewall to perform traditional access control functions while at the same time providing application visibility and the ability to implement appropriate application usage control policies. And with a small IT department– the fact that the PA-4020 is very easy to use would mean that protecting the network would take less time than the previous solution.

AN IMMEDIATE BENEFIT

Within hours of placing the PA-4020 on the network, Will saw an inordinate amount of traffic flowing from a workstation that, upon further investigation, was infected with a wide range of malware. The infected PC was sending out a large volume of traffic which resulted in the Catholic Charities landing on an email Blacklist. For the Catholic Charities, being Blacklisted meant that email communications with business partners and clients – a critical requirement of their daily operations - was limited at best. Luckily, the spyware laden system was found quickly and pulled
offline before the Blacklist issue became too severe. Will worked quickly to get them off the Blacklist, bringing email communications back to normal.

The application visibility and control that Will now has at his fingertips has shed new light on how employees and clients are using the network. The visibility has both positive and negative aspects. In addition to the infected PC, Will discovered other issues that were quickly resolved:

• Several machines were getting Microsoft updates from the wrong location.
• Some users were using streaming video and a policy was implemented to control
  the usage.
• Several instances of unauthorized P2P applications were identified and subsequently
  controlled.
• The computer lab was being used for more than just lab work. Policies were implemented to control both the applications and web traffic emanating from the lab. Even after the policies were implemented, Will watched as some users tried to circumvent the control mechanisms with a Proxy, a move that Will had anticipated and taken care of with a security rule.

Will concludes, “My goal was to implement a firewall that would allow me to sleep at night and with Palo Alto Networks protecting our network, I sleep like a baby. The visibility and control we now have is allowing us to look at implementing and enforcing new policies that dictate appropriate PC, network and application usage.”